Edit tour

Windows Analysis Report
Kawpow new.exe

Overview

General Information

Sample name:	Kawpow new.exe
Analysis ID:	1585413
MD5:	fb6a3b436e9f9402937d95f755b62f91
SHA1:	aea3a8a311c2b8b6fc7d9d263b952f95a30b180e
SHA256:	4c9d878e35e7fd497c633a770d3359fb37447985450dc19f45db0925972c39e0
Tags:	CoinMinerexeuser-aachum
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Disable power options

Sigma detected: Stop EventLog

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Changes security center settings (notifications, updates, antivirus, firewall)

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Hooks files or directories query functions (used to hide files and directories)

Hooks processes query functions (used to hide processes)

Hooks registry keys query functions (used to hide registry keys)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Installs new ROOT certificates

Loading BitLocker PowerShell Module

Modifies power options to not sleep / hibernate

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Uses powercfg.exe to modify the power settings

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Powershell Defender Exclusion

Sigma detected: Uncommon Svchost Parent Process

Stores large binary data to the registry

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

svchost.exe (PID: 6892 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

SgrmBroker.exe (PID: 6816 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)

Kawpow new.exe (PID: 5520 cmdline: "C:\Users\user\Desktop\Kawpow new.exe" MD5: FB6A3B436E9F9402937D95F755B62F91)

powershell.exe (PID: 6372 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7252 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

cmd.exe (PID: 7324 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 7416 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

sc.exe (PID: 7332 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7432 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7480 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7528 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7576 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7584 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7624 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7632 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7648 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7664 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dialer.exe (PID: 7692 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

winlogon.exe (PID: 556 cmdline: winlogon.exe MD5: F8B41A1B3E569E7E6F990567F21DCE97)

lsass.exe (PID: 632 cmdline: C:\Windows\system32\lsass.exe MD5: A1CC00332BBF370654EE3DC8CDC8C95A)

svchost.exe (PID: 2524 cmdline: C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 912 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dwm.exe (PID: 976 cmdline: "dwm.exe" MD5: 5C27608411832C5B39BA04E33D53536C)

svchost.exe (PID: 356 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 704 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 932 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1044 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1064 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1080 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1188 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1212 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1344 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s nsi MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

sc.exe (PID: 7732 cmdline: C:\Windows\system32\sc.exe delete "CKTJZLMO" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7848 cmdline: C:\Windows\system32\sc.exe create "CKTJZLMO" binpath= "C:\ProgramData\wwuujrlkomwy\eejhedztifcv.exe" start= "auto" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7900 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7908 cmdline: C:\Windows\system32\sc.exe start "CKTJZLMO" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7924 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 720 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

eejhedztifcv.exe (PID: 7984 cmdline: C:\ProgramData\wwuujrlkomwy\eejhedztifcv.exe MD5: FB6A3B436E9F9402937D95F755B62F91)

cleanup

Sigma Signatures

Change of critical system settings

Sigma detected: Disable power options

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: "C:\Users\user\Desktop\Kawpow new.exe", ParentImage: C:\Users\user\Desktop\Kawpow new.exe, ParentProcessId: 5520, ParentProcessName: Kawpow new.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 7624, ProcessName: powercfg.exe

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Kawpow new.exe", ParentImage: C:\Users\user\Desktop\Kawpow new.exe, ParentProcessId: 5520, ParentProcessName: Kawpow new.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 6372, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\Windows\system32\dialer.exe, ParentImage: C:\Windows\System32\dialer.exe, ParentProcessId: 7692, ParentProcessName: dialer.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, ProcessId: 912, ProcessName: svchost.exe

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "CKTJZLMO" binpath= "C:\ProgramData\wwuujrlkomwy\eejhedztifcv.exe" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "CKTJZLMO" binpath= "C:\ProgramData\wwuujrlkomwy\eejhedztifcv.exe" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\Kawpow new.exe", ParentImage: C:\Users\user\Desktop\Kawpow new.exe, ParentProcessId: 5520, ParentProcessName: Kawpow new.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "CKTJZLMO" binpath= "C:\ProgramData\wwuujrlkomwy\eejhedztifcv.exe" start= "auto", ProcessId: 7848, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Kawpow new.exe", ParentImage: C:\Users\user\Desktop\Kawpow new.exe, ParentProcessId: 5520, ParentProcessName: Kawpow new.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 6372, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, ProcessId: 6892, ProcessName: svchost.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Stop EventLog

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\Kawpow new.exe", ParentImage: C:\Users\user\Desktop\Kawpow new.exe, ParentProcessId: 5520, ParentProcessName: Kawpow new.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 7900, ProcessName: sc.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\wwuujrlkomwy\eejhedztifcv.exe

ReversingLabs: Detection: 73%

Multi AV Scanner detection for submitted file

Source: Kawpow new.exe

ReversingLabs: Detection: 73%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: Kawpow new.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Windows\System32\winlogon.exe	Code function: 37_2_000001CA7D1EDCE0 FindFirstFileExW,	37_2_000001CA7D1EDCE0
Source: C:\Windows\System32\lsass.exe	Code function: 43_2_0000017D2DD5DCE0 FindFirstFileExW,	43_2_0000017D2DD5DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_0000022F4B92DCE0 FindFirstFileExW,	44_2_0000022F4B92DCE0
Source: C:\Windows\System32\dwm.exe	Code function: 45_2_00000262F1CDDCE0 FindFirstFileExW,	45_2_00000262F1CDDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_0000023942B1DCE0 FindFirstFileExW,	46_2_0000023942B1DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001EF056DDCE0 FindFirstFileExW,	47_2_000001EF056DDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_000002287AD4DCE0 FindFirstFileExW,	48_2_000002287AD4DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001B94DA9DCE0 FindFirstFileExW,	49_2_000001B94DA9DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_000002520257DCE0 FindFirstFileExW,	50_2_000002520257DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_000001A9EBFCDCE0 FindFirstFileExW,	51_2_000001A9EBFCDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_0000019FF163DCE0 FindFirstFileExW,	53_2_0000019FF163DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000002A76A1ADCE0 FindFirstFileExW,	54_2_000002A76A1ADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_000002234E13DCE0 FindFirstFileExW,	55_2_000002234E13DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_0000014D269CDCE0 FindFirstFileExW,	56_2_0000014D269CDCE0

Source: svchost.exe, 00000000.00000002.1371387005.000001DC42C13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: svchost.exe, 00000000.00000003.1370590097.000001DC42C57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371547103.000001DC42C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000000.00000003.1370590097.000001DC42C57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371547103.000001DC42C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 00000000.00000003.1370289694.000001DC42C5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1369251202.000001DC42C6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1370561544.000001DC42C41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371645071.000001DC42C70000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1369479480.000001DC42C62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371511467.000001DC42C42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371594263.000001DC42C63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000000.00000003.1369251202.000001DC42C6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371645071.000001DC42C70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000000.00000003.1370590097.000001DC42C57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371547103.000001DC42C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000000.00000003.1369407878.000001DC42C67000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371621084.000001DC42C68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000000.00000002.1371678039.000001DC42C77000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1369006554.000001DC42C75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 00000000.00000003.1370590097.000001DC42C57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371547103.000001DC42C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000000.00000003.1370289694.000001DC42C5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371426876.000001DC42C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1369479480.000001DC42C62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371594263.000001DC42C63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000000.00000003.1370590097.000001DC42C57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371547103.000001DC42C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000000.00000002.1371426876.000001DC42C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1369407878.000001DC42C67000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371621084.000001DC42C68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000000.00000003.1370590097.000001DC42C57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371547103.000001DC42C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000000.00000003.1370590097.000001DC42C57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371547103.000001DC42C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000000.00000003.1370590097.000001DC42C57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371547103.000001DC42C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000000.00000002.1371426876.000001DC42C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1369479480.000001DC42C62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371594263.000001DC42C63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000000.00000003.1370561544.000001DC42C41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371511467.000001DC42C42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000000.00000003.1370590097.000001DC42C57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371547103.000001DC42C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000000.00000003.1369479480.000001DC42C62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371594263.000001DC42C63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000000.00000003.1370561544.000001DC42C41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1370689484.000001DC42C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&
Source: svchost.exe, 00000000.00000003.1370615655.000001DC42C31000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371594263.000001DC42C63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000000.00000002.1371511467.000001DC42C42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000000.00000003.1369479480.000001DC42C62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371594263.000001DC42C63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000000.00000003.1370561544.000001DC42C41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371511467.000001DC42C42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=
Source: svchost.exe, 00000000.00000002.1371547103.000001DC42C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000000.00000003.1370590097.000001DC42C57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371547103.000001DC42C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000000.00000003.1263586331.000001DC42C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 00000000.00000002.1371426876.000001DC42C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1369407878.000001DC42C67000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371621084.000001DC42C68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000000.00000003.1370561544.000001DC42C41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000000.00000003.1370376947.000001DC42C48000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371511467.000001DC42C42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1370615655.000001DC42C39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000000.00000003.1370615655.000001DC42C39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000000.00000003.1263586331.000001DC42C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000000.00000002.1371426876.000001DC42C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000000.00000003.1370590097.000001DC42C57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371547103.000001DC42C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000000.00000003.1370590097.000001DC42C57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371547103.000001DC42C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=

System Summary

Uses powercfg.exe to modify the power settings

Source: C:\Users\user\Desktop\Kawpow new.exe

Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

Source: C:\Windows\System32\dialer.exe	Code function: 31_2_00000001400010C0 OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,	31_2_00000001400010C0
Source: C:\Windows\System32\winlogon.exe	Code function: 37_2_000001CA7D1E28C8 NtEnumerateValueKey,NtEnumerateValueKey,	37_2_000001CA7D1E28C8
Source: C:\Windows\System32\lsass.exe	Code function: 43_2_0000017D2DD5202C NtQuerySystemInformation,StrCmpNIW,	43_2_0000017D2DD5202C
Source: C:\Windows\System32\dwm.exe	Code function: 45_2_00000262F1CD28C8 NtEnumerateValueKey,NtEnumerateValueKey,	45_2_00000262F1CD28C8
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_000002287AD4202C NtQuerySystemInformation,StrCmpNIW,	48_2_000002287AD4202C

Source: C:\Windows\System32\dialer.exe	Code function: 31_2_000000014000226C	31_2_000000014000226C
Source: C:\Windows\System32\dialer.exe	Code function: 31_2_00000001400014D8	31_2_00000001400014D8
Source: C:\Windows\System32\dialer.exe	Code function: 31_2_0000000140002560	31_2_0000000140002560
Source: C:\Windows\System32\winlogon.exe	Code function: 37_2_000001CA7D1C38A8	37_2_000001CA7D1C38A8
Source: C:\Windows\System32\winlogon.exe	Code function: 37_2_000001CA7D1BD0E0	37_2_000001CA7D1BD0E0
Source: C:\Windows\System32\winlogon.exe	Code function: 37_2_000001CA7D1B1F2C	37_2_000001CA7D1B1F2C
Source: C:\Windows\System32\winlogon.exe	Code function: 37_2_000001CA7D1F6218	37_2_000001CA7D1F6218
Source: C:\Windows\System32\winlogon.exe	Code function: 37_2_000001CA7D1F44A8	37_2_000001CA7D1F44A8
Source: C:\Windows\System32\winlogon.exe	Code function: 37_2_000001CA7D1EDCE0	37_2_000001CA7D1EDCE0
Source: C:\Windows\System32\winlogon.exe	Code function: 37_2_000001CA7D1F6100	37_2_000001CA7D1F6100
Source: C:\Windows\System32\winlogon.exe	Code function: 37_2_000001CA7D1F6100	37_2_000001CA7D1F6100
Source: C:\Windows\System32\winlogon.exe	Code function: 37_2_000001CA7D1E2B2C	37_2_000001CA7D1E2B2C
Source: C:\Windows\System32\lsass.exe	Code function: 43_2_0000017D2DD21F2C	43_2_0000017D2DD21F2C
Source: C:\Windows\System32\lsass.exe	Code function: 43_2_0000017D2DD2D0E0	43_2_0000017D2DD2D0E0
Source: C:\Windows\System32\lsass.exe	Code function: 43_2_0000017D2DD338A8	43_2_0000017D2DD338A8
Source: C:\Windows\System32\lsass.exe	Code function: 43_2_0000017D2DD52B2C	43_2_0000017D2DD52B2C
Source: C:\Windows\System32\lsass.exe	Code function: 43_2_0000017D2DD5DCE0	43_2_0000017D2DD5DCE0
Source: C:\Windows\System32\lsass.exe	Code function: 43_2_0000017D2DD644A8	43_2_0000017D2DD644A8
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_0000022F4B8F1F2C	44_2_0000022F4B8F1F2C
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_0000022F4B8FD0E0	44_2_0000022F4B8FD0E0
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_0000022F4B9038A8	44_2_0000022F4B9038A8
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_0000022F4B922B2C	44_2_0000022F4B922B2C
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_0000022F4B92DCE0	44_2_0000022F4B92DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_0000022F4B9344A8	44_2_0000022F4B9344A8
Source: C:\Windows\System32\dwm.exe	Code function: 45_2_00000262F1CA1F2C	45_2_00000262F1CA1F2C
Source: C:\Windows\System32\dwm.exe	Code function: 45_2_00000262F1CB38A8	45_2_00000262F1CB38A8
Source: C:\Windows\System32\dwm.exe	Code function: 45_2_00000262F1CAD0E0	45_2_00000262F1CAD0E0
Source: C:\Windows\System32\dwm.exe	Code function: 45_2_00000262F1CD2B2C	45_2_00000262F1CD2B2C
Source: C:\Windows\System32\dwm.exe	Code function: 45_2_00000262F1CE6218	45_2_00000262F1CE6218
Source: C:\Windows\System32\dwm.exe	Code function: 45_2_00000262F1CE6100	45_2_00000262F1CE6100
Source: C:\Windows\System32\dwm.exe	Code function: 45_2_00000262F1CE6100	45_2_00000262F1CE6100
Source: C:\Windows\System32\dwm.exe	Code function: 45_2_00000262F1CE44A8	45_2_00000262F1CE44A8
Source: C:\Windows\System32\dwm.exe	Code function: 45_2_00000262F1CDDCE0	45_2_00000262F1CDDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_0000023942AE1F2C	46_2_0000023942AE1F2C
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_0000023942AF38A8	46_2_0000023942AF38A8
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_0000023942AED0E0	46_2_0000023942AED0E0
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_0000023942B12B2C	46_2_0000023942B12B2C
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_0000023942B244A8	46_2_0000023942B244A8
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_0000023942B1DCE0	46_2_0000023942B1DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001EF056AD0E0	47_2_000001EF056AD0E0
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001EF056B38A8	47_2_000001EF056B38A8
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001EF056A1F2C	47_2_000001EF056A1F2C
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001EF056DDCE0	47_2_000001EF056DDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001EF056E44A8	47_2_000001EF056E44A8
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001EF056D2B2C	47_2_000001EF056D2B2C
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001EF056E6218	47_2_000001EF056E6218
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_000002287AD42B2C	48_2_000002287AD42B2C
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_000002287AD544A8	48_2_000002287AD544A8
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_000002287AD4DCE0	48_2_000002287AD4DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001B94DA61F2C	49_2_000001B94DA61F2C
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001B94DA738A8	49_2_000001B94DA738A8
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001B94DA6D0E0	49_2_000001B94DA6D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001B94DA92B2C	49_2_000001B94DA92B2C
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001B94DAA44A8	49_2_000001B94DAA44A8
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001B94DA9DCE0	49_2_000001B94DA9DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_0000025202541F2C	50_2_0000025202541F2C
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_000002520254D0E0	50_2_000002520254D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_00000252025538A8	50_2_00000252025538A8
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_0000025202572B2C	50_2_0000025202572B2C
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_000002520257DCE0	50_2_000002520257DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_00000252025844A8	50_2_00000252025844A8
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_000001A9EBFCDCE0	51_2_000001A9EBFCDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_000001A9EBFD44A8	51_2_000001A9EBFD44A8
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_000001A9EBFC2B2C	51_2_000001A9EBFC2B2C
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_0000019FF1601F2C	53_2_0000019FF1601F2C
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_0000019FF160D0E0	53_2_0000019FF160D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_0000019FF16138A8	53_2_0000019FF16138A8
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_0000019FF1632B2C	53_2_0000019FF1632B2C
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_0000019FF163DCE0	53_2_0000019FF163DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_0000019FF16444A8	53_2_0000019FF16444A8
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000002A76A1838A8	54_2_000002A76A1838A8
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000002A76A17D0E0	54_2_000002A76A17D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000002A76A171F2C	54_2_000002A76A171F2C
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000002A76A1B44A8	54_2_000002A76A1B44A8
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000002A76A1ADCE0	54_2_000002A76A1ADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000002A76A1B60F0	54_2_000002A76A1B60F0
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000002A76A1A2B2C	54_2_000002A76A1A2B2C
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_000002234E1138A8	55_2_000002234E1138A8
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_000002234E10D0E0	55_2_000002234E10D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_000002234E101F2C	55_2_000002234E101F2C
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_000002234E1444A8	55_2_000002234E1444A8
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_000002234E13DCE0	55_2_000002234E13DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_000002234E132B2C	55_2_000002234E132B2C
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_0000014D26991F2C	56_2_0000014D26991F2C
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_0000014D269A38A8	56_2_0000014D269A38A8
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_0000014D2699D0E0	56_2_0000014D2699D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_0000014D269C2B2C	56_2_0000014D269C2B2C
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_0000014D269D44A8	56_2_0000014D269D44A8
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_0000014D269CDCE0	56_2_0000014D269CDCE0

Source: Joe Sandbox View

Dropped File: C:\ProgramData\wwuujrlkomwy\eejhedztifcv.exe 4C9D878E35E7FD497C633A770D3359FB37447985450DC19F45DB0925972C39E0

Source: classification engine

Classification label: mal100.spyw.evad.winEXE@56/69@0/0

Source: C:\Windows\System32\dialer.exe

Code function: 31_2_000000014000226C GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,FindResourceExA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx,

31_2_000000014000226C

Source: C:\Windows\System32\dialer.exe

Code function: 31_2_00000001400019C4 SysAllocString,SysAllocString,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,CoUninitialize,SysFreeString,SysFreeString,

31_2_00000001400019C4

Source: C:\Windows\System32\dialer.exe

31_2_000000014000226C

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7340:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7584:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7676:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7924:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7348:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7656:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7704:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5608:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7916:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7780:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7440:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7856:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7536:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7488:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7640:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gs1rry12.jcn.ps1

Jump to behavior

Source: Kawpow new.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Kawpow new.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Kawpow new.exe

ReversingLabs: Detection: 73%

Source: C:\Users\user\Desktop\Kawpow new.exe

File read: C:\Users\user\Desktop\Kawpow new.exe

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Users\user\Desktop\Kawpow new.exe "C:\Users\user\Desktop\Kawpow new.exe"
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "CKTJZLMO"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "CKTJZLMO" binpath= "C:\ProgramData\wwuujrlkomwy\eejhedztifcv.exe" start= "auto"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "CKTJZLMO"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\wwuujrlkomwy\eejhedztifcv.exe C:\ProgramData\wwuujrlkomwy\eejhedztifcv.exe
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc	Jump to behavior
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc	Jump to behavior
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv	Jump to behavior
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits	Jump to behavior
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc	Jump to behavior
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "CKTJZLMO"	Jump to behavior
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "CKTJZLMO" binpath= "C:\ProgramData\wwuujrlkomwy\eejhedztifcv.exe" start= "auto"	Jump to behavior
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog	Jump to behavior
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "CKTJZLMO"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "CKTJZLMO" binpath= "C:\ProgramData\wwuujrlkomwy\eejhedztifcv.exe" start= "auto"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior

Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: moshost.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapsbtsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mosstorage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapconfiguration.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kawpow new.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\wwuujrlkomwy\eejhedztifcv.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Kawpow new.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: Kawpow new.exe

Static file information: File size 5471744 > 1048576

Source: Kawpow new.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x52a800

Source: Kawpow new.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Kawpow new.exe	Static PE information: section name: .00cfg
Source: eejhedztifcv.exe.4.dr	Static PE information: section name: .00cfg

Source: C:\Windows\System32\winlogon.exe	Code function: 37_2_000001CA7D1CACDD push rcx; retf 003Fh	37_2_000001CA7D1CACDE
Source: C:\Windows\System32\winlogon.exe	Code function: 37_2_000001CA7D1FC6DD push rcx; retf 003Fh	37_2_000001CA7D1FC6DE
Source: C:\Windows\System32\lsass.exe	Code function: 43_2_0000017D2DD3ACDD push rcx; retf 003Fh	43_2_0000017D2DD3ACDE
Source: C:\Windows\System32\lsass.exe	Code function: 43_2_0000017D2DD6C6DD push rcx; retf 003Fh	43_2_0000017D2DD6C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_0000022F4B90ACDD push rcx; retf 003Fh	44_2_0000022F4B90ACDE
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_0000022F4B93C6DD push rcx; retf 003Fh	44_2_0000022F4B93C6DE
Source: C:\Windows\System32\dwm.exe	Code function: 45_2_00000262F1CBACDD push rcx; retf 003Fh	45_2_00000262F1CBACDE
Source: C:\Windows\System32\dwm.exe	Code function: 45_2_00000262F1CEC6DD push rcx; retf 003Fh	45_2_00000262F1CEC6DE
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_0000023942AFACDD push rcx; retf 003Fh	46_2_0000023942AFACDE
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_0000023942B2C6DD push rcx; retf 003Fh	46_2_0000023942B2C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001EF056BACDD push rcx; retf 003Fh	47_2_000001EF056BACDE
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001EF056EC6DD push rcx; retf 003Fh	47_2_000001EF056EC6DE
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_000002287AD5C6DD push rcx; retf 003Fh	48_2_000002287AD5C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001B94DA7ACDD push rcx; retf 003Fh	49_2_000001B94DA7ACDE
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001B94DAAC6DD push rcx; retf 003Fh	49_2_000001B94DAAC6DE
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_000002520255ACDD push rcx; retf 003Fh	50_2_000002520255ACDE
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_000002520258C6DD push rcx; retf 003Fh	50_2_000002520258C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_000001A9EBFDC6DD push rcx; retf 003Fh	51_2_000001A9EBFDC6DE
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_0000019FF161ACDD push rcx; retf 003Fh	53_2_0000019FF161ACDE
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_0000019FF164C6DD push rcx; retf 003Fh	53_2_0000019FF164C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000002A76A18ACDD push rcx; retf 003Fh	54_2_000002A76A18ACDE
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000002A76A1BC6DD push rcx; retf 003Fh	54_2_000002A76A1BC6DE
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_000002234E11ACDD push rcx; retf 003Fh	55_2_000002234E11ACDE
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_000002234E14C6DD push rcx; retf 003Fh	55_2_000002234E14C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_0000014D269AACDD push rcx; retf 003Fh	56_2_0000014D269AACDE
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_0000014D269DC6DD push rcx; retf 003Fh	56_2_0000014D269DC6DE

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\System32\lsass.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob			Jump to behavior
Source: C:\Windows\System32\lsass.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob			Jump to behavior

Source: C:\Users\user\Desktop\Kawpow new.exe

File created: C:\ProgramData\wwuujrlkomwy\eejhedztifcv.exe

Jump to dropped file

Source: C:\Users\user\Desktop\Kawpow new.exe

File created: C:\ProgramData\wwuujrlkomwy\eejhedztifcv.exe

Jump to dropped file

Source: C:\Users\user\Desktop\Kawpow new.exe

Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc

Hooking and other Techniques for Hiding and Protection

Hooks files or directories query functions (used to hide files and directories)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQueryDirectoryFile

Hooks processes query functions (used to hide processes)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQuerySystemInformation

Hooks registry keys query functions (used to hide registry keys)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: ZwEnumerateValueKey

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: ntdll.dll function: ZwEnumerateKey new code: 0xE9 0x9C 0xC3 0x32 0x2C 0xCF

Source: C:\Windows\System32\lsass.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Windows\System32\dialer.exe

Code function: OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,

31_2_00000001400010C0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5624	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4150	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Window / User API: threadDelayed 1759	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 3948	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 6051	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 8743	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 1192	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Window / User API: threadDelayed 9867	Jump to behavior

Source: C:\Windows\System32\lsass.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep			graph_43-15355
Source: C:\Windows\System32\svchost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep			graph_44-14997

Source: C:\Windows\System32\dialer.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_31-422

Source: C:\Windows\System32\lsass.exe	API coverage: 4.7 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.9 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.7 %
Source: C:\Windows\System32\svchost.exe	API coverage: 6.4 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.9 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.8 %
Source: C:\Windows\System32\svchost.exe	API coverage: 6.4 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.7 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.9 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.8 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.7 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.8 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1408	Thread sleep count: 5624 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1008	Thread sleep count: 4150 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7192	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe TID: 7312	Thread sleep count: 189 > 30	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe TID: 7312	Thread sleep time: -189000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\dialer.exe TID: 7696	Thread sleep count: 1759 > 30	Jump to behavior
Source: C:\Windows\System32\dialer.exe TID: 7696	Thread sleep time: -175900s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 7996	Thread sleep count: 3948 > 30	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 7996	Thread sleep time: -3948000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 7996	Thread sleep count: 6051 > 30	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 7996	Thread sleep time: -6051000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\lsass.exe TID: 8012	Thread sleep count: 8743 > 30	Jump to behavior
Source: C:\Windows\System32\lsass.exe TID: 8012	Thread sleep time: -8743000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\lsass.exe TID: 8012	Thread sleep count: 1192 > 30	Jump to behavior
Source: C:\Windows\System32\lsass.exe TID: 8012	Thread sleep time: -1192000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8076	Thread sleep count: 249 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8076	Thread sleep time: -249000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\dwm.exe TID: 8100	Thread sleep count: 9867 > 30	Jump to behavior
Source: C:\Windows\System32\dwm.exe TID: 8100	Thread sleep time: -9867000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8108	Thread sleep count: 249 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8108	Thread sleep time: -249000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8116	Thread sleep count: 256 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8116	Thread sleep time: -256000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8124	Thread sleep count: 195 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8124	Thread sleep time: -195000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8132	Thread sleep count: 81 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8132	Thread sleep time: -81000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8140	Thread sleep count: 77 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8140	Thread sleep time: -77000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8176	Thread sleep count: 242 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8176	Thread sleep time: -242000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6912	Thread sleep count: 241 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6912	Thread sleep time: -241000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4340	Thread sleep count: 237 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4340	Thread sleep time: -237000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2964	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7452	Thread sleep count: 208 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7452	Thread sleep time: -208000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7300	Thread sleep count: 248 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7300	Thread sleep time: -248000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Last function: Thread delayed
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dwm.exe	Last function: Thread delayed
Source: C:\Windows\System32\dwm.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed

Source: C:\Windows\System32\winlogon.exe	Code function: 37_2_000001CA7D1EDCE0 FindFirstFileExW,	37_2_000001CA7D1EDCE0
Source: C:\Windows\System32\lsass.exe	Code function: 43_2_0000017D2DD5DCE0 FindFirstFileExW,	43_2_0000017D2DD5DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_0000022F4B92DCE0 FindFirstFileExW,	44_2_0000022F4B92DCE0
Source: C:\Windows\System32\dwm.exe	Code function: 45_2_00000262F1CDDCE0 FindFirstFileExW,	45_2_00000262F1CDDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_0000023942B1DCE0 FindFirstFileExW,	46_2_0000023942B1DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001EF056DDCE0 FindFirstFileExW,	47_2_000001EF056DDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_000002287AD4DCE0 FindFirstFileExW,	48_2_000002287AD4DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001B94DA9DCE0 FindFirstFileExW,	49_2_000001B94DA9DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_000002520257DCE0 FindFirstFileExW,	50_2_000002520257DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_000001A9EBFCDCE0 FindFirstFileExW,	51_2_000001A9EBFCDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_0000019FF163DCE0 FindFirstFileExW,	53_2_0000019FF163DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000002A76A1ADCE0 FindFirstFileExW,	54_2_000002A76A1ADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_000002234E13DCE0 FindFirstFileExW,	55_2_000002234E13DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_0000014D269CDCE0 FindFirstFileExW,	56_2_0000014D269CDCE0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Thread delayed: delay time: 30000			Jump to behavior

Source: C:\Windows\System32\dialer.exe

API call chain: ExitProcess graph end node

graph_31-468

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\winlogon.exe

Code function: 37_2_000001CA7D1E7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

37_2_000001CA7D1E7D90

Source: C:\Windows\System32\dialer.exe

Code function: 31_2_00000001400017EC GetProcessHeap,HeapAlloc,OpenProcess,TerminateProcess,CloseHandle,GetProcessHeap,HeapFree,

31_2_00000001400017EC

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\dialer.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\System32\winlogon.exe	Code function: 37_2_000001CA7D1E7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	37_2_000001CA7D1E7D90
Source: C:\Windows\System32\winlogon.exe	Code function: 37_2_000001CA7D1F6218 SetUnhandledExceptionFilter,	37_2_000001CA7D1F6218
Source: C:\Windows\System32\winlogon.exe	Code function: 37_2_000001CA7D1ED2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	37_2_000001CA7D1ED2A4
Source: C:\Windows\System32\lsass.exe	Code function: 43_2_0000017D2DD5D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	43_2_0000017D2DD5D2A4
Source: C:\Windows\System32\lsass.exe	Code function: 43_2_0000017D2DD57D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	43_2_0000017D2DD57D90
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_0000022F4B92D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	44_2_0000022F4B92D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_0000022F4B927D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	44_2_0000022F4B927D90
Source: C:\Windows\System32\dwm.exe	Code function: 45_2_00000262F1CDD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	45_2_00000262F1CDD2A4
Source: C:\Windows\System32\dwm.exe	Code function: 45_2_00000262F1CE6218 SetUnhandledExceptionFilter,	45_2_00000262F1CE6218
Source: C:\Windows\System32\dwm.exe	Code function: 45_2_00000262F1CD7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	45_2_00000262F1CD7D90
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_0000023942B17D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	46_2_0000023942B17D90
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_0000023942B1D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	46_2_0000023942B1D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001EF056D7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	47_2_000001EF056D7D90
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001EF056E6218 SetUnhandledExceptionFilter,	47_2_000001EF056E6218
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000001EF056DD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	47_2_000001EF056DD2A4
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_000002287AD47D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	48_2_000002287AD47D90
Source: C:\Windows\System32\svchost.exe	Code function: 48_2_000002287AD4D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	48_2_000002287AD4D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001B94DA9D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	49_2_000001B94DA9D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 49_2_000001B94DA97D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	49_2_000001B94DA97D90
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_000002520257D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	50_2_000002520257D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_0000025202577D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	50_2_0000025202577D90
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_000001A9EBFC7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	51_2_000001A9EBFC7D90
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_000001A9EBFCD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	51_2_000001A9EBFCD2A4
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_0000019FF163D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	53_2_0000019FF163D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_0000019FF1637D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	53_2_0000019FF1637D90
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000002A76A1A7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	54_2_000002A76A1A7D90
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000002A76A1AD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	54_2_000002A76A1AD2A4
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_000002234E137D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	55_2_000002234E137D90
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_000002234E13D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	55_2_000002234E13D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_0000014D269CD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	56_2_0000014D269CD2A4
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_0000014D269C7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	56_2_0000014D269C7D90

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force			Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\winlogon.exe base: 1CA7D1B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\lsass.exe base: 17D2DD20000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 22F4B8F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dwm.exe base: 262F1CA0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 23942AE0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1EF056A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2287A7D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B94DA60000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 25202540000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1A9EBF90000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 19FF1600000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2A76A170000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 14D26990000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2175D5C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B0AB960000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2129B2A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 26384180000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 25178730000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1495FCF0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 22125D90000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 297A5D80000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2D0F41C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2C325340000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2AEFC900000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 270F3530000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D326280000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 16131E60000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2AE137C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2C93A3B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1E2E4190000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\spoolsv.exe base: 1450000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2AB68FA0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 265951C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2C263510000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2234E100000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 181985A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1EF3C5C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 17ACFCF0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 19E8E330000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B5A2950000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1CD340C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B653790000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B19A0E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 24730B30000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 15F35DA0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\sihost.exe base: 200792F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 18CE9170000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D959540000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 18F1A9A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1FF01350000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\ctfmon.exe base: 221D2530000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D400530000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\explorer.exe base: 8650000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 27844DD0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 258B00D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1FA9A260000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dasHost.exe base: 1BFB71A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 26982020000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 185706E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1496A4A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dllhost.exe base: 190043F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 16215D30000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\smartscreen.exe base: 159AD5E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 221570C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B8E5260000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 189090B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 24BB1240000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 28182CD0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1BD9B7A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 24B0CB90000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 2A85C320000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1CC1F5B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2FC66280000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 275F4C50000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2D46A700000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1CA63DC0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1CDF7340000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Program Files\Windows Defender\MpCmdRun.exe base: 165B0040000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 1B4ABAE0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WMIADAP.exe base: 1E657DE0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WMIADAP.exe base: 1E657E10000 protect: page execute and read and write	Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Windows\System32\dialer.exe

Code function: 31_2_0000000140001C88 CreateProcessW,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAlloc,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,OpenProcess,TerminateProcess,

31_2_0000000140001C88

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\winlogon.exe EIP: 7D1B273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\lsass.exe EIP: 2DD2273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 4B8F273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\dwm.exe EIP: F1CA273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 42AE273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 56A273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 7A7D273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 4DA6273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 254273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: EBF9273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: F160273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 6A17273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 2699273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5D5C273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AB96273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 9B2A273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8418273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7873273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5FCF273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 25D9273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A5D8273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F41C273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2534273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FC90273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F353273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2628273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 31E6273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 137C273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 3A3B273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: E419273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 145273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 68FA273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 951C273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6351273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 4E10273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 985A273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 3C5C273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: CFCF273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8E33273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A295273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 340C273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5379273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 9A0E273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 30B3273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 35DA273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 792F273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: E917273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5954273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1A9A273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 135273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D253273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 53273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 865273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 44DD273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B00D273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 9A26273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B71A273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8202273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 706E273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6A4A273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 43F273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 15D3273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AD5E273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 570C273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: E526273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 90B273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B124273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 82CD273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 9B7A273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: CB9273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5C32273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1F5B273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6628273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F4C5273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6A70273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 63DC273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F734273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\sc.exe EIP: B004273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: ABAE273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 57DE273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 57E1273C	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1CA7D1B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 17D2DD20000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22F4B8F0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 262F1CA0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23942AE0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EF056A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2287A7D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B94DA60000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 25202540000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A9EBF90000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 19FF1600000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A76A170000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 14D26990000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2175D5C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B0AB960000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2129B2A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26384180000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 25178730000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1495FCF0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22125D90000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 297A5D80000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2D0F41C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C325340000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AEFC900000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 270F3530000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D326280000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 16131E60000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AE137C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C93A3B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E2E4190000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 1450000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AB68FA0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 265951C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C263510000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E100000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 181985A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EF3C5C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 17ACFCF0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 19E8E330000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B5A2950000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD340C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B653790000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B19A0E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24730B30000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 15F35DA0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\sihost.exe base: 200792F0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 18CE9170000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D959540000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 18F1A9A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FF01350000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 221D2530000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D400530000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\explorer.exe base: 8650000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 27844DD0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 258B00D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FA9A260000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dasHost.exe base: 1BFB71A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 26982020000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 185706E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1496A4A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 190043F0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 16215D30000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 159AD5E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 221570C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B8E5260000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 189090B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 24BB1240000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 28182CD0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1BD9B7A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 24B0CB90000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 2A85C320000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1CC1F5B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2FC66280000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 275F4C50000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2D46A700000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CA63DC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1CDF7340000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Windows Defender\MpCmdRun.exe base: 165B0040000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1B4ABAE0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1E657DE0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1E657E10000 value starts with: 4D5A	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\System32\dialer.exe

Memory written: PID: 4056 base: 8650000 value: 4D

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\Kawpow new.exe

Thread register set: target process: 7692

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1CA7D1B0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 17D2DD20000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22F4B8F0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 262F1CA0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23942AE0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EF056A0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2287A7D0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B94DA60000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 25202540000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A9EBF90000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 19FF1600000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A76A170000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 14D26990000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2175D5C0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B0AB960000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2129B2A0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26384180000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 25178730000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1495FCF0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22125D90000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 297A5D80000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2D0F41C0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C325340000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AEFC900000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 270F3530000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D326280000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 16131E60000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AE137C0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C93A3B0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E2E4190000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 1450000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AB68FA0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 265951C0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C263510000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E100000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 181985A0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EF3C5C0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 17ACFCF0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 19E8E330000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B5A2950000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD340C0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B653790000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B19A0E0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24730B30000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 15F35DA0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\sihost.exe base: 200792F0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 18CE9170000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D959540000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 18F1A9A0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FF01350000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 221D2530000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D400530000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\explorer.exe base: 8650000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 27844DD0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 258B00D0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FA9A260000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dasHost.exe base: 1BFB71A0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 26982020000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 185706E0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1496A4A0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 190043F0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 16215D30000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 159AD5E0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 221570C0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B8E5260000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 189090B0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 24BB1240000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 28182CD0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1BD9B7A0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 24B0CB90000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 2A85C320000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1CC1F5B0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2FC66280000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 275F4C50000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2D46A700000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CA63DC0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1CDF7340000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Windows Defender\MpCmdRun.exe base: 165B0040000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1B4ABAE0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1E657DE0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1E657E10000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E0D0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E0D0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E0D0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E0D0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E0D0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E0D0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E0D0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E0D0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E0D0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E0D0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E0D0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E160000	Jump to behavior

Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart			Jump to behavior

Source: C:\Windows\System32\dialer.exe

Code function: 31_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

31_2_0000000140001B54

Source: C:\Windows\System32\dialer.exe

Code function: 31_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

31_2_0000000140001B54

Source: winlogon.exe, 00000025.00000000.1351090659.000001CA7D6F0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000025.00000002.2636822919.000001CA7D6F0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: winlogon.exe, 00000025.00000000.1351090659.000001CA7D6F0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000025.00000002.2636822919.000001CA7D6F0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: winlogon.exe, 00000025.00000000.1351090659.000001CA7D6F0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000025.00000002.2636822919.000001CA7D6F0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: ?Program Manager
Source: winlogon.exe, 00000025.00000000.1351090659.000001CA7D6F0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000025.00000002.2636822919.000001CA7D6F0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\winlogon.exe

Code function: 37_2_000001CA7D1C36F0 cpuid

37_2_000001CA7D1C36F0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask VolumeInformation	Jump to behavior

Source: C:\Windows\System32\dialer.exe

Code function: 31_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

31_2_0000000140001B54

Source: C:\Windows\System32\winlogon.exe

Code function: 37_2_000001CA7D1E7960 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

37_2_000001CA7D1E7960

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{D68DDC3A-831F-4fae-9E44-DA132C1ACF46} STATE

Jump to behavior

Modifies power options to not sleep / hibernate

Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\Kawpow new.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior

Source: svchost.exe, 00000008.00000002.2630840838.0000025A87102000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000008.00000002.2630840838.0000025A87102000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\sc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\sc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Windows Service	1 Access Token Manipulation	4 Rootkit	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Credential API Hooking	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Service Execution	1 DLL Side-Loading	1 Windows Service	2 Disable or Modify Tools	LSASS Memory	24 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	713 Process Injection	1 Modify Registry	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	NTDS	21 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Access Token Manipulation	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	713 Process Injection	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Hidden Files and Directories	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Obfuscated Files or Information	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Install Root Certificate	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 DLL Side-Loading	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Kawpow new.exe	74%	ReversingLabs	Win64.Infostealer.Tinba

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\wwuujrlkomwy\eejhedztifcv.exe	74%	ReversingLabs	Win64.Infostealer.Tinba

Source	Detection	Scanner	Label	Link
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 00000000.00000003.1370590097.000001DC42C57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371547103.000001DC42C58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&	svchost.exe, 00000000.00000003.1370561544.000001DC42C41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1370689484.000001DC42C46000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	svchost.exe, 00000000.00000003.1263586331.000001DC42C36000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 00000000.00000003.1369407878.000001DC42C67000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371621084.000001DC42C68000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 00000000.00000003.1370590097.000001DC42C57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371547103.000001DC42C58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 00000000.00000003.1370561544.000001DC42C41000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Transit/Stops/	svchost.exe, 00000000.00000002.1371678039.000001DC42C77000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1369006554.000001DC42C75000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 00000000.00000002.1371426876.000001DC42C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1369407878.000001DC42C67000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371621084.000001DC42C68000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/	svchost.exe, 00000000.00000002.1371426876.000001DC42C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1369479480.000001DC42C62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371594263.000001DC42C63000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 00000000.00000003.1370615655.000001DC42C39000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 00000000.00000003.1370590097.000001DC42C57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371547103.000001DC42C58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=	svchost.exe, 00000000.00000003.1370561544.000001DC42C41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371511467.000001DC42C42000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 00000000.00000003.1369479480.000001DC42C62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371594263.000001DC42C63000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 00000000.00000003.1370376947.000001DC42C48000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371511467.000001DC42C42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1370615655.000001DC42C39000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/V1/MapControlConfiguration/native/	svchost.exe, 00000000.00000003.1263586331.000001DC42C36000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 00000000.00000003.1370590097.000001DC42C57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371547103.000001DC42C58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/	svchost.exe, 00000000.00000003.1370590097.000001DC42C57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371547103.000001DC42C58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 00000000.00000003.1370590097.000001DC42C57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371547103.000001DC42C58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 00000000.00000003.1370590097.000001DC42C57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371547103.000001DC42C58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 00000000.00000003.1370289694.000001DC42C5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1369251202.000001DC42C6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1370561544.000001DC42C41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371645071.000001DC42C70000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1369479480.000001DC42C62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371511467.000001DC42C42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371594263.000001DC42C63000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 00000000.00000002.1371426876.000001DC42C2B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 00000000.00000002.1371511467.000001DC42C42000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 00000000.00000003.1370561544.000001DC42C41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371511467.000001DC42C42000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.t	svchost.exe, 00000000.00000002.1371547103.000001DC42C58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 00000000.00000003.1370590097.000001DC42C57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371547103.000001DC42C58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 00000000.00000003.1370590097.000001DC42C57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371547103.000001DC42C58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=	svchost.exe, 00000000.00000003.1370590097.000001DC42C57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371547103.000001DC42C58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 00000000.00000003.1369479480.000001DC42C62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371594263.000001DC42C63000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.bingmapsportal.com	svchost.exe, 00000000.00000002.1371387005.000001DC42C13000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 00000000.00000003.1370590097.000001DC42C57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371547103.000001DC42C58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000000.00000003.1370289694.000001DC42C5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371426876.000001DC42C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1369479480.000001DC42C62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371594263.000001DC42C63000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000000.00000002.1371426876.000001DC42C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1369407878.000001DC42C67000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371621084.000001DC42C68000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 00000000.00000003.1369251202.000001DC42C6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371645071.000001DC42C70000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 00000000.00000003.1370615655.000001DC42C31000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1371594263.000001DC42C63000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585413
Start date and time:	2025-01-07 16:07:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	43
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	14
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Kawpow new.exe
Detection:	MAL
Classification:	mal100.spyw.evad.winEXE@56/69@0/0
EGA Information:	Successful, ratio: 88.2%
HCA Information:	Successful, ratio: 96% Number of executed functions: 58 Number of non-executed functions: 366
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 40.126.32.140, 20.190.160.22, 40.126.32.133, 40.126.32.136, 40.126.32.138, 40.126.32.72, 20.190.160.20, 40.126.32.76, 13.107.246.45, 4.175.87.197
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, login.live.com, www.tm.lg.prod.aadmsa.akadns.net, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, time.windows.com, wu-b-net.trafficmanager.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Kawpow new.exe, PID 5520 because it is empty
Execution Graph export aborted for target eejhedztifcv.exe, PID 7984 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: Kawpow new.exe

Simulations

Behavior and APIs

Time	Type	Description
10:08:02	API Interceptor	1x Sleep call for process: Kawpow new.exe modified
10:08:05	API Interceptor	24x Sleep call for process: powershell.exe modified
10:08:21	API Interceptor	2339x Sleep call for process: svchost.exe modified
11:13:07	API Interceptor	387625x Sleep call for process: winlogon.exe modified
11:13:08	API Interceptor	301082x Sleep call for process: lsass.exe modified
11:13:13	API Interceptor	357159x Sleep call for process: dwm.exe modified
11:13:16	API Interceptor	1682x Sleep call for process: dialer.exe modified
11:13:23	API Interceptor	198x Sleep call for process: WmiPrvSE.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	https://coggle.it/diagram/Z3zkZPAQxQkDOgmo/t/-/1f6434bfba7d8aab898b2531849681e8b0d7342489acbbff6b172f8658a09526	Get hash	malicious	Unknown	Browse	199.232.214.172
	Here is the completed and scanned document.eml	Get hash	malicious	Unknown	Browse	199.232.214.172
	file_83f986ef2d0592ef993924a8cc5b8d6a_2025-01-07_10_04_01_718000.zip	Get hash	malicious	Unknown	Browse	199.232.214.172
	c2.hta	Get hash	malicious	Remcos	Browse	199.232.210.172
	sfqbr.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	199.232.214.172
	Vernales Restaurant-encrypted.pdf	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	KHK0987.xlsx	Get hash	malicious	Unknown	Browse	199.232.214.172
	new.bat	Get hash	malicious	Unknown	Browse	199.232.214.172
	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	199.232.210.172
	#Employee-Letter.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\ProgramData\wwuujrlkomwy\eejhedztifcv.exe	Solara.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\wwuujrlkomwy\eejhedztifcv.exe

Download File

Process:	C:\Users\user\Desktop\Kawpow new.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5471744
Entropy (8bit):	6.525931537093555
Encrypted:	false
SSDEEP:	98304:gBybWc2fgjrlVrH3Y27fd2BY1z7QDkR3m1W:hic2GrrrH3Y2Bd1fIkR3m
MD5:	FB6A3B436E9F9402937D95F755B62F91
SHA1:	AEA3A8A311C2B8B6FC7D9D263B952F95A30B180E
SHA-256:	4C9D878E35E7FD497C633A770D3359FB37447985450DC19F45DB0925972C39E0
SHA-512:	7A3E2E42FE965DB1CEBC539235FEC88E277669C9A62BE2450EA4EFAF5DD93F1DE11740197FF26E697E9E9ACC499CBA2C30B64CFA5E5B35B28B9E0B93087EE2F8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 74%
Joe Sandbox View:	Filename: Solara.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d......f.........."...........R.....@..........@..............................T...........`.................................................H...<.............S...............S.................................(.......8...............`............................text.............................. ..`.rdata...'.......(..................@..@.data.....R.......R.................@....pdata........S......vS.............@..@.00cfg........S......xS.............@..@.tls..........S......zS.............@....reloc........S......\|S.............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FB0D848F74F70BB2EAA93746D24D9749

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 7796 bytes, 1 file, at 0x2c +A "pinrules.stl", number 1, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	7796
Entropy (8bit):	7.971943145771426
Encrypted:	false
SSDEEP:	192:CPTIWKvNnUBBBL05O/b0evl2G6AXK+KMlYX82:CbevNUBDLlz0eN2dAXlKH
MD5:	FB60E1AFE48764E6BF78719C07813D32
SHA1:	A1DC74EF8495C9A1489DD937659B5C2875027E16
SHA-256:	EBF3E7290B8FD1E5509CAA69335251F22B61BAF3F9FF87B4E8544F3C1FEA279D
SHA-512:	92BAA53445EC1A6EC049AF875783619D255AB4A46241B456BD87AE0043C117740BD117406E2CF5440840C68D0C573CBA7B40F58587CE7796D254D0B06E9B7973
Malicious:	false
Preview:	MSCF....t.......,...................I........E.........J.R .pinrules.stl..>N.#..ECK.[.T...O......l.$.)V.a...v.d.H...&.D.YA,(+Y...A.......c]."ka-.XW..I.....w..\|..9.........{...\|d..v.T..w.TMZ.\|...).F.rtAm.....f......T........n.z.:.t&.} EH.S.)2...SP.../~.Q..d..".@.5..r(..M.Zs..~{...>...p.p.^....[/p..~.....@......f..E0....9.i...Ds..^.d...N.R@..P%..9... .4Z)...z..h...@.......C<.]6....([.c=.9..l.....@..4......f.......z.!..0.`Jp.."$I..?`......H...].2...$....9v1./g.&.aIX.A..A.w..p.*.`r.........'!e.. ..d...H.d.hu`.\!w.Z..E.$....$..\|1..@.OC!c.......%.....p.uxC.~@....`...#.~ .P.!.Gb`)i...L..0.-.K.....xRx.e"..@.....5T..JP^.9.....#aH.E.@2..H..f.H..K...+x..$.WM..H}....=....`.PD:.qgn........I.....]uX..q...D...]n.4..0..b!.....m"a.Lz...d..S%P.I11,..^..".+At..To\@K.....c.h.C.....=...H.Xa...r.A.I..@!..0..eV...\|.h..$."r..hL9TR..}.v%...4).H..[.....r..\|]..+5..Y..I..hN...O=u..8.}U...#S...R..KQ..A..w....X\|.....8b...GC.4..h....6gG.>..}.8....!ql..A..1..X.C.q.j....

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	modified
Size (bytes):	330
Entropy (8bit):	3.31809439621491
Encrypted:	false
SSDEEP:	6:kKM81wNSWsCN+SkQlPlEGYRMY9z+4D1QuflIeyGIla1:00FkPlE99Si1QyIeek
MD5:	947EBB6083EB8A1516879E5CF70F2F87
SHA1:	E8A0F268982AFB56410388CCDF73C630D126EBD9
SHA-256:	924ABC76DF892878225FCCA693A8C702DFD407E8C3BDC12D2C94F56CF43EAB6C
SHA-512:	910D0F9CA4DD371580AA014A5A043CA818913DE8D87F03CC03ADA236BEAAF6DB6833F8B622746C90A25F93A27DD410EBD139F8D7C546281C8DE1F6E7E518FB85
Malicious:	false
Preview:	p...... ........}.X..a..(....................................................... ........B@!........(....0."....t...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.p.i.n.r.u.l.e.s.s.t.l...c.a.b...".8.0.4.2.4.0.2.1.c.7.d.b.d.2.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnmWllZ:NllUmWl
MD5:	3EBBEC2F920D055DAC842B4FF84448FA
SHA1:	52D2AD86C481FAED6187FC7E6655C5BD646CA663
SHA-256:	32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
SHA-512:	163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_14lxb2me.xns.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gs1rry12.jcn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mvbm5klb.omy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ox3wzhkj.oev.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	4680
Entropy (8bit):	3.7115837743379414
Encrypted:	false
SSDEEP:	96:pYMguQII4i5q6h4aGdinipV9ll7UY5HAmzQ+:9A4g/xne7HO+
MD5:	B3E9F094612A0553E5747C4AB01131D8
SHA1:	0A944E858D9AEA935E349994CD696E597E905139
SHA-256:	1FFBD472D1A785A02DA260FF16F6CA247945429E743D6D60B585D0C482EB0865
SHA-512:	57CEF46655722DD7C53A706D0395BF6FCFAB395B89302DC856D24C75C9484D028CDA6289478DD32F2B538A07251AAD98AD1A1A1E023958449BF270E484EB934C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.T.a.s.k. .v.e.r.s.i.o.n.=.".1...6.". .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n.d.o.w.s./.2.0.0.4./.0.2./.m.i.t./.t.a.s.k.".>..... . .<.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . . . .<.S.o.u.r.c.e.>.$.(.@.%.s.y.s.t.e.m.r.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.p.p.c...d.l.l.,.-.2.0.0.).<./.S.o.u.r.c.e.>..... . . . .<.A.u.t.h.o.r.>.$.(.@.%.s.y.s.t.e.m.r.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.p.p.c...d.l.l.,.-.2.0.0.).<./.A.u.t.h.o.r.>..... . . . .<.V.e.r.s.i.o.n.>.1...0.<./.V.e.r.s.i.o.n.>..... . . . .<.D.e.s.c.r.i.p.t.i.o.n.>.$.(.@.%.s.y.s.t.e.m.r.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.p.p.c...d.l.l.,.-.2.0.1.).<./.D.e.s.c.r.i.p.t.i.o.n.>..... . . . .<.U.R.I.>.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.S.o.f.t.w.a.r.e.P.r.o.t.e.c.t.i.o.n.P.l.a.t.f.o.r.m.\.S.v.c.R.e.s.t.a.r.t.T.a.s.k.<./.U.R.I.>..... . . . .<.S.e.c.u.r.i.t.y.D.e.s.c.r.i.p.t.o.r.>.D.:.P.(.A.;.;.F.A.;.;.;.S.Y.).(.A.;.;.F.A.;.;.;.B.A.).

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	338
Entropy (8bit):	3.9579464662814963
Encrypted:	false
SSDEEP:	6:kKZHCbhu9tLqJFN+SkQlPlEGYRMY9z+s3Ql2DUevat:R0ufdkPlE99SCQl2DUevat
MD5:	E69E1492E3F86E2355254FE344052511
SHA1:	E98AC00B092E2D4A91651D4772344DFDB3826026
SHA-256:	A1D6DCB03D344A97F48971C35DF02422E04E41F9E73C525283051A25F37D95DE
SHA-512:	84315BAAB316B901456AFDD4EE830160CBCA9A4304FE9D32B442C42500C76CA9EFA50E0713E5A20693C650F5A2D92DEB546358CCBF9D5D6F61F5C50C8812ED2F
Malicious:	false
Preview:	p...... ............Z...(...................a...S...a...\U.a...........S...a.. .........p.........$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...

C:\Windows\System32\winevt\Logs\Application.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	dBase III DBT, next free block index 1130785861, 1st item "**"
Category:	dropped
Size (bytes):	4192
Entropy (8bit):	4.013976946005677
Encrypted:	false
SSDEEP:	96:3IXYOF0OLC8cD1qJEC0DeVAJrOa0iHoeVA2rQR:3IIOF1CD1qJEWVSf0iH5VJ0
MD5:	46E8D697C55D60A250D7BFB716DD124C
SHA1:	D63873C5DB85D776EDF2ADAD2D01CABEDDD1B922
SHA-256:	FA6B2CF7344486EA681E292D56774FAF1FEA27BC4B9672A60C8B3311F8108173
SHA-512:	E4F47D870412839D9C71A0D97EA5B7A20F01DE5A59030B5A4366DE0FAF92C05FAB8A1043192DC9CAEE9C5AB44976649D56E76420301856C780A69CBC1D7AFDC9
Malicious:	false
Preview:	ElfChnk.................F.......H...........`...`.....B.......................................................................C.............................................=.......................................................................................................................J...g...............@...........................n...................M...]...........................p...............F...............................................................&.......................................**.. ...F.........^..a........D.o.&.......D.o.#.X_F...."}........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Z............{..P.r.o.v.i.d.e.r...7....=.......K...N.a.m.e.......S.e.c.u.r.i.t.y.C.e.n.t.e.r..A..M...{........a..E.v.e.n.t.I.D...'............)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n....

C:\Windows\System32\winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 3 chunks (no. 2 in use), next record no. 329, DIRTY
Category:	dropped
Size (bytes):	123792
Entropy (8bit):	4.090092478950178
Encrypted:	false
SSDEEP:	1536:kHi6xadptrX9WP+gqHi6xadptrX9WP+g:JptrX9WP+gHptrX9WP+g
MD5:	1E5F6C42DF8692D031E38FC90F2F4DFE
SHA1:	E7EFF5D41D080BF5D56A313B53E961F17E0FEAF5
SHA-256:	0931D9F7207CAE219D4EBB8F429479112C53059CBF9D79B99655F38AF25E8BEA
SHA-512:	9CEF0055F6ABBF3C4EAA7CF39278061556FDDF9AAB4D2120808355EE94A783C8902F36A7181017AE2E6127EE9D595AAF529D0FC86FE69521AE83461466C0AE52
Malicious:	false
Preview:	ElfFile.................I....................................................................................................2..ElfChnk.........J...............J...........x.......-........................................................................6..................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...........................m..............qo...................>...;..................**..............4.9...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.396148699263237
Encrypted:	false
SSDEEP:	384:jhONk2SCNCrN0KNoBNoiNKNosaNjN4N9NRNCN8NoNjNUNONXN6N6LNvgN1NkNWzP:jgS5itAsZ2DCIEzVFNtPp
MD5:	1714E9F375BF402E9FF7644ED82EC285
SHA1:	ECB3A4495CEBE4F270C8D94553F027A36F50C42B
SHA-256:	20C6A11A8C455A4E4077CC61001BED7C0DD4E6F4FAADBCAD8DDF9A31406F1051
SHA-512:	A376B10C14E4EF653991874DE0D730768CC8D9BD49D8C348EED40CD184DA0C2AB47022B0AF6841B0F260598927C63271550A9B2C30F6A0DB1F6A3F830FC16576
Malicious:	false
Preview:	ElfChnk.v...............v...................p.......T..q......................................................................D&................4.......................\...=...........................................................................................................................f...............?...........................m...................M...F...................}.......................}.......................&...M.......M...........................}...................m...................**......v........^.`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	66960
Entropy (8bit):	4.277181178775586
Encrypted:	false
SSDEEP:	384:XVUV8hpVAVqVjVWVscVcVtVrV51VgVTV/VZVXKVNVjVyVlF/vVIVtVQVwVEV+VpE:/b8xf4BsuMgkk
MD5:	7C90A7B907F804A9F8D829EA83A81462
SHA1:	B29A6DF9855B07ACA251E3AA6E416980CD47135D
SHA-256:	88518498527ECAC297161AD6945F16F0D58B07412381631F71FA3B728E4D97C9
SHA-512:	5FEFF2B53CDEFBAF417346DD456B9854BD399348C0E5184DD144044BBF3EBF59DF53E4DE47CA7C951DED17F521C96EEE669D0A5B563CDFA0039E02DBBC76F967
Malicious:	false
Preview:	ElfChnk.........G...............G.............................................................................................................8.......................`...=...........................................................................................................................f...............?...........................m...................M...F....................................................'..............&.......................................................................%............F.......Zgv..a..........E!&...............................................................@.......X...a.!.....E..........@Zgv..a.....`...ey..`...........F....................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t...'..Y.J.R>:..=_M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t./.O.p.e.r.a.t.i.o.n.a.l...f.d.........N...M.i.c.r.o.s.o.f.t...W.i.n.d.o.w.s...S.e.a.r.c.h._.c.w.5.n.1.h.2.t.x.y.e.w.y.....O.p..........G............a..........

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	67008
Entropy (8bit):	4.402715961435219
Encrypted:	false
SSDEEP:	384:jmImJhImkmAymRvmVkcmhTiYmBmgmUmWmBmbm4my7mcEZmZmtmZ4mRmKmdm5mqm1:uxkrTiZz+9hZ/67TSPnSKn
MD5:	E2BB424352742839259C05ECCA817DB2
SHA1:	33BAE4DD356B9F3149485F47FEA5BC468785269C
SHA-256:	8E42E049A6C9B6A2B28D66D0F217DF2E956F90B249A4AA8E9096667ADFB8CDC1
SHA-512:	C1EFC807D0E4D168F081548625CFE48A5B14D92AF36148DAF2AED502C513B218F5CC2FBCA48CF152DFB3B3EDCA9006CA5DAAC64414B01761EC7F8E8EA2CF5231
Malicious:	false
Preview:	ElfChnk.....................................0...............................................................................<Wc.................b...........................=...........................................................................................................................f...............?...........................m...................M...F................................i...&...,...........................7..................................;...c#..{1..k:...................v........................R....a..........E!&...............................................................N.......d..._.!.....[..........@R....a.....`.......`................................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t.-.S.e.r.v.e.r.9.G?...J...]..-CM.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t.S.e.r.v.e.r./.O.p.e.r.a.t.i.o.n.a.l...e$W..R......................(.....................s.v.c.h.o.s.t...e.x.e.,.S.t.o.r.S.v.c.......r.v..........

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.4578852372743866
Encrypted:	false
SSDEEP:	96:vNVaO8sMa3Z85ZMLgrjjIZ3Z85ZQu3Z85ZW3Z85Zu:1V7pp8nMLEvUp8nDp8nWp8n
MD5:	9C160BC0171DFD3595B31163B5C606C6
SHA1:	BD6AD35A3770A1332EACA6141DEF524DA7D9DA3A
SHA-256:	EFB59BCC5B918874707C52AC858F2A713C77C1807E665E48E3B2E713917F2AAF
SHA-512:	130C93D51F01ACB704E117E0BEEF45FED54C2DB4D398531A2A5BDB6534AA010F4B5B6683AC10A607CD2AAEEBB8741556036B8E20C88DD26EE5C055C792B61268
Malicious:	false
Preview:	ElfChnk.....................................P........&.....................................................................S+..............................................=...........................................................................................................................f...............?...................................p...........M...F...................................................................................................................................&...............*..p...........n.d.............g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.248110473220085
Encrypted:	false
SSDEEP:	1536:YbBN2A4VD7VAx8whAGU2woJQghYAxgRzAlUnF9:
MD5:	87681F2AD6FCB19982924DCE6A2D7A27
SHA1:	6C4D49C5504D6DE6E63B44753C607B3362B79B57
SHA-256:	1CA289F8F7FD7DD1D67EDA5691EF4B083120E456204CC8F6923AFCCD700183BC
SHA-512:	8F1309E5DD7B017945ABF5EB7E869AA1C04A27C37DB7C3A735A2CB31D815B67643D37DAD93FB89FFF2B6BC213EAE1E55201075DAEAFA39A6B1656A214990DEBA
Malicious:	false
Preview:	ElfChnk.........]...............]...............0...........................................................................>...............................................=...................................................................................%.......................................X...............?...............................................M...F.......................................................................................>...........................................z...............**..............................g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.625347651139654
Encrypted:	false
SSDEEP:	1536:+XY5nVYIyyqED5BVZUevOBtNPhPVwCRPvf:+XY5nVYIyyqED5BVZUevOBtNPhPVwChf
MD5:	890CA9963C766DA05E491710E1CD9D7F
SHA1:	3F95AB4363D5DB533E60748F69A364196BAC8920
SHA-256:	47523E0AC40BC366CD0A86BE9A72ECEF3A72EE7D430B25A61D8DF55341C19531
SHA-512:	C2D739AE5ABF76C627DA8B863CC73FF31F7C7733138DB2954A3102377FD0270F69FE269EEAE0DE4172E53E194C3B71791CD09B36F880DC726665004FD9C6A07F
Malicious:	false
Preview:	ElfChnk.........................................`....:..........................................................................................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.......v.......................................................y.......................**................9..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	modified
Size (bytes):	101248
Entropy (8bit):	2.6781643993762594
Encrypted:	false
SSDEEP:	384:loEKBoHoiAhoT+yRozAMgoqy2oUoqykoaoqy3o1oqy8hdo69CcoTorNorWorbvoI:1hMSDCRbhM4DCRbhMye
MD5:	3825F9F43EB1F2BB8C26923DF6DC201E
SHA1:	9AD5EAC6FC9F592ED88965550BCD1638B1BB587B
SHA-256:	2DA67E61CF16868246C7FB0A8B67921A1DA129110C52D123D28B6C36117F9EC8
SHA-512:	FE532C7F310F5A3B45A566B589DA9B56D434BFC538DA7E2C8AAB44B14BBFB78B1A1155016006318783030620C8A288952963A9B6A8EA393ACA923E8521637DE1
Malicious:	false
Preview:	ElfChnk.....................................hJ...L..9-y9.....................................................................1..................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................&....................................3..................................E/..............])..............................**...............F...a..........E!................................................................>.......V...X.!..e...............F...a.....`...@..`....... ........................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.o.d.e.I.n.t.e.g.r.i.t.y..k.N.<.D..97d>7.M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.o.d.e.I.n.t.e.g.r.i.t.y./.O.p.e.r.a.t.i.o.n.a.l...!>.])......!>....[.U.....i...........\|...:....A..3...b...%....=.......F.i.l.e.N.a.m.e.L.e.n.g.t.h.......A..3...b...%....=.......F.i.l.e.N

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-BindFlt%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	DIY-Thermocam raw data (Lepton 2.x), scale 8448-1024, spot sensor temperature 0.000000, unit celsius, color scheme 1, calibration: offset 0.000000, slope 207715216474546355539665747968.000000
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8526226240352849
Encrypted:	false
SSDEEP:	384:YhAiPA5PNPxPEPHPhPEPmPSPRP3PoPqP7DPfPqP/P:Y2NP
MD5:	585F5E645713292DF375B49B2BDC28EA
SHA1:	42531DC7FEDA50E16705A1260EC70B5AD7015FCB
SHA-256:	E16C3A02C9E22074AE98621BB170E12D41A54187FCC6D53B5600F5712F37A9FF
SHA-512:	0C0008188EC621D5FE00CF9211729347A941AF2DE55DA3333114D83B4D181FB8792C64FA0F62309660F51FF26349684D35EAC0A4E0FE98898D1C03CAAB65B434
Malicious:	false
Preview:	ElfChnk......................................%...&...A..................................................................... p..................N...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................................................................................'.......................**..x.............\|..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-Wcifs%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8442469423268683
Encrypted:	false
SSDEEP:	384:DhZ21JJgL4JJFiJJ+aeJJ+WBJJ+5vJJ+/UJJ+4fJJ+CwJJ+D2JJ+a2JJ+JtJJ+lk:DWXSYieD+tvgzmMvB2R387
MD5:	A12D2A18D158FA0E4EBA801B76795EAC
SHA1:	22C6C36D8E0ACD32735F5C0D25929CD734A2DB9F
SHA-256:	4A2A9FFE44AB14DE2504B3632FBDDC8EC4E3B35AFF6C5CCA75AB5095E164E39E
SHA-512:	729117B98F2FA8D18DD3A9B0A373EA5CD36A9B88BA54A45579DE0C50C68DABAB50096CC3078DDA1C11A7483D95CD6B39A54AF35282B1C2550F0AAE4A80F8BEA9
Malicious:	false
Preview:	ElfChnk......................................$...&.....i....................................................................x..(................F...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................&...............................................................................**..p............zu..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.1949548850023466
Encrypted:	false
SSDEEP:	384:4KhqhSx4h/y4Rhph5h6hNh5hah/hrhbhmhjh/h7hkh8hbhMh9hYwhChwh8hRqh2I:4KbCyhLfI931Q
MD5:	54F488D8C354C7E6382EC57543BF33E8
SHA1:	58AE9E68A1C2344FE5A8FB8033567463C19C5997
SHA-256:	DDCF67543FFE2BF3042B5995694BEDC1E444D710A70E5A9FF0EA4A040689E175
SHA-512:	AFFCBCB5036C629BA0F12226A60FA470E6124C25904BF49381D9A249009CD1E3FFA2421E699A9011F47779EB489186A0075D85504BBF49E1707EA08A8C7A617B
Malicious:	false
Preview:	ElfChnk.........N...............N.....................h........................................................................7................6.......................^...=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................n.......6t..............................................................................**..`............0H..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-NCrypt%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.3895763915665986
Encrypted:	false
SSDEEP:	768:TcMhFBuyKskZljdoKXjtT/r18rQXn8uwgSj70FTP:gMhFBuV80
MD5:	1D8BE61A76EB65AD20811E2A3EBD8D8B
SHA1:	65BCCD165D3CF1461160CB66C599C27292F5CFAE
SHA-256:	3A422D3D5B358379363C1C04D81DDC636AB1EE1E1B9ACC78C43CF02BDCD438CD
SHA-512:	2150FFB459D6F9B9AC6DE5274E96C59803240F3C6CFD820C565B892B10FD7DF152B223D05A01433A15DB737C688D4451DD78B07BB42F9774C18CC64E48D23FC4
Malicious:	false
Preview:	ElfChnk.........O...............O...........0........~......................................................................O.".................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............m...........................5A..........................................**..x...........,.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.897824852235771
Encrypted:	false
SSDEEP:	768:UtvigYdNYvAzBCBao/F6Cf2SEqEhwaK41HZalMIq9Iz6IOTLGfFXN/E:WQH+dqWzrhFXN/E
MD5:	81E27C8411597973E644100B4779620A
SHA1:	BC96F6D7472174051BC5A7A10CCDB46738AB75A3
SHA-256:	3DF7FBEBAF30A4A63374A0431ED383B11B470576563B6A257A3401D70D12A04B
SHA-512:	A6E60CCDAB188DBD32904BE97E2C95C0A10C13C0A0BCAC230B0C526FD105A4791BAF9DC50779FAC3B2CC16671A1573DDA86872A5C4B80685E8AF90D6CAA574B7
Malicious:	false
Preview:	ElfChnk.w...............w...........................L4.........................................................................`................4.......................\...=...........................................................................................................................f...............?...........................m...................M...F...................................................................&...............................................................................**..H...w...........`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 1 chunks (no. 0 in use), next record no. 27, DIRTY
Category:	dropped
Size (bytes):	93416
Entropy (8bit):	2.772194224962589
Encrypted:	false
SSDEEP:	384:2uh1kbAP1gzkw3kN5Ayqk+HkzGk+hkV3SuckzlckA66k+4DkzRxk+dkzwUk+rkza:9MAP1Qa5AgfQQhCPMAP1Qa5AgfQQhC
MD5:	A8D94CD4632EAA07DE2CA1DC0C77BC9F
SHA1:	5DC5E75F264D82EE10FE50B7CD9F2A915242FE7C
SHA-256:	C099D98D4C0FFE7DAF2D33B1B13138781E73CAC8AABF5D424EC7EC19ACA6550E
SHA-512:	3FD4D1FC6E13B2613A9425D09063534EADA10C66FA2CBF5533E52B08A6DCF0EE712F8574F250928C40B0AE04B124B91CC96D1D0F69E403D3FD57308373595C89
Malicious:	false
Preview:	ElfFile.....................................................................................................................\|.~2ElfChnk.....................................@j..hl....9......................................................................A.................b...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&........Y...............................&..............;...............................**..x...........HD................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.441475404183629
Encrypted:	false
SSDEEP:	768:ZbM5eahvB94LSAoiMTQMrj+/IVvu4mJY0YCOO:dMAaZBLzn6fYZO
MD5:	B7F318BB9FA336235CCBE5A391775D8E
SHA1:	F7F7CFF57A6BB00B4E6F17E39BAAF2443E08878D
SHA-256:	D59515423F15D3618746447E1333945BF1432B9B4C20B54849050CE17C72311D
SHA-512:	1C8FA8FD31BC4A3C6815A473C00187497E7E71CAF1FAD61F5A6D73DBEB6AE9D551A3DAA6B39B76A4D1401A061844036D5D06469A3942BC030B276D4E186C7289
Malicious:	false
Preview:	ElfChnk.r...............r...................0.......A..@....................................................................k...................,.......................T...=...........................................................................................................................f...............?...........................m...................M...F....................+...............)......55......................&.......E....@......M#..............u7.......1.........../...........!..]>......**......r.......R...`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-HelloForBusiness%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	DIY-Thermocam raw data (Lepton 3.x), scale 8448-4108, spot sensor temperature 0.000000, unit celsius, color scheme 1, show spot sensor, calibration: offset 0.000000, slope 308596736.000000
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.4699263306571524
Encrypted:	false
SSDEEP:	384:6hYCAKRuKIYKxkKiCKVIAK8sL4K5VKjPKwnKZ/K50K8/0KXAKuWKSlK+NK8t3Klq:61T4hu7OJscMmza
MD5:	86173450A7EE15BC5B6A2C667DD3B040
SHA1:	200635B7FB3137AB9A33A6551182F4BA05BDCE84
SHA-256:	AEDE5AAE515D2A3C78BA23C631D178DCCB3E775CD3B4FB6F0406887FAEDE5B88
SHA-512:	3A73438F1A7B3B2F166B2B2F70E713F7393A2F2D5DF23858D05F2790BD2DF5B2CDC38263EC72ECC34621C82C44308E3C0474E295C678642E30146CAC27D69067
Malicious:	false
Preview:	ElfChnk.........s...............s..............x....,........................................................................5.................V.......................T...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.............................................................../.......................**............... .$..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.450965793914843
Encrypted:	false
SSDEEP:	384:phFiDhKxDmqIDrfDYEDdDDDbDOD2DSD+DtDFDxDlDUDEDoDADeDuDx4DWDXDjDfO:pzSKEqsMuy6CL3
MD5:	3914FD52494E203A25B69F9F4221031F
SHA1:	8046E0D1C78A47632A4550AC66FC9917E6429457
SHA-256:	D2D37391EC1325C6C27486311C5B5E1D11C55D0A464270F009E3D3E1B2A54D3B
SHA-512:	12FB89D2F9A5B19C7150D23A09A7C7B3F5616C09C8A83AE83A331263F0FA45181066F1A44080A46FE3A9F551BDF56485BD03DB9001FE82388DCDB1EF3FBC7829
Malicious:	false
Preview:	ElfChnk.........L...............L...................=....................................................................... ..H................2.......................Z...=...........................................................................................................................f...............?...........................m...................M...F...........................&........................................`..............................................................................**...............v?..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.1568075545974956
Encrypted:	false
SSDEEP:	384:ZhMLzI9ozTxzFEz3zLzWztCzizQzzz5zqfzDz5z1zkzSz9zEzWz+zQzqbzUTz3zg:Zmw9g3LCjg
MD5:	F3CF496665845DA6C957242770973ECE
SHA1:	BF7206ECD6C6ABE687BE10A157C86C7EBE59C6BD
SHA-256:	BB190FF3FA391F3B69F3E4509B14D6DE320C980D69A59BC74DBD57BD8AA42F7F
SHA-512:	EA5A2D21353556B5B6FC420671E5F7026B6A280C7CD740CD1CAFA2C958318B5BB6A5F4AE6A00450E2A7997425A0AAAFFD158452401ABB732CA985A8DE3548213
Malicious:	false
Preview:	ElfChnk.........6...............6...........(o...p..........................................................................y.................J.......................r...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......E.......................n........X..............................................................................**..............j...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.8853799397148268
Encrypted:	false
SSDEEP:	384:5hCI2LwuSsYI8tIbLIYoI/IE6IQsIhIxIUIfIXIAI2I/IRIvI:5Z
MD5:	FACBCFA717058EFCED1754221D6A421D
SHA1:	1BA10B3E2BB8A2C739257CE228789E2D6C4F1A1D
SHA-256:	6F6A7779828D79A41F94AF9EE452BB44EE0E495D27A5B5DE7DAD659A6865C9CB
SHA-512:	0253FDCC88D3E52A9A26A065AC0C4E264DC0E84CB6A175D09BEC79E56D5282B9B95DCE2FEF47C48505D34C629388904AA6E2BDFF81759920FE314D6F9F5A6DB0
Malicious:	false
Preview:	ElfChnk.K.......L.......K.......L...............@6..u..B.....................................................................w..................,.......................T...=...........................................................................................................................f...............?...........................m...................M...F...................................................................&...............................................................................**......K.......1E..`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-NCSI%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0596696487276978
Encrypted:	false
SSDEEP:	384:Qh1hM7MpMEaMWFMu/Ma2M+AMmGM1cMNF3Mg9Ml7MABMczM0cMKhMpHMXmM+ZM6Zz:QeJ+
MD5:	F6D375E51341AC949A73803CF00B96E6
SHA1:	5DB3BF9A34145DD777EA9593DE3C8054B08A11D1
SHA-256:	EBDFA834049A08F8FC9B3DD35800233E75BDB480D59E548D7F4F3F2720B889F9
SHA-512:	1714A4243ECEB63E23583F31D3D6C161D8423E1AD2D1E1440545718E6DA879F74C2F03E5C21120ED826093777F6DEEEFEC57B913E1B4C1D74C0B8A473752460B
Malicious:	false
Preview:	ElfChnk.........................................X0.....!....................................................................B...........................................>...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................6(..............................................................................**..............c...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.241268628600426
Encrypted:	false
SSDEEP:	384:Thk1EL1I1Vh1C1D161f1f181L1tY1VGm1Q1L1p1VG1U1Z1s1VA141c1Vc1q1tS1/:TBjdjP0csQqL
MD5:	602FD635C1BE2C0F087784BAE052554B
SHA1:	77EE62511C78BA6989DF77AC6B616422A44D7F54
SHA-256:	78FC5D1D71915650A8080B217B8B28F799B054F35C89AAB2C474DC4B9C3F0581
SHA-512:	8A66621CE4233D42AE83A0046A04628F4A88D91713C064944A61AFDF3F33D44E54E416A8441D1FFFDDCEA2E909761BBF151894881B4F93C0D238537939E21217
Malicious:	false
Preview:	ElfChnk...............................................j.........................................................................................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&..............................A.......................................................*..............5.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	129088
Entropy (8bit):	3.703847255178517
Encrypted:	false
SSDEEP:	384:fPIDrHIHIvIUIMIrInIJlImwIbzI8rIseIyIQIFIDIeIlnIAITI3WhDIEQAGxIHm:fNhjWZxGkilvhQWZxGkilvhYZ
MD5:	D5DEF85CEFB34DA16A8CD5F89BF31C07
SHA1:	A678F85043514D7255AECEF02F19BC9353E0BBBC
SHA-256:	940F45A2DD04BBCAA236C52183DCDF4B7D4FC2C24C14F0231C6683EB6C3CB7CA
SHA-512:	E0089C0E13EB5D46A2362A5E35FBA6330EDD808A07A56D2D0BD8B4D5A9C70C33AEDBA54FEDA69BBDAEEB847FCBBC3A6715F19B835E2E36DFDBCFC499A6B934EF
Malicious:	false
Preview:	ElfChnk.T...............T........................... ......................................................................O.;.........................................>...=...........................................................................................................................f...............?...........................m...................M...F...........................................................a........F..........1........................................)..........................**......y.......C....a..........E!.F..............................................................,.......D.....!........... ....@C....a.....`...Z..`....... ...y....................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.N.t.f.s..z.?..nM.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.N.t.f.s./.O.p.e.r.a.t.i.o.n.a.l.......a...&.......6p.\.#i....>..........2........A..=...>.../....=.......V.o.l.u.m.e.C.o.r.r.e.l.a.t.i.o.n.I.d.......A..7...>...)....=.......V.o.l.u.m.e.N.a.m.e.L.e.n.g.t.h....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4WHC.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8023807109333921
Encrypted:	false
SSDEEP:	384:Fch6iIvcImIvITIQIoIoI3IEIMIoIBIOIRTIWeIZIEPdINI:FcoxXxP
MD5:	996D00E5A8B66706691FE697CCD68A7A
SHA1:	C90C99232451BAF2DCEB02C56C69CA9194390A9D
SHA-256:	95EF5245BEB2BBFD8EB8F5CE3A0C81869EF2AFACA54EF3445C3B144909C6A4B2
SHA-512:	FEA1D551151A622B151133814ECA8DE8EE4E3DA6D08F81CCE931FA7A64242E732A283E03A4B21EE922AF24F6FF0AF5EE2F26CDB7AA534583063C40F9C40DA0C8
Malicious:	false
Preview:	ElfChnk.....................................`"...#...l]....................................................................upp.............................................=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................^...............................................................................**..............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Partition%4Diagnostic.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.999253421723821
Encrypted:	false
SSDEEP:	768:h4u1n8zfFFU1x4Dk13xIb13xIb13xIt13xIi13xI513xIU13xI013xIF13xIH130:j
MD5:	11CAFE60067FAE9C5A304C7A7DAC0EB5
SHA1:	0E72987588CB8557C7CD00AD3D8956CDC0593C35
SHA-256:	1AFA765FD9A0D9659C2A02A266ED4FD303C82BD9AFF45F0E7167E335F91E042E
SHA-512:	764A5D459803B989800473821647907FF484C914778A8AE42257E4791C1C1369E5490AB9365665C257045A007907981E78C1F2B4D5652BCA777873439537E9D0
Malicious:	false
Preview:	ElfChnk.....................................0...@......~....................................................................u!..................(.......................P...=...........................................................................................................................f...............?...........................m...................M...F...........................&................................ ......................................................................................**...............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	dBase III DBT, next free block index 1130785861, 1st item "**"
Category:	dropped
Size (bytes):	68632
Entropy (8bit):	3.8554460752513044
Encrypted:	false
SSDEEP:	768:vc8utDBjV8k+G7eUtHpoVWW6HzLKvc90Xjt0GMAoLx07SZRcZv76NcRUjGHzLKv9:futDBjV8k+G7PtHpoVW
MD5:	BFA6C635B63E3D65527E466C0F72F979
SHA1:	9143FE5E1E2382138FE304B43D10C5140D30D469
SHA-256:	F978A09BD27A227DF281408C04AD2B0B258F99199AEEDA966831592F97818EDD
SHA-512:	A9B9B8246B2DA4337936C02B3F65AB4CD5598B81A7E3E8866C14E162DC3AA6EF29264D16D1FAADD76C62DA66FEB3CBC06E998E5FD8249841E4CB7ABA4D9AA79F
Malicious:	false
Preview:	ElfChnk.................O.......Q...................{.......................................................................h..................8...........................=...........................................................................................................................f...............?...........................m...................M...F...................................................................&...............................................................................**..h...O........$v..a..........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-PushNotification-Platform%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.435727690193882
Encrypted:	false
SSDEEP:	768:GpJ5LU1jN2RkG6OQFAWAbYgO0TKLPmbvZk8M4+q:0LUy4AVKLPmbDM4L
MD5:	C8CA09D06FDF7816260F8EC0A3D7651C
SHA1:	F6C7175325E661DFCF9DB213CFDA41D975D9CA82
SHA-256:	53026A81DE8E4C632D99AD6C8550ACD74E51F16F694B1B0BE2DCB4EA167D2079
SHA-512:	4A40AEC067D2CFEAB320586822D093BA54EED08D33CDFF6C200282E47A452D02B39A4D3A64A205C5C8CDEDD00682FC32B966C095C45E2FAE7DF17E23E712D2B8
Malicious:	false
Preview:	ElfChnk.........................................x......q......................................................................................v...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................O.......................&..........................................................._...................*..@...........:.2..a..........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7602204514023913
Encrypted:	false
SSDEEP:	384:ChP8o8Z85848V8M8g8D8R8E8J83W1d8b8ut8l8:CR
MD5:	A71D2A716E4B8C87379C50F91A376243
SHA1:	B55D17BCD95C285812D918E820EDC513B8BC4373
SHA-256:	4C279C417D131982DEF275E92EC2EB1CCF985E5A5785B8989D28972A72AAD650
SHA-512:	4759EE9F1D1DF7F9C3452A40C1A58C66A8928378CC69B464944C4732BC5042BE1FFA81996F5943702CF7379C632B41081F9109421EB9A2243CCF06AF02BC45E8
Malicious:	false
Preview:	ElfChnk.........................................8!..=.......................................................................w]..........................................V...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.......v...............................................................................**..(.............................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.777686051348048
Encrypted:	false
SSDEEP:	1536:uXhWUyS+z1VV18o838c8bUc8cVVsz8VX8SoX8aA8cmtpjAiVB18dwE4vjcYoMjn1:uXcnS
MD5:	68B21090E6E30897FEB4503C8114AF6F
SHA1:	4486CAB534F83710240BB5CD6D35E7A269BD318A
SHA-256:	FFDFC9C8FACFF754DA908F2A4D513C890074BD7E6E08E7DAA1A1B1EE31F7256D
SHA-512:	D6AC1650B80A5E850745F89546E09C6C57204E952573B19FEEDFD3DC20864C1972C95F85B426CFDDB3D0D8738C84B91171816922D92EFFD751CBDCF1881D8FD1
Malicious:	false
Preview:	ElfChnk...................................(N...O..F.......................................................................D.na................v...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&........=......................................................O.......................**..............g5...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.4655200384785823
Encrypted:	false
SSDEEP:	768:m0VsLY/Z5aFka2aKazzabCafama5Sa0ra6rzaJcavkao9O5vaP4eZiGai2niL9i5:ucE5
MD5:	EC1441AF347A3AEBD3C499EB77112044
SHA1:	062F0645AF0FF401308A0582362E6FE001C5444F
SHA-256:	97F7D6CF9603D2EF964F3D680F5902853382AE270ED6A37576364BD19E0A1C4A
SHA-512:	687D850AB0E8E4E75E484ED8E56658749F1331854AD6E28400538F050E3F372CA791023C87CE192D1417C70E63C0911E589AD9AE103CE30BB68A03EED414AABA
Malicious:	false
Preview:	ElfChnk.........@...............@............{..@}....c.....................................................................].................Q...........................=...........................................................a...............................................................f...............?...2...........................................M...F......................................&................................................b..........%_..........................]...................*.............._.............X..&.......X...],T.'tB..E........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	86488
Entropy (8bit):	2.2471092796292176
Encrypted:	false
SSDEEP:	384:lhNiwCrtrlXbaDQX/5pbiN5p6iN5yYXiN5pZiN5pIiN5pLiN5pZDiN5p+iN5yYTQ:l6f6mR
MD5:	F9038C399CFFA5DD217B0B39A7068204
SHA1:	0E4C8EFF437E1FFB07AEA21953962324E0A8A047
SHA-256:	C181FEBBD7F0972B4CC905A46F3156B3E12D127FB30DABDADA492478399757DA
SHA-512:	FE98ECBF5D3AF5B4CFF9FCABF52400EB2E81ACE4804DF8F3663518558F2880192AD6A5016EF0B4C227E84949BC18A8B23D90921822B38905BA11702C01AEC967
Malicious:	false
Preview:	ElfChnk.'.......0.......'.......0............E..`L....B.....................................................................\M..................^...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................7.......................&...............................................................................**......'........D.Y_...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SettingSync%4Debug.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.335307911754908
Encrypted:	false
SSDEEP:	384:NpQ/hDGCyCkCzCRCFCaC5ClCWQCyCiECLCtmWCTCYCflCdCEtC0C6gCwzChWCVJY:NpQ/dJjm6EIf8aG3e
MD5:	DEC13E419235D71E66C768AF61C819EB
SHA1:	C2601E3DF8A2D6E230D368CA0ECDD4BD11786D1A
SHA-256:	E9AAB8B817BC34F1B7009A6ABC439ACD1EFC991293198857268699458DF84552
SHA-512:	A78230EF0961E00D27B109F0EEF6DEDB9198759E1858C1DCB8C0E1032D48242C23726BB2931EE62A47A5C4D8434CD3BB537B0E6DF85D62653E3648A49A22AA3D
Malicious:	false
Preview:	ElfChnk.U...............U.............................w..................................................................... j..................F.......................n...=...........................................................................................................................f...............?...........................m...................M...F...........................1[..............................&........>......................................y.......................................**..0...U.........Df..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4AppDefaults.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.470554172113501
Encrypted:	false
SSDEEP:	1536:J0dBaHTmPeG68WdEWx/Tm3vaA1YNNd/vTGMk1o4X7BOBrc3gkWqJfECYqzGDXbJm:J0razmmG/WCWlTYvn1ANxvqMYo4XdOBH
MD5:	7C2BA3824E6FDFDC9B34997831CF5BA4
SHA1:	2F75B2D7953CA1F3F139E66C1C1C785DC11F6F0B
SHA-256:	902EC3153154EDF682DF6D35860B9D42B3C6016F787D02E0CC1D2371F3997192
SHA-512:	4BC9FFCB38302D4764B8632EC360FFDE079EF9818F6128BE07F6E89671A510A32AC93145F3FDB4CDBD6363390EAB157D8B164C2B04B86A36C3B93A08AE7A6B52
Malicious:	false
Preview:	ElfChnk......................................h...i.....n....................................................................n.2.................8.......................`...=...........................................................................................................................f...............?...........................m...................M...F...................................................................&...............................................................................**..8............C',_...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.469736793329298
Encrypted:	false
SSDEEP:	1536:6j9GvEkeLhw6IrKOu4zB5c63VJ7qhFRbw7ZGnCg7HZANhlPqizIUxKu/GFy9pUJD:6j9GvEkeLhw6IrKOu4zB5c63VJ7qhFRv
MD5:	8F5A4A76B980826116BE5A5516591E85
SHA1:	59BF27E802048AD462308A17C30F5FE5006F86A1
SHA-256:	41E83C33670CDD3452FA267E442B42AD26F61A0766381B0D61026312007299D4
SHA-512:	DF7BEC6D83713ABA6CF9CB2ADC34E2A884B4942C08CCA0DBBAD4A9A358D4E79FC55EE35B68CA7518BF56AC1E8B137596E29FF2B9311F7DB76DC0F16E8838955C
Malicious:	false
Preview:	ElfChnk.........#...............#...............(...Z.......................................................................nh`.................8.......................`...=...........................................................................................................................f...............?...........................m...................M...F...............................................................9...&...........................q.......I...................................Q.......**..............t...`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ShellCommon-StartLayoutPopulation%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.5283250731919766
Encrypted:	false
SSDEEP:	384:YeUThv707s7a7v7yP7c7V7u7C7Z7C7M7n7K7G7d7Yp7PC787h7H7l73+7L7L7j7s:YeUTRVb
MD5:	9CB77B06F0F33B4BC7A638085998A032
SHA1:	04C57BABBE0B49A1AF70143FD2D9ED9071A14D5C
SHA-256:	AC3F98137ECCA65B1C5EBDF80B02F693E51AEA05B0B033CCB9A91C68778FF751
SHA-512:	488788029BCCEA4A3D2C8ED7492D895469BE0962884BC868F080E9CB479AF7ECDAF46E17FC08C9912B953E614E9DEE673DF994170931A99D9E28248117C6F4F8
Malicious:	false
Preview:	ElfChnk.....................................0y...{.._N......................................................................%.............................................=...........................................................................................................................f...............?...........................m...................M...F...........................-@..............E9..m...................&.......................................................->......................**..8...........D...`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.268440759929627
Encrypted:	false
SSDEEP:	384:whc+uaNuru+uhuKVuPJu5u9u4ufuTuxuDuvuDuOuXumui+udutui4uTAuFuauinJ:w6Ovc0S5UyEeDgLvqSX79K
MD5:	3E6903B4F529505011694E65B60A9154
SHA1:	05BC372041FD161154C35F843BFE439066F3A6C6
SHA-256:	E7BB68D43D88025FC2EC47BCA4957A08CEDF53FAA24751D95019CEF867223393
SHA-512:	8C700C45A3A01A79F9E0AB74BE5C0E718E231AAD4395F631A3DADA5C83E937EEBD0804DB0AF340A341440414ACD9293713B9ECB1A074F5E794CA21DFAB8D8CA0
Malicious:	false
Preview:	ElfChnk.........?...............?............q...s..>O......................................................................C..................,.......................T...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................6^..............................................w...............................*...............&3..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Security.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8178355996317889
Encrypted:	false
SSDEEP:	384:HhGuZumutu4uEu5uOuDuyb2uPu1uuuCeuDu7utu:HD
MD5:	FFB7825ACA321A39E4DD495EC4B7E3BE
SHA1:	A4EBE4617E4B98D93FDE5546893A4D29441B5F44
SHA-256:	F56C28857B0E8D30F34089306B9CCF6655F7ED073412E710AB10D747092DA0D2
SHA-512:	86D7C252C870B9362394CFA35B99AE257228E477A5346D8EF5B91E81F3A78CD008DC52A5F3D12C395EFB715F82B849CAD805AD71CF8C58514614F83EACB4F63E
Malicious:	false
Preview:	ElfChnk......................................"...$....u.....................................................................v..C................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.......>...............................................................................**..............Wy.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-StateRepository%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.075909180265887
Encrypted:	false
SSDEEP:	384:NhzAsAvAaAmANSAbNAQAfCHA+AHchArAXATAvAjALATABAtGABS78jAOAqA4eAEp:NGCs2k64i/tpqA
MD5:	3A282029B03747ACB9F0A3496C717BD9
SHA1:	705490A345F883E024CC1641981A90DA6EDADCF5
SHA-256:	2A94A3FFC2481031F58367AB9F99D7972299D7F537520D2A6318B1BAA6B158F8
SHA-512:	F98AEB35B035B10B5C3CCA876E445D502AD84F66BE857B17EFE715983F9834ECAEDCCE5FF03914853115DE1644E9541FF111BD79A3607FA707735546A0C04AD4
Malicious:	false
Preview:	ElfChnk.....................................H.......}{........................................................................dE................<.......................d...=...........................................................................................................................f...............?...........................m...................M...F............................+.......................%..............&...............................................................................**..............\|..3_...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Health.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.162414582102809
Encrypted:	false
SSDEEP:	384:khVpW2pPkpPrpPepP1pP4pPHpPypPxpPYpPDpPypPlpPct1pPnpPsLpPAWpPQpPT:k+tZb
MD5:	0D76B94CB673E07C9297775F6635BB30
SHA1:	42037C8D133B4CD395BA6BDC1108C30882248866
SHA-256:	7133E41E960AD5F46294DCBDC3FFE8CFCFD120213DF680017947924D3C013A8B
SHA-512:	9E5D104332631EDBCB8AF55BCEA2CD7B7EB34A0FE1DF226579E005A775840CDF05C86CCBEF902730138ED1A27347B4FB070FAF37046320740009CC11BAC11C33
Malicious:	false
Preview:	ElfChnk.........'...............'...................u..4.................................................................... ...........................................B...=...........................................................................................................................f...............?...........................m...................M...F...................................................................&...............................................................................**...............h{.`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.217583590897775
Encrypted:	false
SSDEEP:	384:3hUIpGcRpDvpLfpvQpw2pQYph15pcApLqBpJxTp0qo8psfp4yp4Rphe3p7PpLWBD:3YDoh1VLBCVz6t0o3ZeF9UBlG
MD5:	C5BB06A11AA8E33C5D2512146A14F414
SHA1:	BCA1D0ABD07806B4DDB34B4483B04B57A840CC26
SHA-256:	5A42653C87D73E415D15B08AE3511312F991238224022920D85CDEE43316C64A
SHA-512:	8FE28DAC0CEB3BBB462390492FA7623077448CCD58E04EE38C6CE9FF92FAD6647176DD61A628A4C03C3C5DEE9912D67375AE77865DE52D23B2B253C01C43FC86
Malicious:	false
Preview:	ElfChnk.........................................P......a.................................................................... ..................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F...................................................................&...............................................................................**..............T.0.`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1666137709834492
Encrypted:	false
SSDEEP:	384:uwhwCCRzCaCkClCzCYC/CyCVCGCMCvCzCw9CdqCVCICsC:uwKFT
MD5:	88E290384531AC91E63C802B158E726D
SHA1:	2AFD218C14B290A33DC27B0BDBA87AADFD428D9B
SHA-256:	36B48D00709B0F3B917927DE97D395C4785F6A7B61CCC5C72C799C4521FD9D97
SHA-512:	7969E4BDC2659D8412FD187135AB04B329AE134E2A5E386D86BA0E490F979621DCE05DF1118FA31987CB5FD27CB964773F4A67D6884002F7E9579A752E5A2AAD
Malicious:	false
Preview:	ElfChnk.....................................84..p6..........................................................................Pl..................V.......................~...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................v)........................................................................../...**..p............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Store%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	95328
Entropy (8bit):	4.686458683797856
Encrypted:	false
SSDEEP:	768:zv+AywAyCAy6tAyP4s05v+AywAyCAyre5:lakGqEbakIe5
MD5:	3A9D52C4CF9DF9FF73469CF1531022A8
SHA1:	243E7D613C2B38DA2ADBC639983A740778B31008
SHA-256:	93F14F47CF45EC8E9A84E81D44F807185F3067614BD21DCE9BE9830459153075
SHA-512:	9F7A1B40AD35BD6BB03D72946726A3762D5690EE7EF308B2F0A3A64FA2E454759292D343845917A3B5BDF3CABB35A2CCB609F9AA47657301CA658F536A43EA75
Malicious:	false
Preview:	ElfChnk..3.......3.......3.......3...........N...Q.....r......................................................................g.........................................<...=...........................................................................................................................f...............?...........................m...................M...F...................................................................&...............................................................................**..p....3.......N-..a..........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 1 chunks (no. 0 in use), next record no. 15, DIRTY
Category:	dropped
Size (bytes):	79024
Entropy (8bit):	1.8243555656174901
Encrypted:	false
SSDEEP:	384:y/hL6UsE0ZUmxUmgDUmSUmKUmgUmlUmB8UmCUmeUmIUmxjUmLUmnUxhL6UsE0ZUv:YY7LR+Y7LR
MD5:	8F4A3197835332B5EB3B1097779D28A7
SHA1:	25C6BE736424268F10F7F21D4F8E703B5FBFEB4B
SHA-256:	8DB763A92F2734BB8311391DF5BCCAEA658DD2728A2F149261C11CC7F0A2E2F0
SHA-512:	F874CEBB95B01F2D65CA542EDF092C40FE9ED9DFDC255B19C24384911FC86D172443D597051C3A1D900FDAFBFABFF837279282D2F0A3736FAC5C2FC23AC6FCE0
Malicious:	false
Preview:	ElfFile.....................................................................................................................\>.eElfChnk......................................1..04..J.T\|....................................................................&..T................ .......................H...=...........................................................................................................................f...............?...........................m...................M...F...........................&......................................................................................................................*..............a...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TZUtil%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.20434892737239
Encrypted:	false
SSDEEP:	24:Mzbg2Wkw1rPfWwfcnMoNRpYCx/EtfWi05MhL5OkWwj21WhBkco16wa8LDl80hmjj:MtW3rP+yQNRBEZWTENO4bhBkcob/6zk
MD5:	7DA84830C2365B0DBB218E56F42BE048
SHA1:	02826810E1C9828F82120DC163218F77242F3B17
SHA-256:	CB0C22CDD968868FA322D0EEAE3E4AF8B32B20DE4FDBE5FFBB0CECAA984AAC4F
SHA-512:	4F0629A340A6B23EC0EA9A388E5091DE2225833DD87DECD7E0F53B6A97DD2F11601CD33F97B5908E2F7D97A5E2A99CECC4B84B1CFA931033ABDD664E5B557A43
Malicious:	false
Preview:	ElfChnk.............................................e........................................................................=.y................(.......................P...=...........................................................................................................................f...............?...........................m...................M...F...................................................................&...............................................................................**...............p.3a...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.0934111022900845
Encrypted:	false
SSDEEP:	384:phjivnniDiiuXieuietio0i7riTKhiIViOhin5ibaifiWipiUiKijiTVijiHiBRY:pon6ufC/hCI4MWs8PM9QSp
MD5:	C03DC232AFCDF6316B6CC7D1D5266423
SHA1:	8B90D640BB1B09E8C61117DE6B00B93CB1FE69A0
SHA-256:	198FDBBBC7444C323E7DBFB5B6D5B6AB870587FE7B740A05C22C6821B0508D16
SHA-512:	192E77738FC7A6493DFA22C5A56EA01E4A502219756578AE772C4FB0A1074617A21523D1029C6C9DDF15798D0968A0C14C8B723EAB0B91BD01F9967540C04DE9
Malicious:	false
Preview:	ElfChnk.y...............y....................x...z..D.......................................................................Hu...................#..a.......................=.......................#...................................................................................................f...............?................'......P.......................M...F....................................................................@...................#..................................w#.......'..............**......y........`0.Y...........g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Time-Service%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	100392
Entropy (8bit):	2.90277895823838
Encrypted:	false
SSDEEP:	768:+hshamoZqP+INFaqoshamoZqP+INFaqsXqF:+6hYE7NT3hYE7NT6a
MD5:	76F34EF68E46015C53CB7C35B7292438
SHA1:	1F88DC60350F138C0EC820DCB6C935F9CC96496E
SHA-256:	B921FB50DEF74EA6E8739CA57C064A702049FCD692D5E1EBBEC5598BE3A2982E
SHA-512:	45F5C6CD4CD02798A994A3FB16781E7805450C6534870597D27B6B24CEC126FCC97F8AB2E6F83283DCD072A5E5459582FF9C34DB608FC6B76EE81424BCE317CE
Malicious:	false
Preview:	ElfChnk......................................k...m....8........................................................................................6...........................=...........................................................................................................................f...............?...........................m...................M...F...............................................y...........&........0...........%..........................a!..........!F..........................*...............n..a..........E!.0..............................................................<.......T...A.!................@.n..a.....`.......`...(...8........................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.T.i.m.e.-.S.e.r.v.i.c.e.......SN.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.T.i.m.e.-.S.e.r.v.i.c.e./.O.p.e.r.a.t.i.o.n.a.l....%.....................................................<..............*..x................a..........E!.0....................................

C:\Windows\System32\winevt\Logs\Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.386685832930137
Encrypted:	false
SSDEEP:	768:EsasF4a8a/a8a7aRadaQacaXaaaJamagabavaraTaHabavaLaHa/a3aHaPaLa7aX:fF4
MD5:	0F8EBC41337BB0FE1E1350110C8FFF3E
SHA1:	2485A1CF190C989195AA9172D54F51EC3F34BDE8
SHA-256:	FFC2533D7AD10B6E25313AA7583390DEDFA57BA7197B1DB2B23084AE039CAC35
SHA-512:	B5398826684295641D2946017570CD17E5878446F4662785FB9A0BAEC516448DCACE3420A84C761E811EF7364DBBB64E239C6EF561C8D42C666B1A8548B3B2CE
Malicious:	false
Preview:	ElfChnk.........@...............@...............h.........................................................................I...................h...........................=...........................................................................................................................f...............?...........................m...................M...F...................................................................&...........................................A...................................**..P...........%..!a...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Device Registration%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.4157482482643835
Encrypted:	false
SSDEEP:	384:8haXJb4+XJcXJsXJrXJQXJIXJdXJkXJuXJyXJLMXJgXJRpXJBgXJQXJBvXJnXJSc:8Q0yUkNYwD8imLEoRfBoYb5GO
MD5:	A886E83D1948FFB2BF4A2B744DDCCBD3
SHA1:	0074C53E8984FB0024DE0485447D3E1081B34D0B
SHA-256:	6DD70CE24E770699A142E13D62B090F64E00CD0A8501FC2D31E0ED5F9DFAB004
SHA-512:	3263F89608AEB4140553E587A3946E352391DAAC7DF85ABF0358A39B45103655DAE1DE29616A71142C4BB42FD1C0273F3E3B2F6900CCDE672F36ADBB3F7629D1
Malicious:	false
Preview:	ElfChnk......................................D...G..B.f......................................................................0.................j...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&........3..................................................C...........................**..............@V.$..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.342266575776689
Encrypted:	false
SSDEEP:	384:Chbm8mJmAwmsmkmtmZjm9mEJmSmSgmMmJmyFmgmPm4mOmdm9mHbkmzm7m6mBmdmv:CA74DcxI1c8PF
MD5:	302AE7C3FB3FBC33D19DBFB4CA97D867
SHA1:	86165BE8A181F1DE44CC86F75E36890C0379AB94
SHA-256:	1183791BE47DD2268E48827BC2B2F8D2F50C6265AF23904E15E35A8A4715B3DB
SHA-512:	AEE86973AE3C7844DF4EAA3406ECCF1AD59EF458F1623A35B84246B26C83229441B76C64A2502D2F9EF298DAF450D0069C6180A99B041A1D2B9DAD57B6F8A816
Malicious:	false
Preview:	ElfChnk......................................6..P8...P\<........................................................................................R.......................z...=...........................................................................................................................f...............?...........................m...................M...F...................................................................&...........;...........+.......................................................**...............21.`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.711346426112008
Encrypted:	false
SSDEEP:	192:7V7rDiDxFYzDiDPDiDfDiDDDiDxDiDUDiDgDiDsDiDQDiDEDiDYDiDEDiD:7hr2ts2T2z2n2N2w202w2M2Y2E2I2
MD5:	F911674F42FFA9096A39B15D79861134
SHA1:	14C46673DAB47906E3693ABC048CD0C2FADBECB6
SHA-256:	1668A045EF7528D741AAD61574F673D564D9BC7831A57FB6CD4A4D25C3FCA4B5
SHA-512:	2341C1145DCD1E714D0A16CFE517CCD8F0BF6F94A45882A4142B2D90B27A1ACD4F4508AF7E49A52B0B0F2E418EEC461EF2CBB0463D48CC48E08E6880A617B442
Malicious:	false
Preview:	ElfChnk................................................(....................................................................4.KU................T.......................\|...=...........................................................................................................................f...............?...........................m...................M...F...............................-...................................&...............................................................................**..............IL..`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	71640
Entropy (8bit):	3.8668332644778953
Encrypted:	false
SSDEEP:	384:2RtRIzsRccRVwR+Rh7RucVRDRbR2R3RgRxR5RrGRRrRuRVRERfRzRwRQRoRTyDRL:boRNzUhK3Vo
MD5:	6AC9E81348EA20DCBEE8AA401F1F9D2F
SHA1:	6CC0F8879DC823B84E713EB666C6A6C38D0DEFF9
SHA-256:	D8BEA8365E544E3336122FBD085BE1D236F525EA32E1117485523CDEBB068789
SHA-512:	59A81AFC4DF7BAD162AE125F179D8794152CCFFAE27421C0448E23ADE078532D3E0B0F1897D10C846A8BAC36302111918404E410552C9A11F4CB1F0C8BB17DFE
Malicious:	false
Preview:	ElfChnk.:.......w.......:.......w...................q^<.............................................................................................2.......@...............=...........................................S.......................-...........................J..........................f...b..........?...............................A.......G.......M...F.......................................................................................&...........................................................**......s........2...a.........^..&...............................................................<.......T...R.!................@.2...a.....`......`...........s....................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.W.M.I.-.A.c.t.i.v.i.t.y.......#F.~.J.{..M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.W.M.I.-.A.c.t.i.v.i.t.y./.O.p.e.r.a.t.i.o.n.a.l...6..0........6..07.\..+{.([.U.......A..I...@........=..O.p.e.r.a.t.i.o.n._.E.S.S.t.o.C.o.n.s.u.m.e.r.B.i.n.d.i.n.g...o....j.....3.h.t.t.p.:././

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.260359446709512
Encrypted:	false
SSDEEP:	384:fhRhwhdhP0h9hzehShchawhZh4hhhshphihXhMhxhzhwhohGh5h3hShChWhzhLh4:fmFpkBzBiELmn
MD5:	067AD5BE5D9DAC2F9972EA7CCD899B43
SHA1:	EDD013A75A95D510CCEBA7DF86938621FA17E518
SHA-256:	EE5349F31C79D30F8AB2023451ECC640BD33C7F038ED6951D0F9FF2FE82BA0E7
SHA-512:	F2E20C281CD6E14FBDDCE8C89055CF5BC6A3C79E5D65037B269B11F2500E750A15998C9A29365F7D5903E4CF568EA45026E9F340A0318C212E8AD936EA2B3F65
Malicious:	false
Preview:	ElfChnk.........................................`...........................................................................3i._........................................@...=...........................................................................................................................f...............?...........................m...................M...F...........................................i.......................&.......................................................y.......................**................9.`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WebAuthN%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2594795605878295
Encrypted:	false
SSDEEP:	384:LhOVPiVcVCVC7VNVtVEV3Vob7V5VXVmVbVoV/VEVptVtVBVnVOVHV7Vj0V1VXFVq:LyjbPac
MD5:	33C02B19501869BF7DF6F6BF1D2E6BF6
SHA1:	D90AF4BD50FE734A1E74ACC4E0704FEE1346F8D4
SHA-256:	6453729FD9D539566FC7AA3CE013B958C237E0E713AA917444F453C02A96F3BB
SHA-512:	B4D4A162E59651477CE87DE756F9DBD7634A206CA7FA83CA61DD73F86CAE343083AFF067A981DE096AAB1AE6997E599397E4851648800B2BCDAA6E5BAC0797A8
Malicious:	false
Preview:	ElfChnk........."..............."...........h8...9....?......................................................................Z..................&...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................v.......&..............................................................................*..P...........y................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.222447856511044
Encrypted:	false
SSDEEP:	384:vRhcBwBuBwB+BwBZwDIBwBoK/oyBwBY/puBwBN0bNoBwByQZBwBY/UUBwBY/5Bwu:5I0bp6tHrL
MD5:	2728CF054D93BACF2D46684B2BE7B685
SHA1:	88E3C611575E779C38212326B14D113E1FAF5038
SHA-256:	4224E965585D057E00D8A3978861E028624648A2B8112C42FCD104DA8A6F52E0
SHA-512:	D53BD84EA6F13D03AC4A18BAA05C000D04B07D7D3EFED00492E29C6135E7C184F5BE6527EBD6254C9B8F13AC848B30444BB68A1248B480E7ABB64898B880514E
Malicious:	false
Preview:	ElfChnk.....................................H;..x>....;4.....................................................................k.l............................................=...........................................................................................................................f...............?...........................m...................M...F...........................o.......................................&...............................................................................**..(...............`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Winlogon%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.423183909657457
Encrypted:	false
SSDEEP:	384:/hGUEBUEYUEQUEhUE8UE5UE5UE8UExUEFUELUEVUEyUEXUEDUEuDUEBUEWUEzUE3:/P7s3NxG9
MD5:	718C0E7FA4C2A524A5FF961FEB987C13
SHA1:	73CB0C09C67332548F50613AA349E12695C715A2
SHA-256:	461F7778DD38ABE30403674C9E34EFF22F91AB7D4C207FB8CD2C4B31773588CC
SHA-512:	6A7705597D00B2193F3ECD79CDCD4B6D97DA36B879ECBC2E5F8EA3A8B77D9FA301B14E68BBB9ACBBF72B695DC83E66493F3C4D1DD94B1FC9D0E4ABA787BD853B
Malicious:	false
Preview:	ElfChnk.....................................0`...a.....r........................................................................................0.......................X...=...........................................................................................................................f...............?...........................m...................M...F...........................................................................................................................A.......................**.................`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Security.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	84384
Entropy (8bit):	4.248889863867504
Encrypted:	false
SSDEEP:	384:FFR9Be2s7N0oGMtUkwoxMtnFR9Be2s7N0oGMtUkwoxMthtrWovMt9RYolQMDoJLw:HNO2rNO2QRNNASbk3NO2a
MD5:	C9254FF852E968A6678BF656852DDAF8
SHA1:	11DDBEEAD2AD069B39F958BC44D22F5E093F3788
SHA-256:	12D671455347B886BD9F3F4148AE6EBD6036D76F44512C4A373E21D159512FF9
SHA-512:	0FE4DE81557609A184D4A4DF46ECED68142A5505FA8AE4B03948FFE1E6EE950BD228B030DA8493A8CE02B1EDDCA4EDAFAFB8D575DFEE1537463229AC45A46B5D
Malicious:	false
Preview:	ElfChnk.................$.......(................!...Fo......................................................................A..........!.......z...s...h...................=...................................................N...............................................w.......<.......................5...................................c...........).......M...Z...:...............................S...............................V.......................................................................&.......**..0...$........RQ..a.........<.@&........<.@.o.S....../.G.......A..;...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.....d...........oT..S.y.s.t.e.m....A...............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.E.v.e.n.t.l.o.g..........)...G.u.i.d.....&.{.f.c.6.5.d.d.d.8.-.d.6.e.f.-.4.9.6.2.-.8.3.d.5.-.6.e.5.c.f.e.9.c.e.1.

C:\Windows\System32\winevt\Logs\Setup.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	67992
Entropy (8bit):	0.40522333491716434
Encrypted:	false
SSDEEP:	96:3gNVaO8McoE8SRO2UgNVaO8McoE8SRO2:OV74RR3V74RR
MD5:	4AED6DC4A874DEB02D4E034CB7C8381E
SHA1:	DF5FE5802E3AB4745E43A7DE49E0C4AC60EBB701
SHA-256:	775CB04B338E93CCE4F57CE5FE19CA3724EDEE2CAA6DDF8A9D1F6AC98B91C661
SHA-512:	14CB5004825CF361ADB486896CF1C7291D81DFB43B251E3BAD8C063E13AFB74FF1D587B69322FA7146534148DD756C9F9D8389C26FF19B970C52DA2F2486BE82
Malicious:	false
Preview:	ElfChnk..............................................Kp.......................................................................w.............................................=...........................................................................................................................f...............?...........................m...................M...F...................................................................&...............................................................................**..............u....a..........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\System.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	89192
Entropy (8bit):	4.457045499770004
Encrypted:	false
SSDEEP:	768:QxpVOTxpVO6it/uFN3HpRAtF7xpVOS6Rv:sw6KLAtFRov
MD5:	89D4B5CF9CEB2881FA68243AD729FA90
SHA1:	325A0A6849A753C6601174237416BA23374A888A
SHA-256:	D83C72E5ECA638F6B0737651E8963FAFA41A21794FC2C272E1AD5A9A4771ADFD
SHA-512:	42B5BABF433CFCF95733B0E58A9F059AD3F4D7E1BF3E3C7505CDD97DEE071A3F07424E7442A097F60721E670DA6FAE773228A396D609DC6AC9D844CC6983F1AA
Malicious:	false
Preview:	ElfChnk..................................... &..0'.._..v....................................................................X.bq....................s...h...............%...=...................................................N................................ ...%..........w.......8.......................M..................................._...........).......M...;...:...................................................r"......y...~...........................................&...1%..................&...........**..H............RQ..a.........v..&........v..Tr].4....E.C.......A..7...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.....`...........oT..S.y.s.t.e.m....A...............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.E.v.e.n.t.l.o.g..........)...G.u.i.d.....&.{.f.c.6.5.d.d.d.8.-.d.6.e.f.-.4.9.6.2.-.8.3.d.5.-.6.e.5.c.f.e.9.c.e.1.

C:\Windows\System32\winevt\Logs\Windows PowerShell.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	77096
Entropy (8bit):	3.8481877756794898
Encrypted:	false
SSDEEP:	1536:OltSq0IC8ltSq0ICX0ZjN4r47OzHaQhy3i:
MD5:	AECFA35FCC186B873C046B3A50436078
SHA1:	54C5F566A1C07EDD920FD5DAFED5DB1F7B352864
SHA-256:	6DEE7501B9DB577F357A644A6040D704703C694591B6BDEF4209120CE6E98B15
SHA-512:	ADAC7892ECCD49E1BAE4E40BB028FC5B370559CB7FCB7ABB3CCE706B4BFEF0262B8CE1A17653EAD59830B995E4748DC7E95123D939AB071E20E1EA2510C0B3B3
Malicious:	false
Preview:	ElfChnk.................y....................(..(-..........................................................................m...............................................=..........................................................................................................................._...............8...........................f...................M...c...........................v.......................................................................................&...............................**......y.......L....a........L.-9&.......L.-9...P..K`..$5........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..R............{..P.r.o.v.i.d.e.r.../....=.......K...N.a.m.e.......P.o.w.e.r.S.h.e.l.l..A..M...s........a..E.v.e.n.t.I.D...'............)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n............

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.525931537093555
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Kawpow new.exe
File size:	5'471'744 bytes
MD5:	fb6a3b436e9f9402937d95f755b62f91
SHA1:	aea3a8a311c2b8b6fc7d9d263b952f95a30b180e
SHA256:	4c9d878e35e7fd497c633a770d3359fb37447985450dc19f45db0925972c39e0
SHA512:	7a3e2e42fe965db1cebc539235fec88e277669c9a62be2450ea4efaf5dd93f1de11740197ff26e697e9e9acc499cba2c30b64cfa5e5b35b28b9e0b93087ee2f8
SSDEEP:	98304:gBybWc2fgjrlVrH3Y27fd2BY1z7QDkR3m1W:hic2GrrrH3Y2Bd1fIkR3m
TLSH:	3646224D9C715724C56B857C2A351CF0EFE2F9242EFFEAA12ACFA4843D629D62379410
File Content Preview:	MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d......f.........."...........R.....@..........@..............................T...........`........................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140001140
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6693B281 [Sun Jul 14 11:12:01 2024 UTC]
TLS Callbacks:	0x40001760, 0x1, 0x400017e0, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	203d63d5d9a088e2d84cef737227986b

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [0000AED5h]
mov dword ptr [eax], 00000001h
call 00007FBFFC7EFE1Fh
nop
nop
nop
dec eax
add esp, 28h
ret
nop
inc ecx
push edi
inc ecx
push esi
push esi
push edi
push ebx
dec eax
sub esp, 20h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov edi, dword ptr [eax+08h]
dec eax
mov esi, dword ptr [0000AEC9h]
xor eax, eax
dec eax
cmpxchg dword ptr [esi], edi
sete bl
je 00007FBFFC7EFE40h
dec eax
cmp edi, eax
je 00007FBFFC7EFE3Bh
dec esp
mov esi, dword ptr [0000D189h]
nop word ptr [eax+eax+00000000h]
mov ecx, 000003E8h
inc ecx
call esi
xor eax, eax
dec eax
cmpxchg dword ptr [esi], edi
sete bl
je 00007FBFFC7EFE17h
dec eax
cmp edi, eax
jne 00007FBFFC7EFDF9h
dec eax
mov edi, dword ptr [0000AE90h]
mov eax, dword ptr [edi]
cmp eax, 01h
jne 00007FBFFC7EFE1Eh
mov ecx, 0000001Fh
call 00007FBFFC7F9B74h
jmp 00007FBFFC7EFE39h
cmp dword ptr [edi], 00000000h
je 00007FBFFC7EFE1Bh
mov byte ptr [00538531h], 00000001h
jmp 00007FBFFC7EFE2Bh
mov dword ptr [edi], 00000001h
dec eax
mov ecx, dword ptr [0000AE7Ah]
dec eax
mov edx, dword ptr [0000AE7Bh]
call 00007FBFFC7F9B6Bh
mov eax, dword ptr [edi]
cmp eax, 01h
jne 00007FBFFC7EFE2Bh
dec eax
mov ecx, dword ptr [0000AE50h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe048	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x53c000	0x18c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x53f000	0x80	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc0a0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xc410	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xe1e8	0x160	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa0c6	0xa200	daa695e177d70a143384a41c581c4152	False	0.48410976080246915	data	6.120411868835049	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xc000	0x27dc	0x2800	8447d32f062dd402a94b6fd372cdc0e9	False	0.48271484375	data	4.797840406707439	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xf000	0x52c0a8	0x52a800	f4dad1a7599a5afded4b82e1e6a51ec2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x53c000	0x18c	0x200	1194c6cbad6c789127276d08d8015019	False	0.509765625	data	3.1897430361504404	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.00cfg	0x53d000	0x10	0x200	b18c7380298e104adf73576fa46bccc1	False	0.04296875	data	0.15127132530476972	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x53e000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x53f000	0x80	0x200	ac63a5c750fa0a7b812d69f394edeba3	False	0.2421875	data	1.4604375773007994	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
msvcrt.dll	__C_specific_handler, __getmainargs, __initenv, __iob_func, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _commode, _fmode, _initterm, _onexit, _wcsicmp, _wcsnicmp, abort, calloc, exit, fprintf, free, fwrite, malloc, memcpy, memset, signal, strlen, strncmp, vfprintf, wcscat, wcscpy, wcslen, wcsncmp, wcsstr
KERNEL32.dll	DeleteCriticalSection, EnterCriticalSection, GetLastError, InitializeCriticalSection, LeaveCriticalSection, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualProtect, VirtualQuery

Network Behavior

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 7, 2025 16:08:20.432568073 CET	1.1.1.1	192.168.2.7	0xbc8c	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 7, 2025 16:08:20.432568073 CET	1.1.1.1	192.168.2.7	0xbc8c	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 7, 2025 16:08:34.748676062 CET	1.1.1.1	192.168.2.7	0xd45f	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 7, 2025 16:08:34.748676062 CET	1.1.1.1	192.168.2.7	0xd45f	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
ZwEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
ZwResumeThread	INLINE	explorer.exe, winlogon.exe
NtDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
ZwDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
NtEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe
ZwEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
NtResumeThread	INLINE	explorer.exe, winlogon.exe
RtlGetNativeSystemInformation	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
NtEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe

Processes

Process: explorer.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Process: winlogon.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Target ID:	0
Start time:	10:08:01
Start date:	07/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:08:01
Start date:	07/01/2025
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff654350000
File size:	329'504 bytes
MD5 hash:	3BA1A18A0DC30A0545E7765CB97D8E63
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	10:08:01
Start date:	07/01/2025
Path:	C:\Users\user\Desktop\Kawpow new.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Kawpow new.exe"
Imagebase:	0x7ff74ac40000
File size:	5'471'744 bytes
MD5 hash:	FB6A3B436E9F9402937D95F755B62F91
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:08:02
Start date:	07/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:08:02
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:08:02
Start date:	07/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	10:08:06
Start date:	07/01/2025
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff7fb730000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	10:08:08
Start date:	07/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff662580000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:08:08
Start date:	07/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop UsoSvc
Imagebase:	0x7ff7078b0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:08:08
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	10:08:08
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	10:08:08
Start date:	07/01/2025
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff6d4da0000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:08:08
Start date:	07/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop WaaSMedicSvc
Imagebase:	0x7ff7078b0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	10:08:08
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	10:08:08
Start date:	07/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop wuauserv
Imagebase:	0x7ff7078b0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	10:08:08
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	10:08:08
Start date:	07/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop bits
Imagebase:	0x7ff7078b0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	10:08:08
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	10:08:08
Start date:	07/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop dosvc
Imagebase:	0x7ff7078b0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	10:08:08
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	10:08:08
Start date:	07/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff655360000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	10:08:08
Start date:	07/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff655360000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	10:08:08
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	10:08:08
Start date:	07/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff655360000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	10:08:08
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	10:08:08
Start date:	07/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff655360000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	10:08:08
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	10:08:08
Start date:	07/01/2025
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dialer.exe
Imagebase:	0x7ff7ec3d0000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	10:08:08
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	10:08:08
Start date:	07/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe delete "CKTJZLMO"
Imagebase:	0x7ff7078b0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	10:08:08
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	10:08:09
Start date:	07/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe create "CKTJZLMO" binpath= "C:\ProgramData\wwuujrlkomwy\eejhedztifcv.exe" start= "auto"
Imagebase:	0x7ff7078b0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	10:08:09
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	10:08:09
Start date:	07/01/2025
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x7ff6fc1b0000
File size:	906'240 bytes
MD5 hash:	F8B41A1B3E569E7E6F990567F21DCE97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	10:08:09
Start date:	07/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop eventlog
Imagebase:	0x7ff7078b0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	10:08:09
Start date:	07/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe start "CKTJZLMO"
Imagebase:	0x7ff7078b0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	10:08:10
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	10:08:10
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	10:08:10
Start date:	07/01/2025
Path:	C:\ProgramData\wwuujrlkomwy\eejhedztifcv.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\wwuujrlkomwy\eejhedztifcv.exe
Imagebase:	0x7ff669700000
File size:	5'471'744 bytes
MD5 hash:	FB6A3B436E9F9402937D95F755B62F91
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 74%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	10:08:10
Start date:	07/01/2025
Path:	C:\Windows\System32\lsass.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\lsass.exe
Imagebase:	0x7ff6d9390000
File size:	59'456 bytes
MD5 hash:	A1CC00332BBF370654EE3DC8CDC8C95A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	10:08:10
Start date:	07/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	10:08:12
Start date:	07/01/2025
Path:	C:\Windows\System32\dwm.exe
Wow64 process (32bit):	false
Commandline:	"dwm.exe"
Imagebase:	0x7ff74b010000
File size:	94'720 bytes
MD5 hash:	5C27608411832C5B39BA04E33D53536C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	10:08:15
Start date:	07/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	10:08:15
Start date:	07/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	10:08:15
Start date:	07/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	10:08:16
Start date:	07/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	50
Start time:	10:08:16
Start date:	07/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	10:08:16
Start date:	07/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	53
Start time:	10:08:17
Start date:	07/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	54
Start time:	10:08:19
Start date:	07/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	55
Start time:	10:08:19
Start date:	07/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	56
Start time:	10:08:20
Start date:	07/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FF74AC41140 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1351846085.00007FF74AC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF74AC40000, based on PE: true

Associated: 00000004.00000002.1351812745.00007FF74AC40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1351884044.00007FF74AC4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1351919032.00007FF74AC4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1351950143.00007FF74AC50000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1353614812.00007FF74B144000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1353806190.00007FF74B17C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff74ac40000_Kawpow new.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 808f824871d7e1a8eee0a1093264b3d0fd75ff3502bae8c0f48d855cf6986489
Instruction ID: a0ad70f45deaf7553ba4596f36c4468040dc245bf2a681bb6112833b48005c50
Opcode Fuzzy Hash: 808f824871d7e1a8eee0a1093264b3d0fd75ff3502bae8c0f48d855cf6986489
Instruction Fuzzy Hash: 29B01230D4D309C5F340BF01D84135877616B08740FE00070C40C03362CE7D54404B34

Analysis Process: dialer.exePID: 7692, Parent PID: 5520COMMON

Execution Graph

Execution Coverage:	47%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	67%
Total number of Nodes:	227
Total number of Limit Nodes:	24

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 000000014000226C Relevance: 61.4, APIs: 27, Strings: 8, Instructions: 165
registrymemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001F2C: StrCpyW.SHLWAPI ref: 0000000140001F5D
Part of subcall function 0000000140001F2C: StrCatW.SHLWAPI ref: 0000000140001F6B
Part of subcall function 0000000140001F2C: GetModuleHandleW.KERNEL32 ref: 0000000140001F74
Part of subcall function 0000000140001F2C: GetCurrentProcess.KERNEL32 ref: 0000000140001F94
Part of subcall function 0000000140001F2C: K32GetModuleInformation.KERNEL32 ref: 0000000140001FA8
Part of subcall function 0000000140001F2C: CreateFileW.KERNELBASE ref: 0000000140001FD8
Part of subcall function 0000000140001F2C: CreateFileMappingW.KERNELBASE ref: 0000000140002002
Part of subcall function 0000000140001F2C: MapViewOfFile.KERNELBASE ref: 0000000140002025
Part of subcall function 0000000140001F2C: lstrcmpiA.KERNEL32 ref: 000000014000207B
Part of subcall function 0000000140001F2C: CloseHandle.KERNELBASE ref: 00000001400020E7
Part of subcall function 0000000140001F2C: CloseHandle.KERNEL32 ref: 00000001400020F0
Part of subcall function 0000000140001F2C: FreeLibrary.KERNEL32 ref: 00000001400020F9

Part of subcall function 0000000140001F2C: VirtualProtect.KERNELBASE ref: 00000001400020AE
Part of subcall function 0000000140001F2C: VirtualProtect.KERNELBASE ref: 00000001400020DE

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000228F
OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000229F
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 00000001400022B9
LookupPrivilegeValueW.ADVAPI32 ref: 00000001400022D0
AdjustTokenPrivileges.KERNELBASE ref: 0000000140002308
GetLastError.KERNEL32 ref: 0000000140002312
CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000231B
FindResourceExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000232F
SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002346
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000235F
LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002371
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000237E
RegCreateKeyExW.KERNELBASE ref: 00000001400023BE
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400023E5
RegSetKeySecurity.KERNELBASE ref: 00000001400023FE
LocalFree.KERNEL32 ref: 0000000140002408
RegCreateKeyExW.KERNELBASE ref: 000000014000243E
GetCurrentProcessId.KERNEL32 ref: 0000000140002448
RegSetValueExW.KERNELBASE ref: 000000014000246F
RegCloseKey.KERNELBASE ref: 0000000140002479
RegCloseKey.ADVAPI32 ref: 0000000140002483
CreateThread.KERNELBASE ref: 00000001400024A4
GetProcessHeap.KERNEL32 ref: 00000001400024AA
HeapAlloc.KERNEL32 ref: 00000001400024B9
CreateThread.KERNELBASE ref: 00000001400024E8
CreateThread.KERNELBASE ref: 0000000140002509
SleepEx.KERNELBASE ref: 0000000140002511

Strings

SeDebugPrivilege, xrefs: 00000001400022C9
D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA), xrefs: 00000001400023DE
kernel32.dll, xrefs: 0000000140002283
ntdll.dll, xrefs: 0000000140002277
SOFTWARE\dialerconfig, xrefs: 0000000140002399
pid, xrefs: 000000014000241B
DLL, xrefs: 0000000140002321
svc64, xrefs: 0000000140002452

Memory Dump Source

Source File: 0000001F.00000002.2619618506.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001F.00000002.2619163841.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.2619929734.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.2620296845.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140000000_dialer.jbxd

Similarity

API ID: CreateProcess$Close$CurrentHandleResource$FileSecurityThread$DescriptorFreeHeapModuleOpenProtectTokenValueVirtual$AdjustAllocConvertErrorFindInformationLastLibraryLoadLocalLockLookupMappingPrivilegePrivilegesSizeofSleepStringViewlstrcmpi
String ID: D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA)$DLL$SOFTWARE\dialerconfig$SeDebugPrivilege$kernel32.dll$ntdll.dll$pid$svc64
API String ID: 4177739653-1130149537
Opcode ID: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
Instruction ID: c2e61514e361dd61edc66d1a85693de1d2c237bf329a5b31df93bef4cff25afe
Opcode Fuzzy Hash: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
Instruction Fuzzy Hash: B781E4B6200B4196EB26CF62F8547D977A9F78CBD8F44512AEB4A43A78DF38C148C740

Function 00000001400010C0 Relevance: 51.0, APIs: 25, Strings: 4, Instructions: 257
memorystringnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400018AC: OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
Part of subcall function 00000001400018AC: IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
Part of subcall function 00000001400018AC: CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

OpenProcess.KERNEL32 ref: 000000014000112C
OpenProcess.KERNEL32 ref: 000000014000114B
K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001170
PathFindFileNameW.SHLWAPI ref: 000000014000117E
lstrlenW.KERNEL32 ref: 000000014000118A
StrCpyW.SHLWAPI ref: 00000001400011A1
CloseHandle.KERNEL32 ref: 00000001400011AD
StrCmpIW.SHLWAPI ref: 00000001400011E2
NtQueryInformationProcess.NTDLL ref: 0000000140001216
OpenProcessToken.ADVAPI32 ref: 0000000140001240
GetTokenInformation.KERNELBASE ref: 000000014000126C
GetLastError.KERNEL32 ref: 0000000140001276
LocalAlloc.KERNEL32 ref: 0000000140001289
GetTokenInformation.KERNELBASE ref: 00000001400012B5
GetSidSubAuthorityCount.ADVAPI32 ref: 00000001400012C2
GetSidSubAuthority.ADVAPI32 ref: 00000001400012D1
LocalFree.KERNEL32 ref: 00000001400012E9
CloseHandle.KERNEL32 ref: 00000001400012FD
StrStrA.SHLWAPI ref: 00000001400013A7
VirtualAllocEx.KERNELBASE ref: 000000014000140E
WriteProcessMemory.KERNELBASE ref: 0000000140001431
WaitForSingleObject.KERNEL32 ref: 000000014000147D
GetExitCodeThread.KERNEL32 ref: 0000000140001493
CloseHandle.KERNELBASE ref: 00000001400014AB
CloseHandle.KERNEL32 ref: 00000001400014B4

Strings

MSBuild.exe, xrefs: 00000001400011B8
@, xrefs: 0000000140001401
ReflectiveDllMain, xrefs: 000000014000139D
dialer.exe, xrefs: 00000001400011CC

Memory Dump Source

Source File: 0000001F.00000002.2619618506.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001F.00000002.2619163841.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.2619929734.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.2620296845.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140000000_dialer.jbxd

Similarity

API ID: Process$CloseHandle$Open$InformationToken$AllocAuthorityFileLocalName$CodeCountErrorExitFindFreeLastMemoryModuleObjectPathQuerySingleThreadVirtualWaitWow64Writelstrlen
String ID: @$MSBuild.exe$ReflectiveDllMain$dialer.exe
API String ID: 2561231171-3753927220
Opcode ID: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
Instruction ID: 2175fd9260984ecd3e092ef955109d5d50fbfcc0bf213717558b1eb8b1c9701c
Opcode Fuzzy Hash: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
Instruction Fuzzy Hash: 40B138B260468186EB26DF27F8947E927A9FB8CBC4F404125AF4A477B4EF38C645C740

Function 00000001400014D8 Relevance: 19.6, APIs: 13, Instructions: 130
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000000014000150B
HeapAlloc.KERNEL32 ref: 000000014000151E
GetProcessHeap.KERNEL32 ref: 000000014000152C
HeapAlloc.KERNEL32 ref: 000000014000153D
K32EnumProcesses.KERNEL32 ref: 0000000140001557
OpenProcess.KERNEL32 ref: 0000000140001585
K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
ReadProcessMemory.KERNELBASE ref: 00000001400015E1
CloseHandle.KERNELBASE ref: 000000014000161D
GetProcessHeap.KERNEL32 ref: 000000014000162F
RtlFreeHeap.NTDLL ref: 000000014000163D
GetProcessHeap.KERNEL32 ref: 0000000140001643
RtlFreeHeap.NTDLL ref: 0000000140001651

Memory Dump Source

Source File: 0000001F.00000002.2619618506.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001F.00000002.2619163841.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.2619929734.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.2620296845.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140000000_dialer.jbxd

Similarity

API ID: Heap$Process$AllocEnumFree$CloseHandleMemoryModulesOpenProcessesRead
String ID:
API String ID: 4084875642-0
Opcode ID: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
Instruction ID: 4858e5a3d965c592fcd1f5951e26bd94c88d4916acf90710a0b336d1aa1e032e
Opcode Fuzzy Hash: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
Instruction Fuzzy Hash: E6519DB2711A819AEB66CF63E8587EA22A5F78DBC4F444025EF4947764DF38C545C700

Function 0000000140001B54 Relevance: 9.1, APIs: 6, Instructions: 82
memorypipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
LocalAlloc.KERNEL32 ref: 0000000140001BFB
InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Memory Dump Source

Source File: 0000001F.00000002.2619618506.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001F.00000002.2619163841.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.2619929734.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.2620296845.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140000000_dialer.jbxd

Similarity

API ID: DescriptorInitializeSecurity$AllocAllocateCreateDaclEntriesLocalNamedPipe
String ID:
API String ID: 3197395349-0
Opcode ID: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
Instruction ID: 21eaad2a8fcaa81d39f01622d1c01d05a8059e075f91819b3ade9b41c51f013a
Opcode Fuzzy Hash: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
Instruction Fuzzy Hash: FA318D72215691CAE761CF25F490BDE77A5F748B98F40521AFB4947FA8EB78C208CB40

Function 00000001400017EC Relevance: 9.1, APIs: 6, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001801
HeapAlloc.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001812

Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000150B
Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000151E
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000152C
Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000153D
Part of subcall function 00000001400014D8: K32EnumProcesses.KERNEL32 ref: 0000000140001557
Part of subcall function 00000001400014D8: OpenProcess.KERNEL32 ref: 0000000140001585
Part of subcall function 00000001400014D8: K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
Part of subcall function 00000001400014D8: ReadProcessMemory.KERNELBASE ref: 00000001400015E1
Part of subcall function 00000001400014D8: CloseHandle.KERNELBASE ref: 000000014000161D
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000162F
Part of subcall function 00000001400014D8: RtlFreeHeap.NTDLL ref: 000000014000163D
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 0000000140001643
Part of subcall function 00000001400014D8: RtlFreeHeap.NTDLL ref: 0000000140001651

OpenProcess.KERNEL32 ref: 0000000140001859
TerminateProcess.KERNEL32 ref: 000000014000186C
CloseHandle.KERNEL32 ref: 0000000140001875
GetProcessHeap.KERNEL32 ref: 0000000140001885

Memory Dump Source

Source File: 0000001F.00000002.2619618506.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001F.00000002.2619163841.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.2619929734.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.2620296845.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140000000_dialer.jbxd

Similarity

API ID: HeapProcess$Alloc$CloseEnumFreeHandleOpen$MemoryModulesProcessesReadTerminate
String ID:
API String ID: 1323846700-0
Opcode ID: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
Instruction ID: e8e8f15008253283e0d5a10c8ea57e573901c1344bffe788f1ea91b5e390c365
Opcode Fuzzy Hash: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
Instruction Fuzzy Hash: C8115BB1B05A4186FB1ADF27F8443D966A6ABCDBC4F188038EF09037B5DE38C5868700

Function 0000000140001F2C Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 124
filememorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCpyW.SHLWAPI ref: 0000000140001F5D
StrCatW.SHLWAPI ref: 0000000140001F6B
GetModuleHandleW.KERNEL32 ref: 0000000140001F74
GetCurrentProcess.KERNEL32 ref: 0000000140001F94
K32GetModuleInformation.KERNEL32 ref: 0000000140001FA8
CreateFileW.KERNELBASE ref: 0000000140001FD8
CreateFileMappingW.KERNELBASE ref: 0000000140002002
MapViewOfFile.KERNELBASE ref: 0000000140002025
lstrcmpiA.KERNEL32 ref: 000000014000207B
VirtualProtect.KERNELBASE ref: 00000001400020AE
VirtualProtect.KERNELBASE ref: 00000001400020DE
CloseHandle.KERNELBASE ref: 00000001400020E7
CloseHandle.KERNEL32 ref: 00000001400020F0
FreeLibrary.KERNEL32 ref: 00000001400020F9

Strings

C:\Windows\System32\, xrefs: 0000000140001F4F
.text, xrefs: 0000000140002074

Memory Dump Source

Source File: 0000001F.00000002.2619618506.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001F.00000002.2619163841.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.2619929734.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.2620296845.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140000000_dialer.jbxd

Similarity

API ID: FileHandle$CloseCreateModuleProtectVirtual$CurrentFreeInformationLibraryMappingProcessViewlstrcmpi
String ID: .text$C:\Windows\System32\
API String ID: 2721474350-832442975
Opcode ID: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
Instruction ID: 0b364bd3c89a37fdd3fa7b369e4888cbeb1e5b170dc00cf86e963973e9165d3d
Opcode Fuzzy Hash: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
Instruction Fuzzy Hash: CC518BB2204B8096EB62CF16F8587DAB3A5F78CBD4F444525AF4A03B68DF38C549C700

Function 0000000140002BF8 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40
sleepfilepipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001B54: AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
Part of subcall function 0000000140001B54: SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
Part of subcall function 0000000140001B54: LocalAlloc.KERNEL32 ref: 0000000140001BFB
Part of subcall function 0000000140001B54: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
Part of subcall function 0000000140001B54: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
Part of subcall function 0000000140001B54: CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Sleep.KERNEL32 ref: 0000000140002C1D
ConnectNamedPipe.KERNELBASE ref: 0000000140002C2A
ReadFile.KERNELBASE ref: 0000000140002C4D
WriteFile.KERNEL32 ref: 0000000140002C7B
Sleep.KERNEL32 ref: 0000000140002C88
DisconnectNamedPipe.KERNELBASE ref: 0000000140002C91

Strings

\\.\pipe\dialerchildproc64, xrefs: 0000000140002C05
M, xrefs: 0000000140002C6E

Memory Dump Source

Source File: 0000001F.00000002.2619618506.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001F.00000002.2619163841.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.2619929734.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.2620296845.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140000000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorFileInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesLocalReadWrite
String ID: M$\\.\pipe\dialerchildproc64
API String ID: 2203880229-3489460547
Opcode ID: cb78decc689e444f168c8ecd1fa7ab696948f8a3ff5b9be1a13ae3c23ba91d6c
Instruction ID: 6dc3dc8c0bd617ca7cbe615ebfcb02ed857a87361961821bc60a1768ee808972
Opcode Fuzzy Hash: cb78decc689e444f168c8ecd1fa7ab696948f8a3ff5b9be1a13ae3c23ba91d6c
Instruction Fuzzy Hash: C01139B1218A8492F716DB22F8047EE6764A78DBE0F444225BB66036F4DF7CC548C700

Function 00000001400021D0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36
sleeppipefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001B54: AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
Part of subcall function 0000000140001B54: SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
Part of subcall function 0000000140001B54: LocalAlloc.KERNEL32 ref: 0000000140001BFB
Part of subcall function 0000000140001B54: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
Part of subcall function 0000000140001B54: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
Part of subcall function 0000000140001B54: CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Sleep.KERNEL32 ref: 00000001400021F5
ConnectNamedPipe.KERNELBASE ref: 0000000140002202
ReadFile.KERNEL32 ref: 0000000140002225
Sleep.KERNEL32 ref: 0000000140002246
DisconnectNamedPipe.KERNEL32 ref: 000000014000224F

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 00000001400021DD

Memory Dump Source

Source File: 0000001F.00000002.2619618506.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001F.00000002.2619163841.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.2619929734.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.2620296845.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140000000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesFileLocalRead
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 2071455217-3440882674
Opcode ID: 0eadeefac485689016ee7cb8901f6413b977b23d4cbf2cacf1e5db6f82192be8
Instruction ID: d66e41e89491d3fe39127ed5f8ff24c46c9ecc4af95d447005e5476a51c55f6d
Opcode Fuzzy Hash: 0eadeefac485689016ee7cb8901f6413b977b23d4cbf2cacf1e5db6f82192be8
Instruction Fuzzy Hash: 42014BB1204A40A2EA17EB63F8443E9B365A79DBE0F144235FB66476F4DF78C488C700

Function 0000000140002B38 Relevance: 9.1, APIs: 6, Instructions: 58
memorysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140002B53
HeapAlloc.KERNEL32 ref: 0000000140002B67
GetProcessHeap.KERNEL32 ref: 0000000140002B70
HeapAlloc.KERNEL32 ref: 0000000140002B7E
K32EnumProcesses.KERNEL32 ref: 0000000140002B99
Sleep.KERNEL32 ref: 0000000140002BEE

Memory Dump Source

Source File: 0000001F.00000002.2619618506.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001F.00000002.2619163841.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.2619929734.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.2620296845.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140000000_dialer.jbxd

Similarity

API ID: Heap$AllocProcess$EnumProcessesSleep
String ID:
API String ID: 3676546796-0
Opcode ID: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
Instruction ID: 9c67988e037e7d22bad9650836966df18df348572cafe7f0e6f30b42da554bff
Opcode Fuzzy Hash: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
Instruction Fuzzy Hash: 3A115CB26006518AE72ACF17F85579A77A6F78DBC1F154028EB4607B68CF39D881CB40

Function 00000001400018AC Relevance: 4.5, APIs: 3, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

Memory Dump Source

Source File: 0000001F.00000002.2619618506.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001F.00000002.2619163841.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.2619929734.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.2620296845.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140000000_dialer.jbxd

Similarity

API ID: Process$CloseHandleOpenWow64
String ID:
API String ID: 10462204-0
Opcode ID: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
Instruction ID: a864651f2e5c17a125c4a55b2f5ca9b47fcd1256b8d640ad9fe9232b2a40a049
Opcode Fuzzy Hash: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
Instruction Fuzzy Hash: 77F01D7170578192EB56CF17B584399A665E78CBC0F449039EB8943768DF39C4858700

Function 0000000140002258 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000228F
Part of subcall function 000000014000226C: OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000229F
Part of subcall function 000000014000226C: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 00000001400022B9
Part of subcall function 000000014000226C: LookupPrivilegeValueW.ADVAPI32 ref: 00000001400022D0
Part of subcall function 000000014000226C: AdjustTokenPrivileges.KERNELBASE ref: 0000000140002308
Part of subcall function 000000014000226C: GetLastError.KERNEL32 ref: 0000000140002312
Part of subcall function 000000014000226C: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000231B
Part of subcall function 000000014000226C: FindResourceExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000232F
Part of subcall function 000000014000226C: SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002346
Part of subcall function 000000014000226C: LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000235F
Part of subcall function 000000014000226C: LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002371
Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000237E
Part of subcall function 000000014000226C: RegCreateKeyExW.KERNELBASE ref: 00000001400023BE
Part of subcall function 000000014000226C: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400023E5
Part of subcall function 000000014000226C: RegSetKeySecurity.KERNELBASE ref: 00000001400023FE
Part of subcall function 000000014000226C: LocalFree.KERNEL32 ref: 0000000140002408

ExitProcess.KERNEL32 ref: 0000000140002263

Memory Dump Source

Source File: 0000001F.00000002.2619618506.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001F.00000002.2619163841.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.2619929734.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.2620296845.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140000000_dialer.jbxd

Similarity

API ID: Process$Resource$Security$CurrentDescriptorOpenToken$AdjustCloseConvertCreateErrorExitFindFreeHandleLastLoadLocalLockLookupPrivilegePrivilegesSizeofStringValue
String ID:
API String ID: 3836936051-0
Opcode ID: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
Instruction ID: 542f07df19912b07f19d0c3647b83d0aa38d4f887fbb8c9b09a79fc57a6ac5cd
Opcode Fuzzy Hash: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
Instruction Fuzzy Hash: 84A002B1F1794096FA0BB7F7785E3DC21656B9CB82F500415B242472B2DD3C44558716

Non-executed Functions

Function 0000000140002560 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 296
memoryregistryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32 ref: 00000001400025E7

Part of subcall function 00000001400018AC: OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
Part of subcall function 00000001400018AC: IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
Part of subcall function 00000001400018AC: CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

Part of subcall function 00000001400010C0: OpenProcess.KERNEL32 ref: 000000014000112C
Part of subcall function 00000001400010C0: OpenProcess.KERNEL32 ref: 000000014000114B
Part of subcall function 00000001400010C0: K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001170
Part of subcall function 00000001400010C0: PathFindFileNameW.SHLWAPI ref: 000000014000117E
Part of subcall function 00000001400010C0: lstrlenW.KERNEL32 ref: 000000014000118A
Part of subcall function 00000001400010C0: StrCpyW.SHLWAPI ref: 00000001400011A1
Part of subcall function 00000001400010C0: CloseHandle.KERNEL32 ref: 00000001400011AD
Part of subcall function 00000001400010C0: StrCmpIW.SHLWAPI ref: 00000001400011E2
Part of subcall function 00000001400010C0: NtQueryInformationProcess.NTDLL ref: 0000000140001216
Part of subcall function 00000001400010C0: OpenProcessToken.ADVAPI32 ref: 0000000140001240

RegOpenKeyExW.ADVAPI32 ref: 0000000140002683
RegDeleteValueW.ADVAPI32 ref: 000000014000269B
ExitProcess.KERNEL32 ref: 00000001400026BF
GetProcessHeap.KERNEL32 ref: 00000001400026C6
HeapAlloc.KERNEL32 ref: 00000001400026D9
K32EnumProcesses.KERNEL32 ref: 00000001400026F6
ExitProcess.KERNEL32 ref: 0000000140002796

Strings

open, xrefs: 0000000140002960
dialerstager, xrefs: 0000000140002694
SOFTWARE, xrefs: 0000000140002675

Memory Dump Source

Source File: 0000001F.00000002.2619618506.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001F.00000002.2619163841.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.2619929734.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.2620296845.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140000000_dialer.jbxd

Similarity

API ID: Process$Open$File$CloseExitHandleHeapName$AllocDeleteEnumFindInformationModulePathProcessesQueryReadTokenValueWow64lstrlen
String ID: SOFTWARE$dialerstager$open
API String ID: 3276259517-3931493855
Opcode ID: ae79544a1ca264f77e0040c582fad8c70a14f3da5095032f2fa0f831f935a8fc
Instruction ID: ae65b9042581f7dc9e2ee581e3d1b52dcddb088aa692a5b8ad70e1a65f9de3a1
Opcode Fuzzy Hash: ae79544a1ca264f77e0040c582fad8c70a14f3da5095032f2fa0f831f935a8fc
Instruction Fuzzy Hash: 91D14DB13046818BEB7BDF26B8143E92269F74DBC8F404125BB4A47AB9DE78C605C741

Function 0000000140001C88 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 154
injectionthreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 0000000140001D1D
VirtualAllocEx.KERNEL32 ref: 0000000140001D4C
WriteProcessMemory.KERNEL32 ref: 0000000140001D73
WriteProcessMemory.KERNEL32 ref: 0000000140001DB2
VirtualAlloc.KERNEL32 ref: 0000000140001DE3
GetThreadContext.KERNEL32 ref: 0000000140001DFF
WriteProcessMemory.KERNEL32 ref: 0000000140001E26
SetThreadContext.KERNEL32 ref: 0000000140001E44
ResumeThread.KERNEL32 ref: 0000000140001E52
OpenProcess.KERNEL32 ref: 0000000140001E6A
TerminateProcess.KERNEL32 ref: 0000000140001E7D

Strings

@, xrefs: 0000000140001D44

Memory Dump Source

Source File: 0000001F.00000002.2619618506.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001F.00000002.2619163841.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.2619929734.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.2620296845.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140000000_dialer.jbxd

Similarity

API ID: Process$MemoryThreadWrite$AllocContextVirtual$CreateOpenResumeTerminate
String ID: @
API String ID: 3462610200-2766056989
Opcode ID: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
Instruction ID: 5c16bc39e07cf5e776479c29415d8ab36f8b64b080a4e80c067f24e51f003d21
Opcode Fuzzy Hash: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
Instruction Fuzzy Hash: B55122B2700A808AEB52CF66E8447DE77A5FB88BD8F054125EF4997B68DF38C855C700

Function 00000001400019C4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 102memorycomCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00000001400019E6
SysAllocString.OLEAUT32 ref: 00000001400019F6
CoInitializeEx.OLE32 ref: 0000000140001A03
CoInitializeSecurity.OLE32 ref: 0000000140001A3A
CoCreateInstance.OLE32 ref: 0000000140001A7A
VariantInit.OLEAUT32 ref: 0000000140001A8C
CoUninitialize.OLE32 ref: 0000000140001B26
SysFreeString.OLEAUT32 ref: 0000000140001B2F
SysFreeString.OLEAUT32 ref: 0000000140001B38

Strings

dialersvc64, xrefs: 00000001400019DD

Memory Dump Source

Source File: 0000001F.00000002.2619618506.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001F.00000002.2619163841.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.2619929734.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.2620296845.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140000000_dialer.jbxd

Similarity

API ID: String$AllocFreeInitialize$CreateInitInstanceSecurityUninitializeVariant
String ID: dialersvc64
API String ID: 4184240511-3881820561
Opcode ID: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
Instruction ID: f04b9e4fe08d72b668f3c34f73b3c63bb96ebc933f76805d9c48aa5d26f439e8
Opcode Fuzzy Hash: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
Instruction Fuzzy Hash: 69415A72704A819AE712CF6AE8543DD73B5FB89B89F044125EF4E47A64DF38D149C300

Function 0000000140001000 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 0000000140001034
RegDeleteKeyW.ADVAPI32 ref: 0000000140001045
RegEnumKeyExW.ADVAPI32 ref: 0000000140001082
RegCloseKey.ADVAPI32 ref: 0000000140001093
RegDeleteKeyExW.ADVAPI32 ref: 00000001400010B0

Strings

SOFTWARE\dialerconfig, xrefs: 0000000140001026, 000000014000109C

Memory Dump Source

Source File: 0000001F.00000002.2619618506.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001F.00000002.2619163841.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.2619929734.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.2620296845.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140000000_dialer.jbxd

Similarity

API ID: Delete$CloseEnumOpen
String ID: SOFTWARE\dialerconfig
API String ID: 3013565938-461861421
Opcode ID: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
Instruction ID: 8f4ace04a6ff3505bb025a84b088d585f414f6eddbaae7ea6d4a7c6b6057ac94
Opcode Fuzzy Hash: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
Instruction Fuzzy Hash: 2F1186B2714A8486E762CF26F8557E92378F78C7D8F404215A74D0BAA8DF7CC248CB54

Function 0000000140002A90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 0000000140002ACB
WriteFile.KERNEL32 ref: 0000000140002AF3
WriteFile.KERNEL32 ref: 0000000140002B16
CloseHandle.KERNEL32 ref: 0000000140002B1F

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 0000000140002AA8

Memory Dump Source

Source File: 0000001F.00000002.2619618506.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001F.00000002.2619163841.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.2619929734.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.2620296845.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140000000_dialer.jbxd

Similarity

API ID: File$Write$CloseCreateHandle
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 148219782-3440882674
Opcode ID: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
Instruction ID: c657f3a7a6ba8077c0f3fca19c98ae9a251d12aa6ce49f65425284bb78429f7a
Opcode Fuzzy Hash: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
Instruction Fuzzy Hash: AE1139B6720B5082EB16CF16F818399A764F78DFE4F544215AB6907BA4CF78C549CB40

Function 0000000140001914 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,0000000140002138), ref: 0000000140001924
GetProcAddress.KERNEL32(?,?,00000000,0000000140002138), ref: 0000000140001937

Strings

ntdll.dll, xrefs: 000000014000191A

Memory Dump Source

Source File: 0000001F.00000002.2619618506.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001F.00000002.2619163841.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.2619929734.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.2620296845.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_140000000_dialer.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ntdll.dll
API String ID: 1646373207-2227199552
Opcode ID: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
Instruction ID: 7108e587e86fbdef38877cdd133235ae9a077454219746bc209a409130a8dfa8
Opcode Fuzzy Hash: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
Instruction Fuzzy Hash: 5BD0C9F471260582EE1BDBA378643E552996B5CBC5F884020AE164B360DA38C1998600

Analysis Process: winlogon.exePID: 556, Parent PID: 7692COMMON

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	95.1%
Signature Coverage:	0%
Total number of Nodes:	123
Total number of Limit Nodes:	16

Executed Functions

Function 000001CA7D1E1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001CA7D1E1633
HeapAlloc.KERNEL32 ref: 000001CA7D1E1642

Part of subcall function 000001CA7D1E1268: GetProcessHeap.KERNEL32 ref: 000001CA7D1E126E
Part of subcall function 000001CA7D1E1268: HeapAlloc.KERNEL32 ref: 000001CA7D1E127D
Part of subcall function 000001CA7D1E1268: GetProcessHeap.KERNEL32 ref: 000001CA7D1E1297
Part of subcall function 000001CA7D1E1268: HeapAlloc.KERNEL32 ref: 000001CA7D1E12A8

RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E16B2
RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E16DF
RegCloseKey.ADVAPI32 ref: 000001CA7D1E16F9
RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E1719
RegCloseKey.ADVAPI32 ref: 000001CA7D1E1734
RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E1754
RegCloseKey.ADVAPI32 ref: 000001CA7D1E176F
RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E178F
RegCloseKey.ADVAPI32 ref: 000001CA7D1E17AA
RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E17CA
RegCloseKey.ADVAPI32 ref: 000001CA7D1E17E5
RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E1805
RegCloseKey.ADVAPI32 ref: 000001CA7D1E1820
RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E1840
RegCloseKey.ADVAPI32 ref: 000001CA7D1E185B
RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E187B
RegCloseKey.ADVAPI32 ref: 000001CA7D1E1896
RegCloseKey.ADVAPI32 ref: 000001CA7D1E18A0

Part of subcall function 000001CA7D1E12BC: RegQueryInfoKeyW.ADVAPI32 ref: 000001CA7D1E1319
Part of subcall function 000001CA7D1E12BC: GetProcessHeap.KERNEL32 ref: 000001CA7D1E1327
Part of subcall function 000001CA7D1E12BC: HeapAlloc.KERNEL32 ref: 000001CA7D1E1338
Part of subcall function 000001CA7D1E12BC: RegEnumValueW.ADVAPI32 ref: 000001CA7D1E1397
Part of subcall function 000001CA7D1E12BC: GetProcessHeap.KERNEL32 ref: 000001CA7D1E13DF
Part of subcall function 000001CA7D1E12BC: HeapAlloc.KERNEL32 ref: 000001CA7D1E13ED
Part of subcall function 000001CA7D1E12BC: GetProcessHeap.KERNEL32 ref: 000001CA7D1E140A
Part of subcall function 000001CA7D1E12BC: HeapFree.KERNEL32 ref: 000001CA7D1E1418
Part of subcall function 000001CA7D1E12BC: lstrlenW.KERNEL32 ref: 000001CA7D1E1421
Part of subcall function 000001CA7D1E12BC: GetProcessHeap.KERNEL32 ref: 000001CA7D1E142F
Part of subcall function 000001CA7D1E12BC: HeapAlloc.KERNEL32 ref: 000001CA7D1E143D

Strings

SOFTWARE\dialerconfig, xrefs: 000001CA7D1E1692
paths, xrefs: 000001CA7D1E1788
service_names, xrefs: 000001CA7D1E17C3
process_names, xrefs: 000001CA7D1E174D
tcp_local, xrefs: 000001CA7D1E17FE
pid, xrefs: 000001CA7D1E1712
tcp_remote, xrefs: 000001CA7D1E1839
udp, xrefs: 000001CA7D1E1874
startup, xrefs: 000001CA7D1E16D5

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 48ce8952a82ebc74220c2487228d1bc0113687a5d257c47da5ea2c9a7a45dc1b
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 12711737B51B1986FB119F61E880ED933A4FB85B8DF811111DA4E43B68DF3AC485C392

Function 000001CA7D1E3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 000001CA7D1E379E
GetCurrentProcess.KERNEL32 ref: 000001CA7D1E37CC
VirtualProtectEx.KERNEL32 ref: 000001CA7D1E37EE
GetCurrentProcess.KERNEL32 ref: 000001CA7D1E3809
VirtualProtectEx.KERNEL32 ref: 000001CA7D1E382A

Strings

wr, xrefs: 000001CA7D1E37FF

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 1437afb44a6030bed97caeb438423ad72f3f4486f91bb87fdb2879e943d99604
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: ED118E37B4574582FF159B51E404AA972B0FB89F8AF840129DE8903754EF3EC505C746

Function 000001CA7D1E5B30 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000001CA7D1E5B6B
GetThreadContext.KERNEL32 ref: 000001CA7D1E5CD5

Part of subcall function 000001CA7D1E5960: GetCurrentThreadId.KERNEL32 ref: 000001CA7D1E5964

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
Instruction ID: 9e730dcd64c9b4873a2407d987be952f30225ce8fa84111ce86869373716654e
Opcode Fuzzy Hash: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
Instruction Fuzzy Hash: 37D1BC37644B8881FA71DB06E49079AB7A0F7C8B89F500216EACD47BA5DF3DC541CB92

Function 000001CA7D1E50D0 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000001CA7D1E5156

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
Instruction ID: 186141dc81254af0a0e79f67f44779af937e48d3e6299e15823b50d9708dab82
Opcode Fuzzy Hash: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
Instruction Fuzzy Hash: B5021A33658B8886F761CB55F49079AB7A0F7C4789F500015EA8E87BA9DF7DC484CB42

Function 000001CA7D1E39E0 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 000001CA7D1E3A66
VirtualAlloc.KERNEL32 ref: 000001CA7D1E3AA0

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction ID: efa9a61321a05f5721407d38492656d5084e18caa73be618f57ab66f9e01f62e
Opcode Fuzzy Hash: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction Fuzzy Hash: 7F312733A59B8881FA32AA15E05479E76A0FBC4B8EF900515F5CD46798DF7EC1C08B87

Function 000001CA7D1E328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000001CA7D1E32AE
PathFindFileNameW.SHLWAPI ref: 000001CA7D1E32BD

Part of subcall function 000001CA7D1E3844: StrCmpNIW.SHLWAPI ref: 000001CA7D1E385C

Part of subcall function 000001CA7D1E3790: GetModuleHandleW.KERNEL32 ref: 000001CA7D1E379E
Part of subcall function 000001CA7D1E3790: GetCurrentProcess.KERNEL32 ref: 000001CA7D1E37CC
Part of subcall function 000001CA7D1E3790: VirtualProtectEx.KERNEL32 ref: 000001CA7D1E37EE
Part of subcall function 000001CA7D1E3790: GetCurrentProcess.KERNEL32 ref: 000001CA7D1E3809
Part of subcall function 000001CA7D1E3790: VirtualProtectEx.KERNEL32 ref: 000001CA7D1E382A

CreateThread.KERNEL32 ref: 000001CA7D1E330B

Part of subcall function 000001CA7D1E1D14: GetCurrentThread.KERNEL32 ref: 000001CA7D1E1D1F

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 48bd2577c4afaca7072e3fbef1ae148441cb0d439950237a956cc62ed7abe44a
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 49116133E9074882F7629761F845FE932A4BF54B4FFD04125A906415A2EF7BC04483D3

Function 000001CA7D1E4DF0 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 000001CA7D1E4DF4
VirtualProtect.KERNEL32 ref: 000001CA7D1E4E37
FlushInstructionCache.KERNEL32 ref: 000001CA7D1E4E4C

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
Instruction ID: 745996f67f8af34395719e6fd1a935c418c87249f72ce47cbee2d4951f10e5ff
Opcode Fuzzy Hash: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
Instruction Fuzzy Hash: E1F03037658B08C0F632DB11E441B9A7BA0F7887D8F940111FACD43B69DA3EC580CB82

Function 000001CA7D1B273C Relevance: 3.2, APIs: 2, Instructions: 187
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000001CA7D1B27DB
LoadLibraryA.KERNELBASE ref: 000001CA7D1B285E

Memory Dump Source

Source File: 00000025.00000002.2629244690.000001CA7D1B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1b0000_winlogon.jbxd

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 371cd42a6a5bec0abf48dcf5dd3b8f5c2ba92a03d5d6d1c4d01554504f57e61a
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: F5611233F417E887EB568F15D000BADB392FB54BA8F988121DE5D07788DA39D856C782

Function 000001CA7D1E1ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001CA7D1E1628: GetProcessHeap.KERNEL32 ref: 000001CA7D1E1633
Part of subcall function 000001CA7D1E1628: HeapAlloc.KERNEL32 ref: 000001CA7D1E1642
Part of subcall function 000001CA7D1E1628: RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E16B2
Part of subcall function 000001CA7D1E1628: RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E16DF
Part of subcall function 000001CA7D1E1628: RegCloseKey.ADVAPI32 ref: 000001CA7D1E16F9
Part of subcall function 000001CA7D1E1628: RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E1719
Part of subcall function 000001CA7D1E1628: RegCloseKey.ADVAPI32 ref: 000001CA7D1E1734
Part of subcall function 000001CA7D1E1628: RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E1754
Part of subcall function 000001CA7D1E1628: RegCloseKey.ADVAPI32 ref: 000001CA7D1E176F
Part of subcall function 000001CA7D1E1628: RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E178F
Part of subcall function 000001CA7D1E1628: RegCloseKey.ADVAPI32 ref: 000001CA7D1E17AA
Part of subcall function 000001CA7D1E1628: RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E17CA

Sleep.KERNEL32 ref: 000001CA7D1E1AD7
SleepEx.KERNELBASE ref: 000001CA7D1E1ADD

Part of subcall function 000001CA7D1E1628: RegCloseKey.ADVAPI32 ref: 000001CA7D1E17E5
Part of subcall function 000001CA7D1E1628: RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E1805
Part of subcall function 000001CA7D1E1628: RegCloseKey.ADVAPI32 ref: 000001CA7D1E1820
Part of subcall function 000001CA7D1E1628: RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E1840
Part of subcall function 000001CA7D1E1628: RegCloseKey.ADVAPI32 ref: 000001CA7D1E185B
Part of subcall function 000001CA7D1E1628: RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E187B
Part of subcall function 000001CA7D1E1628: RegCloseKey.ADVAPI32 ref: 000001CA7D1E1896
Part of subcall function 000001CA7D1E1628: RegCloseKey.ADVAPI32 ref: 000001CA7D1E18A0

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 90bbf13b46906a81cca8f7b5d075952f832bd840b306eeba2e69fe4698c1ced9
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 37312F33A8474941FB529B22DA40BE933B5BF44BCEF8A54618E0987295FE12C4D1C3B3

Non-executed Functions

Function 000001CA7D1E2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000001CA7D1E2BD0
lstrlenW.KERNEL32 ref: 000001CA7D1E2E0A

Part of subcall function 000001CA7D1E199C: OpenProcess.KERNEL32 ref: 000001CA7D1E19C2
Part of subcall function 000001CA7D1E199C: K32GetModuleFileNameExW.KERNEL32 ref: 000001CA7D1E19E0
Part of subcall function 000001CA7D1E199C: PathFindFileNameW.SHLWAPI ref: 000001CA7D1E19EF
Part of subcall function 000001CA7D1E199C: lstrlenW.KERNEL32 ref: 000001CA7D1E19FB
Part of subcall function 000001CA7D1E199C: StrCpyW.SHLWAPI ref: 000001CA7D1E1A0E
Part of subcall function 000001CA7D1E199C: CloseHandle.KERNEL32 ref: 000001CA7D1E1A1C

GetProcAddress.KERNEL32 ref: 000001CA7D1E2BE5

Part of subcall function 000001CA7D1E152C: StrCmpIW.SHLWAPI ref: 000001CA7D1E155D

Part of subcall function 000001CA7D1E3844: StrCmpNIW.SHLWAPI ref: 000001CA7D1E385C

StrCmpNIW.SHLWAPI ref: 000001CA7D1E2C28
lstrlenW.KERNEL32 ref: 000001CA7D1E2D50

Strings

ntdll.dll, xrefs: 000001CA7D1E2BC9
\Device\Nsi, xrefs: 000001CA7D1E2C1B
NtQueryObject, xrefs: 000001CA7D1E2BDB

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: ea87f51b4d246b202b162c5beb234da6051bdf7f7ec10de7cdedcfd0f2486952
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: C6B18E33A51B5882FB6A8F25D460BE973A5FF44B8EF84505AEE0953794DB36C840C382

Function 000001CA7D1E7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000001CA7D1E7DAC
RtlCaptureContext.NTDLL ref: 000001CA7D1E7DD9
RtlLookupFunctionEntry.NTDLL ref: 000001CA7D1E7DF3
RtlVirtualUnwind.NTDLL ref: 000001CA7D1E7E34
IsDebuggerPresent.KERNEL32 ref: 000001CA7D1E7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000001CA7D1E7EA9
UnhandledExceptionFilter.KERNEL32 ref: 000001CA7D1E7EB4

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: c6cc1a2b66a7223f86c8833438918cb61fa612acceaea4aed7f027ca5527fed7
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 5A316F77645B848AFB61DF60E840BED7360FB84748F84402ADA8E57B94EF39C548C752

Function 000001CA7D1ED2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000001CA7D1ED31D
RtlLookupFunctionEntry.NTDLL ref: 000001CA7D1ED335
RtlVirtualUnwind.NTDLL ref: 000001CA7D1ED370
IsDebuggerPresent.KERNEL32 ref: 000001CA7D1ED3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000001CA7D1ED3B3
UnhandledExceptionFilter.KERNEL32 ref: 000001CA7D1ED3BE

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 41f782a374a9e7ac0e04b499f40d3f10b57880f75d585e5a1c91e151fdb1a05c
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 7D31BE37644B8486FB21CF25E840BDE73A0FB89759F940126EA8D43B99EF39C145CB42

Function 000001CA7D1E7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000001CA7D1E798C
GetCurrentThreadId.KERNEL32 ref: 000001CA7D1E799A
GetCurrentProcessId.KERNEL32 ref: 000001CA7D1E79A6
QueryPerformanceCounter.KERNEL32 ref: 000001CA7D1E79B6

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 6c190a95eddca58bebb779cd6f5741fc51bdbaffc4857ac3b0ec7aa6c4f8f1e4
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: C1112E32B55F0589FB01CF60E8547A833A4FB5975CF840E21DE6D867A4EB79C19983C2

Function 000001CA7D1EDCE0 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
Instruction ID: e8a152b29c9dc1c6f23f48376aabb017e8c2a3263a0affc95413c9e1d5eb2ddd
Opcode Fuzzy Hash: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
Instruction Fuzzy Hash: F551D433B4079489FB21DB72A840BDE7BA1FB4479DF988114EE5827B99DA39C401C742

Function 000001CA7D1F6218 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06bdc7bdcce5dafae6e0238bdb12be328aa1397a169adc73bdcff9f24297e149
Instruction ID: a448f7bb0c2100c17309db19a22ea3cdab781a59969db90d663f4ba9f1525f78
Opcode Fuzzy Hash: 06bdc7bdcce5dafae6e0238bdb12be328aa1397a169adc73bdcff9f24297e149
Instruction Fuzzy Hash: 9A31C5F7D8FBC84AF3934B784977A893F90BBA1B18F8E8056C381421C7A65759058383

Function 000001CA7D1C36F0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2629244690.000001CA7D1B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1b0000_winlogon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06df2142d5dd0183fd0e01b7d5608ecb5bc0210788fa76ce78b9fbce82fbb0aa
Instruction ID: c70208b93198a25992856707a338619cefe2d793cbcf0771febef66b4268afc6
Opcode Fuzzy Hash: 06df2142d5dd0183fd0e01b7d5608ecb5bc0210788fa76ce78b9fbce82fbb0aa
Instruction Fuzzy Hash: 7AF068727543988EEB998F68A402B5A77D1F708388FD08159D69983B04D33DC050CF45

Function 000001CA7D1E12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001CA7D1E1319
GetProcessHeap.KERNEL32 ref: 000001CA7D1E1327
HeapAlloc.KERNEL32 ref: 000001CA7D1E1338
RegEnumValueW.ADVAPI32 ref: 000001CA7D1E1397

Part of subcall function 000001CA7D1E152C: StrCmpIW.SHLWAPI ref: 000001CA7D1E155D

GetProcessHeap.KERNEL32 ref: 000001CA7D1E13DF
HeapAlloc.KERNEL32 ref: 000001CA7D1E13ED
GetProcessHeap.KERNEL32 ref: 000001CA7D1E140A
HeapFree.KERNEL32 ref: 000001CA7D1E1418
lstrlenW.KERNEL32 ref: 000001CA7D1E1421
GetProcessHeap.KERNEL32 ref: 000001CA7D1E142F
HeapAlloc.KERNEL32 ref: 000001CA7D1E143D
StrCpyW.SHLWAPI ref: 000001CA7D1E145F
GetProcessHeap.KERNEL32 ref: 000001CA7D1E1476
HeapFree.KERNEL32 ref: 000001CA7D1E1484

Strings

d, xrefs: 000001CA7D1E135A

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: e7645e214f6475b5f26edb55c88840f96c5a30b1b602d3f65bf79884d792b9a8
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 8A518DB3A45B8886FB11CF62E44879A77A1FB89F89F844124DE4907719DF3DC445C742

Function 000001CA7D1E1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000001CA7D1E1D1F

Part of subcall function 000001CA7D1E1FD4: GetModuleHandleA.KERNEL32 ref: 000001CA7D1E1FEC
Part of subcall function 000001CA7D1E1FD4: GetProcAddress.KERNEL32 ref: 000001CA7D1E1FFD

Part of subcall function 000001CA7D1E5B30: GetCurrentThreadId.KERNEL32 ref: 000001CA7D1E5B6B

Strings

EnumServiceGroupW, xrefs: 000001CA7D1E1DF0
NtDeviceIoControlFile, xrefs: 000001CA7D1E1E56
NtQueryDirectoryFile, xrefs: 000001CA7D1E1D7F
NtQuerySystemInformation, xrefs: 000001CA7D1E1D45
ntdll.dll, xrefs: 000001CA7D1E1D2D
NtEnumerateKey, xrefs: 000001CA7D1E1DB9
NtResumeThread, xrefs: 000001CA7D1E1D62
EnumServicesStatusExW, xrefs: 000001CA7D1E1E11, 000001CA7D1E1E32
advapi32.dll, xrefs: 000001CA7D1E1DF7, 000001CA7D1E1E18
NtQueryDirectoryFileEx, xrefs: 000001CA7D1E1D9C
sechost.dll, xrefs: 000001CA7D1E1E39
NtEnumerateValueKey, xrefs: 000001CA7D1E1DD6

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 78337731afdec34c9cfa824d5e060e934d323296e0797ae460139294bdbcf7ad
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: ED31AF76D81B0EA0FA02EF65E861FE47321BF0135DFC51057941902566AE7AC28AC3E3

Function 000001CA7D1B6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001CA7D1B6938
__scrt_acquire_startup_lock.LIBCMT ref: 000001CA7D1B698A
_RTC_Initialize.LIBCMT ref: 000001CA7D1B69B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001CA7D1B69DE
__scrt_release_startup_lock.LIBCMT ref: 000001CA7D1B6A09

Strings

`eh vector vbase copy constructor iterator', xrefs: 000001CA7D1B69EE
`eh vector copy constructor iterator', xrefs: 000001CA7D1B6A3B
scriptor', xrefs: 000001CA7D1B6B39, 000001CA7D1B6BB2, 000001CA7D1B6BEC
`dynamic initializer for ', xrefs: 000001CA7D1B69C7

Memory Dump Source

Source File: 00000025.00000002.2629244690.000001CA7D1B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1b0000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 99f2c08cbdff331c93203f278c729cdb7b88395c708101498294299cc26d5d2f
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 7981D073F8430D8AFA52AB269451BE932A0FFA578CFD44015D94C4B796DB3BC8858783

Function 000001CA7D1ECE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 000001CA7D1ECE37
FlsGetValue.KERNEL32(?,?,?,000001CA7D1F0A6B,?,?,?,000001CA7D1F045C,?,?,?,000001CA7D1EC84F), ref: 000001CA7D1ECE4C
FlsSetValue.KERNEL32(?,?,?,000001CA7D1F0A6B,?,?,?,000001CA7D1F045C,?,?,?,000001CA7D1EC84F), ref: 000001CA7D1ECE6D
FlsSetValue.KERNEL32(?,?,?,000001CA7D1F0A6B,?,?,?,000001CA7D1F045C,?,?,?,000001CA7D1EC84F), ref: 000001CA7D1ECE9A
FlsSetValue.KERNEL32(?,?,?,000001CA7D1F0A6B,?,?,?,000001CA7D1F045C,?,?,?,000001CA7D1EC84F), ref: 000001CA7D1ECEAB
FlsSetValue.KERNEL32(?,?,?,000001CA7D1F0A6B,?,?,?,000001CA7D1F045C,?,?,?,000001CA7D1EC84F), ref: 000001CA7D1ECEBC
SetLastError.KERNEL32 ref: 000001CA7D1ECED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000001CA7D1F0A6B,?,?,?,000001CA7D1F045C,?,?,?,000001CA7D1EC84F), ref: 000001CA7D1ECF0D
FlsSetValue.KERNEL32(?,?,00000001,000001CA7D1EECCC,?,?,?,?,000001CA7D1EBF9F,?,?,?,?,?,000001CA7D1E7AB0), ref: 000001CA7D1ECF2C

Part of subcall function 000001CA7D1ED6CC: HeapAlloc.KERNEL32 ref: 000001CA7D1ED721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001CA7D1F0A6B,?,?,?,000001CA7D1F045C,?,?,?,000001CA7D1EC84F), ref: 000001CA7D1ECF54

Part of subcall function 000001CA7D1ED744: HeapFree.KERNEL32 ref: 000001CA7D1ED75A
Part of subcall function 000001CA7D1ED744: GetLastError.KERNEL32 ref: 000001CA7D1ED764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001CA7D1F0A6B,?,?,?,000001CA7D1F045C,?,?,?,000001CA7D1EC84F), ref: 000001CA7D1ECF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001CA7D1F0A6B,?,?,?,000001CA7D1F045C,?,?,?,000001CA7D1EC84F), ref: 000001CA7D1ECF76

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: 8296048ea8ffe2076b5639f4ac60f58a94fc61a4852f985f49d5950637c27c62
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: C1416B32EC134C42FA6BA3355941BE972537F447BEFD84724A836466D6EA2AC84183C3

Function 000001CA7D1E2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001CA7D1E2259
GetCurrentProcessId.KERNEL32 ref: 000001CA7D1E2263

Part of subcall function 000001CA7D1E1934: OpenProcess.KERNEL32 ref: 000001CA7D1E1952
Part of subcall function 000001CA7D1E1934: IsWow64Process.KERNEL32 ref: 000001CA7D1E1968
Part of subcall function 000001CA7D1E1934: CloseHandle.KERNEL32 ref: 000001CA7D1E1983

CreateFileW.KERNEL32 ref: 000001CA7D1E22BC
WriteFile.KERNEL32 ref: 000001CA7D1E22E4
ReadFile.KERNEL32 ref: 000001CA7D1E2303
CloseHandle.KERNEL32 ref: 000001CA7D1E230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 000001CA7D1E2293
\\.\pipe\dialerchildproc64, xrefs: 000001CA7D1E228C

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: fd45427aeee6357c87aaea6c99e18d604ac28c80192c8d27bf1af2cc7dda8255
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 4E219233A5474483FB11CB24F454B9973A1FB89BA9FA00215EA5903BA8CF3DC149CF42

Function 000001CA7D1B9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001CA7D1B99A1

Part of subcall function 000001CA7D1BA814: __GetUnwindTryBlock.LIBCMT ref: 000001CA7D1BA857
Part of subcall function 000001CA7D1BA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001CA7D1BA87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001CA7D1B9A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001CA7D1B9CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001CA7D1B9DDA

Strings

csm, xrefs: 000001CA7D1B9A22
csm, xrefs: 000001CA7D1B99BB
csm, xrefs: 000001CA7D1B9A9C

Memory Dump Source

Source File: 00000025.00000002.2629244690.000001CA7D1B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1b0000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 6d2781804dbe8b1ea41af8a2371f1589b4dd2bfa224022df002ce09c2fb839c7
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: E4E1BD73A44B488AFB629B65D480BDD77A0FB45B8CF800115EE8D57B99CB36C092C783

Function 000001CA7D1EA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001CA7D1EA5A1

Part of subcall function 000001CA7D1EB414: __GetUnwindTryBlock.LIBCMT ref: 000001CA7D1EB457
Part of subcall function 000001CA7D1EB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001CA7D1EB47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001CA7D1EA679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001CA7D1EA8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001CA7D1EA9DA

Strings

csm, xrefs: 000001CA7D1EA622
csm, xrefs: 000001CA7D1EA5BB
csm, xrefs: 000001CA7D1EA69C

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: 8c57a0ee9345419c73fab16e88ad87043601f387ae73b4eb170320544ddd202f
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 38E18B73A407488AFB22DF259580BDD77A0FB9979EF900116EE8957B95CB35C081C783

Function 000001CA7D1EF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000001CA7D1EF510
GetProcAddress.KERNEL32 ref: 000001CA7D1EF51C

Strings

api-ms-, xrefs: 000001CA7D1EF45A
ext-ms-, xrefs: 000001CA7D1EF46D

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 3f1bf872b977040abdece61366c477209e7c321d0cf28104e8ad10cb84968118
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 6641C233B91B0881FB17CB66A804BD53392BF45BE9FD942259D0A87785EE3AC4458393

Function 000001CA7D1E104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001CA7D1E10B1
RegEnumValueW.ADVAPI32 ref: 000001CA7D1E1117
GetProcessHeap.KERNEL32 ref: 000001CA7D1E115A
HeapAlloc.KERNEL32 ref: 000001CA7D1E1168
GetProcessHeap.KERNEL32 ref: 000001CA7D1E1185
HeapFree.KERNEL32 ref: 000001CA7D1E1193

Strings

d, xrefs: 000001CA7D1E10D6

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 0332acd1771d854494ee12fb43ad52b5304bce5d0e0612f73963db57a60a753a
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 2741A1B3614B88C6F761CF21E444B9E77A1F788B89F448129DA8947758DF39C485CB42

Function 000001CA7D1ED068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000001CA7D1EC7DE,?,?,?,?,?,?,?,?,000001CA7D1ECF9D,?,?,00000001), ref: 000001CA7D1ED087
FlsSetValue.KERNEL32(?,?,?,000001CA7D1EC7DE,?,?,?,?,?,?,?,?,000001CA7D1ECF9D,?,?,00000001), ref: 000001CA7D1ED0A6
FlsSetValue.KERNEL32(?,?,?,000001CA7D1EC7DE,?,?,?,?,?,?,?,?,000001CA7D1ECF9D,?,?,00000001), ref: 000001CA7D1ED0CE
FlsSetValue.KERNEL32(?,?,?,000001CA7D1EC7DE,?,?,?,?,?,?,?,?,000001CA7D1ECF9D,?,?,00000001), ref: 000001CA7D1ED0DF
FlsSetValue.KERNEL32(?,?,?,000001CA7D1EC7DE,?,?,?,?,?,?,?,?,000001CA7D1ECF9D,?,?,00000001), ref: 000001CA7D1ED0F0

Strings

1%, xrefs: 000001CA7D1ED0CE
Y%, xrefs: 000001CA7D1ED0A6

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 30b70231d1e24de4b4ca025418508e32fa0bfd173ae1eb2ce45867a7fd4bf205
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: 87118172F8434C42FA6B57355951BE971527F443FDFDC8324A839466DAEE2AC4428383

Function 000001CA7D1E7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001CA7D1E7538
__scrt_acquire_startup_lock.LIBCMT ref: 000001CA7D1E758A
_RTC_Initialize.LIBCMT ref: 000001CA7D1E75B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001CA7D1E75DE
__scrt_release_startup_lock.LIBCMT ref: 000001CA7D1E7609

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 54b571efee64b7c6e9de23f96b134ccc0a5902488700766100ffe0eb4a6d37ff
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 3381B033F8030986FA57AB65A441FD97290BF8578EFD84415E98847396EB3AC806C7C3

Function 000001CA7D1E9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000001CA7D1E9E49
GetLastError.KERNEL32 ref: 000001CA7D1E9E57
LoadLibraryExW.KERNEL32 ref: 000001CA7D1E9E81
FreeLibrary.KERNEL32 ref: 000001CA7D1E9EC7
GetProcAddress.KERNEL32 ref: 000001CA7D1E9ED3

Strings

api-ms-, xrefs: 000001CA7D1E9E69

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 62314fa3814a8e06d3d4a6beeb72d442ce52af9b01e3a874d5eecb47daa7c9a7
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: AE31A433A9274891FE27DB42A400FD57394BF48BA9F990925DE1D0B791DF3AC6858383

Function 000001CA7D1F3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001CA7D1F3DE5
GetLastError.KERNEL32 ref: 000001CA7D1F3DF1
CloseHandle.KERNEL32 ref: 000001CA7D1F3E09
CreateFileW.KERNEL32 ref: 000001CA7D1F3E34
WriteConsoleW.KERNEL32 ref: 000001CA7D1F3E53

Strings

CONOUT$, xrefs: 000001CA7D1F3E15

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 2b86fcdd5caa45acab973e001419543304b1708e844680d1db9a10069147419d
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: B711B232B55B4882F7528B52E844B9972A0FB88FE8F940214EE1E87794DF39C81487C6

Function 000001CA7D1E2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001CA7D1E2F27
HeapAlloc.KERNEL32 ref: 000001CA7D1E2F3A
StrCmpNIW.SHLWAPI ref: 000001CA7D1E2FAF
GetProcessHeap.KERNEL32 ref: 000001CA7D1E3015
HeapFree.KERNEL32 ref: 000001CA7D1E3023

Strings

dialer, xrefs: 000001CA7D1E2FA8

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: b9274c7783efc7eaeec6a1c905d52b98db8aabe49b7f658e8e5547107feb53a0
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: DA31C233B41B59C2F616CF56E950BA9B7A0FF44B8AF884024DE4847B55EF36C4A18783

Function 000001CA7D1E14A4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001CA7D1E14C5
HeapFree.KERNEL32 ref: 000001CA7D1E14D4
GetProcessHeap.KERNEL32 ref: 000001CA7D1E14E1
HeapFree.KERNEL32 ref: 000001CA7D1E14F0
GetProcessHeap.KERNEL32 ref: 000001CA7D1E1500

Strings

C:\Windows\system32\winlogon.exe, xrefs: 000001CA7D1F61A9, 000001CA7D1F61B1

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Heap$Process$Free
String ID: C:\Windows\system32\winlogon.exe
API String ID: 3168794593-3603389050
Opcode ID: 5f1dcf0d6982f64b78ee420bc41fcee6693c0fdf65c097574d0a291fc3cf39dd
Instruction ID: 6c6c5161a78096c14bdf9e39c571406aa4d2933193245d43bd6798bd4724b74b
Opcode Fuzzy Hash: 5f1dcf0d6982f64b78ee420bc41fcee6693c0fdf65c097574d0a291fc3cf39dd
Instruction Fuzzy Hash: 5B3181F798EBC88AF353DB7598556C93BA0FBC5F48F898015DA4403247EA26C404C783

Function 000001CA7D1ECFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001CA7D1ECFAF
FlsSetValue.KERNEL32(?,?,?,000001CA7D1ED6B5,?,?,?,?,000001CA7D1ED778), ref: 000001CA7D1ECFE5
FlsSetValue.KERNEL32(?,?,?,000001CA7D1ED6B5,?,?,?,?,000001CA7D1ED778), ref: 000001CA7D1ED012
FlsSetValue.KERNEL32(?,?,?,000001CA7D1ED6B5,?,?,?,?,000001CA7D1ED778), ref: 000001CA7D1ED023
FlsSetValue.KERNEL32(?,?,?,000001CA7D1ED6B5,?,?,?,?,000001CA7D1ED778), ref: 000001CA7D1ED034
SetLastError.KERNEL32 ref: 000001CA7D1ED04F

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: d570b095018080d9c6ef97b415606a9f5be074c38465b2419cff6c6650b22fd4
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: B5118132F8534842FA2793715541BE971527F487BDFDC4314A836466D6EE2AC44287C3

Function 000001CA7D1E199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000001CA7D1E19C2
K32GetModuleFileNameExW.KERNEL32 ref: 000001CA7D1E19E0
PathFindFileNameW.SHLWAPI ref: 000001CA7D1E19EF
lstrlenW.KERNEL32 ref: 000001CA7D1E19FB
StrCpyW.SHLWAPI ref: 000001CA7D1E1A0E
CloseHandle.KERNEL32 ref: 000001CA7D1E1A1C

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: f4ad075c7aea17db1ceae1a45a947082fae6b03566feeae13d02396fd8ed993f
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 58015B72B45B8882FA21DB52A448B9973A1FB88BC9F884035DE4D43754DF3DC989C782

Function 000001CA7D1E36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001CA7D1E36E4
GetCurrentProcess.KERNEL32 ref: 000001CA7D1E36F2
VirtualProtectEx.KERNEL32 ref: 000001CA7D1E3714
GetCurrentProcess.KERNEL32 ref: 000001CA7D1E3732
VirtualProtectEx.KERNEL32 ref: 000001CA7D1E3753
TerminateThread.KERNEL32 ref: 000001CA7D1E3762

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 3562395a95a52aff63cf21579dac4e8f13eb3013ee12918dff203d36e439016a
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: ED012176B5274882FB269B51E808B9673A0FF49B8AF940425CD4907754EF3FC5448783

Function 000001CA7D1E8FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001CA7D1E9013
_IsNonwritableInCurrentImage.LIBCMT ref: 000001CA7D1E90A8
RtlUnwindEx.NTDLL ref: 000001CA7D1E90F7

Strings

f, xrefs: 000001CA7D1E9026
csm, xrefs: 000001CA7D1E908E

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: 1199add2447963c7e0a6626c74d3094f3923f35bc4b717506d990dde214144ec
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: 8F51C1B3B4170886FB16CF15E848F997795FB48BADF908124DA1687748EB36C841C783

Function 000001CA7D1E1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000001CA7D1E1A60
StrCmpNIW.SHLWAPI ref: 000001CA7D1E1A7A
lstrlenW.KERNEL32 ref: 000001CA7D1E1A89
StrCpyW.SHLWAPI ref: 000001CA7D1E1A9E

Strings

\\?\, xrefs: 000001CA7D1E1A6E

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: 6e3483dfa0cb264427eadf7c91b22e4bb5698e91d066fab0aaa11d89a92d8869
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 33F08C33B0478882FB318B21E884BA97760FB88B8DFC44020CA4946954DA2EC68DCB42

Function 000001CA7D1EBC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001CA7D1EBCBD
GetProcAddress.KERNEL32 ref: 000001CA7D1EBCD3
FreeLibrary.KERNEL32 ref: 000001CA7D1EBCFA

Strings

mscoree.dll, xrefs: 000001CA7D1EBCB4
CorExitProcess, xrefs: 000001CA7D1EBCCC

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: f2807ae1bd75188fa85f376b0ba0b714188b609a780e91e34ac1448a234a152c
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 4AF06273A5270981FB118B24E444B997360FF857A9FD40319DA6A462E4DF3EC085C383

Function 000001CA7D1E3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000001CA7D1E3066
StrCpyW.SHLWAPI ref: 000001CA7D1E3076
StrCatW.SHLWAPI ref: 000001CA7D1E3082
PathCombineW.SHLWAPI ref: 000001CA7D1E3090

Strings

\\.\pipe\, xrefs: 000001CA7D1E305C

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 44993aca4da2e8601cf1e922fcfe321c3e9efcdd99f502c1acbbfe0ecfd2f6a1
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 29F08C32B45B8882FA018B53B9045A9B261BF48FC9F888030EE4A07B18DF3DC4458783

Function 000001CA7D1E5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001CA7D1E5726

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 0c7f3a11ae4e5ff47235e902b7b6ce7055ed727b420134bb2449cab27e882fd8
Instruction ID: 48ae10da8c4df23e958ab8f03296e4a0b33087e67722e76d3cd1bc5552b5d880
Opcode Fuzzy Hash: 0c7f3a11ae4e5ff47235e902b7b6ce7055ed727b420134bb2449cab27e882fd8
Instruction Fuzzy Hash: DE610F37A58B48C6F761CB15E450B9A77A0F788789F900115FA8E87BA8DB7DC450CF82

Function 000001CA7D1C3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001CA7D1C352C
_set_statfp.LIBCMT ref: 000001CA7D1C3547
_set_statfp.LIBCMT ref: 000001CA7D1C3563
_set_statfp.LIBCMT ref: 000001CA7D1C359F

Memory Dump Source

Source File: 00000025.00000002.2629244690.000001CA7D1B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1b0000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 26aa6f05d8d0c36441faf356c1eb802a2fed81e89bde6f8e5d8bf6df5ef2ad79
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 5011A733ED0B1911FA971728E442BE931807F5937CFC94629A96E063D6CA26D8C143C7

Function 000001CA7D1F4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001CA7D1F412C
_set_statfp.LIBCMT ref: 000001CA7D1F4147
_set_statfp.LIBCMT ref: 000001CA7D1F4163
_set_statfp.LIBCMT ref: 000001CA7D1F419F

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 3e3acebee684e582d8ce2dd1fd84b87fa86eaa0c0ec6cc8cb9dde2eb6e72f61d
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 9C11C1B3EDAB4C11F7669568D451FE531407FA83BCFC80A34A976066D68B26D84443C3

Function 000001CA7D1BF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001CA7D1BF124

Strings

Tuesday, xrefs: 000001CA7D1BF0F4
or copy constructor iterator', xrefs: 000001CA7D1BF25A, 000001CA7D1BF275
Wednesday, xrefs: 000001CA7D1BF1ED

Memory Dump Source

Source File: 00000025.00000002.2629244690.000001CA7D1B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1b0000_winlogon.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 72014b747d6863982a49a37313f067a39efb66854103c51deb26e26df590dc88
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 6F61D277E8030842FA679B69E544BEA3AA1FF8174CFC45815DA4E137A4DB37C8418383

Function 000001CA7D1EAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000001CA7D1EAA68
_CallSETranslator.LIBVCRUNTIME ref: 000001CA7D1EAAB7

Strings

RCC, xrefs: 000001CA7D1EAA85
MOC, xrefs: 000001CA7D1EAA7C

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 0322d4e37939c6260d1bb9a950ba8c41908360be786aaab989c939b8c27ee8a3
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 48617933A04B888AFB11DF65D540BDD77A0FB88B8DF444215EE4913B98DB39D084C782

Function 000001CA7D1BA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001CA7D1BA1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001CA7D1BA288

Strings

csm, xrefs: 000001CA7D1BA1C2
csm, xrefs: 000001CA7D1BA2DA

Memory Dump Source

Source File: 00000025.00000002.2629244690.000001CA7D1B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1b0000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 537ae5a17c7cede48fef7a0b6b27ac6f71ba065a8642b9b159c5fc0dfa40a52f
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: F151C133980388CAFB768B159654B9C77A0FB54B8CF984116DA8D87BD5CB7AC450C783

Function 000001CA7D1EAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001CA7D1EADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001CA7D1EAE88

Strings

csm, xrefs: 000001CA7D1EAEDA
csm, xrefs: 000001CA7D1EADC2

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: ff6082552ba727c106ead55259fbc36506d939957c957cd3fda493e793e6ae59
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: C951D4739803888AFB758F159684BDCB7A0FB54B8EF984115EA8947BD5CB39C490C783

Function 000001CA7D1B8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001CA7D1B8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001CA7D1B84A8

Strings

csm, xrefs: 000001CA7D1B848E
f, xrefs: 000001CA7D1B8426

Memory Dump Source

Source File: 00000025.00000002.2629244690.000001CA7D1B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1b0000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 927c2fdad09794bd25794c7f784e0a77e787d82862998c5ac5c16faddc19a449
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 61519D33A517088AFB16DF15E444F993795FB54F9CF948128DA0E43B88EB36D8818B87

Function 000001CA7D1B83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001CA7D1B8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001CA7D1B84A8

Strings

csm, xrefs: 000001CA7D1B848E
f, xrefs: 000001CA7D1B8426

Memory Dump Source

Source File: 00000025.00000002.2629244690.000001CA7D1B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1b0000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 56ec0d371ec3460b2750359f6045c0d1bf5edbfbed1400ec1511aa951714bf4b
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: F7318A33A4174886FB169F11E844B9977A4FB44F8CF858018AE5E43B85DB3AC981C787

Function 000001CA7D1F2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000001CA7D1F20D7
WriteFile.KERNEL32 ref: 000001CA7D1F239F
WriteFile.KERNEL32 ref: 000001CA7D1F23E5
GetLastError.KERNEL32 ref: 000001CA7D1F249B

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 00fa72cab6ff883e5f3b1fb8a90b0589520b73edd2e7a3f6f8eb0508b6586a7e
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 39D1EE73B06B8889F712CFA9D440ADC3BB1FB4579CF804256CE5997B9ADA35C406C782

Function 000001CA7D1F2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000001CA7D1F2A9C
GetLastError.KERNEL32 ref: 000001CA7D1F2B27

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 52aec2bfa1a84c38979ad7b660f25c0f60e35b55fb02f8f4d3627a78bea016f4
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: BD91E033F4675889F762DF659440BED3BA0BB44B8CF944149DE0A97A84DB36C882C783

Function 000001CA7D1E253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001CA7D1E2620
StrCpyW.SHLWAPI ref: 000001CA7D1E2639

Strings

\\.\pipe\, xrefs: 000001CA7D1E262B

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: a7a464d998a13818dff7043b415c480fc730c321ae9d0af3c7f8a224529f5646
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 2471E437E4079985F726DF259850BEA7790FB9AB8AFC4011ADD0943B88DE36C541C383

Function 000001CA7D1B9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000001CA7D1B9EB7

Strings

RCC, xrefs: 000001CA7D1B9E85
MOC, xrefs: 000001CA7D1B9E7C

Memory Dump Source

Source File: 00000025.00000002.2629244690.000001CA7D1B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1b0000_winlogon.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 663d0cdf61b7a31929ef5e369fcb4ece6e9975571219eafa033982f5a2a6eda5
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 26615733A40B888AFB229F65D4807DD7BA0FB44B8CF444215EE8D17B98DB79D195C782

Function 000001CA7D1E2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001CA7D1E2416
StrCpyW.SHLWAPI ref: 000001CA7D1E242D

Strings

\\.\pipe\, xrefs: 000001CA7D1E2421

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 2baa006f8433f4dd066ae2f31979bb918442f7645726458859c6ae6fb974e8a8
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: D1510533A8478981F6368A29A168BFA7791FB86749FD50259DD4903B4ACA3BC50487C3

Function 000001CA7D1F26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001CA7D1F2807
GetLastError.KERNEL32 ref: 000001CA7D1F2829

Strings

U, xrefs: 000001CA7D1F27B3

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 03fc06659c014acbab491e78cbeca63ad311804e2869c2ba40f389efd7815286
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 7941A373B15B8482EB21CF25E4447EA77A0FB98798F904121EE8D87794EB3DC441C782

Function 000001CA7D1E94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000001CA7D1E94F0
RaiseException.KERNEL32 ref: 000001CA7D1E9531

Strings

csm, xrefs: 000001CA7D1E951E

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: e7ac8a37f4b25896d4bb65df61c78c916ff4b37cad3f2f8f153ed6f492886e7e
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: A8116D33605B8482EB228F15F40079977E0FB88B98F984221EE8C07759DF3DC551CB41

Function 000001CA7D1B7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001CA7D1B737C

Strings

riptor at (, xrefs: 000001CA7D1B7364
ierarchy Descriptor', xrefs: 000001CA7D1B7381

Memory Dump Source

Source File: 00000025.00000002.2629244690.000001CA7D1B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1b0000_winlogon.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 8b3f4309db0a49c8fd5b1ddc3c9158209024aaf48e899a8248ff8660e8bc8f7a
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 77E08673A80B4890FF028F21E8506E833A4EF58B6CBC89122995C06351FA38D1E9C342

Function 000001CA7D1B73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001CA7D1B73D8

Strings

riptor at (, xrefs: 000001CA7D1B73C0
Locator', xrefs: 000001CA7D1B73DD

Memory Dump Source

Source File: 00000025.00000002.2629244690.000001CA7D1B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1b0000_winlogon.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: f408beb214d026d7562755bb5fd0a0bf77fc4fd21f5bae039add18967cadc347
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 8DE08673A40B48C0FF028F21D8505E87364FB58B58FC89122C94C06351EA38D1E5C342

Function 000001CA7D1E1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001CA7D1E1C2D
HeapAlloc.KERNEL32 ref: 000001CA7D1E1C3B
GetProcessHeap.KERNEL32 ref: 000001CA7D1E1C77
HeapFree.KERNEL32 ref: 000001CA7D1E1C85

Part of subcall function 000001CA7D1E152C: StrCmpIW.SHLWAPI ref: 000001CA7D1E155D

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: eea621f113062a6406cf7ec60adaefb11558c4a8b8e83d2aebfa4c2cb5a21360
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: C311C476A01B4881FB05CB66E404AA973A1FFC9FC9F894024DE4D83765DF3AC482D382

Function 000001CA7D1E1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001CA7D1E126E
HeapAlloc.KERNEL32 ref: 000001CA7D1E127D
GetProcessHeap.KERNEL32 ref: 000001CA7D1E1297
HeapAlloc.KERNEL32 ref: 000001CA7D1E12A8

Memory Dump Source

Source File: 00000025.00000002.2629747459.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: da8c3dafd84f4e9d3148870d217228cf2e181fae1a96b4a2815fc4d2442c645c
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 8FE039B6A4270886FB058B62D80878A36E1FB89B0AF848024C90907351DF7EC899C792

Analysis Process: eejhedztifcv.exePID: 7984, Parent PID: 624COMMON

Executed Functions

Function 00007FF669701140 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.1353923956.00007FF669701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF669700000, based on PE: true

Associated: 0000002A.00000002.1353837614.00007FF669700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000002A.00000002.1353985242.00007FF66970C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000002A.00000002.1354024143.00007FF66970F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000002A.00000002.1354049350.00007FF669710000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000002A.00000002.1354577333.00007FF669C39000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000002A.00000002.1354607066.00007FF669C3C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ff669700000_eejhedztifcv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 808f824871d7e1a8eee0a1093264b3d0fd75ff3502bae8c0f48d855cf6986489
Instruction ID: 4c26abe4b774d9d2dc42bcaed63a1a4f3ad7303a5335fcc7294ccda7a75d3151
Opcode Fuzzy Hash: 808f824871d7e1a8eee0a1093264b3d0fd75ff3502bae8c0f48d855cf6986489
Instruction Fuzzy Hash: 08B012B0D04309C4E7042F01DC413683A706B0C7C5F400030DC0C4B352CE7F50508BA0

Analysis Process: lsass.exePID: 632, Parent PID: 7692COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	96
Total number of Limit Nodes:	3

Executed Functions

Function 0000017D2DD5202C Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 0000017D2DD520C6

Part of subcall function 0000017D2DD52F04: GetProcessHeap.KERNEL32 ref: 0000017D2DD52F27
Part of subcall function 0000017D2DD52F04: HeapAlloc.KERNEL32 ref: 0000017D2DD52F3A
Part of subcall function 0000017D2DD52F04: StrCmpNIW.SHLWAPI ref: 0000017D2DD52FAF
Part of subcall function 0000017D2DD52F04: GetProcessHeap.KERNEL32 ref: 0000017D2DD53015
Part of subcall function 0000017D2DD52F04: HeapFree.KERNEL32 ref: 0000017D2DD53023

Strings

S, xrefs: 0000017D2DD521E7
dialer, xrefs: 0000017D2DD520BF

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: S$dialer
API String ID: 756756679-3873981283
Opcode ID: 10a6181ad89868b013f95f8d430f86fb0b73c76b57149a1256a42c526e771eaa
Instruction ID: 155143b81f3208abd6031ca8c042dd218b69dc177d281ba8a3fc227f7ed7204d
Opcode Fuzzy Hash: 10a6181ad89868b013f95f8d430f86fb0b73c76b57149a1256a42c526e771eaa
Instruction Fuzzy Hash: 2D519036A19F2886EB65CB26F840BEE6BB5FB04784F49D111DE0D12A46DBB5C8D6C340

Function 0000017D2DD5328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 0000017D2DD532AE
PathFindFileNameW.SHLWAPI ref: 0000017D2DD532BD

Part of subcall function 0000017D2DD53844: StrCmpNIW.SHLWAPI ref: 0000017D2DD5385C

Part of subcall function 0000017D2DD53790: GetModuleHandleW.KERNEL32 ref: 0000017D2DD5379E
Part of subcall function 0000017D2DD53790: GetCurrentProcess.KERNEL32 ref: 0000017D2DD537CC
Part of subcall function 0000017D2DD53790: VirtualProtectEx.KERNEL32 ref: 0000017D2DD537EE
Part of subcall function 0000017D2DD53790: GetCurrentProcess.KERNEL32 ref: 0000017D2DD53809
Part of subcall function 0000017D2DD53790: VirtualProtectEx.KERNEL32 ref: 0000017D2DD5382A

CreateThread.KERNEL32 ref: 0000017D2DD5330B

Part of subcall function 0000017D2DD51D14: GetCurrentThread.KERNEL32 ref: 0000017D2DD51D1F

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 214331da1523383085459dc1cf3a72151d1bd42f80546dae1799ce22ecc2b291
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: BE118431A1CF8D83F7609B21F8053D926B4AF55344F5C4125E98E415B3EFB8C0C78290

Function 0000017D2DD51ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000017D2DD51628: GetProcessHeap.KERNEL32 ref: 0000017D2DD51633
Part of subcall function 0000017D2DD51628: HeapAlloc.KERNEL32 ref: 0000017D2DD51642
Part of subcall function 0000017D2DD51628: RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD516B2
Part of subcall function 0000017D2DD51628: RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD516DF
Part of subcall function 0000017D2DD51628: RegCloseKey.ADVAPI32 ref: 0000017D2DD516F9
Part of subcall function 0000017D2DD51628: RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD51719
Part of subcall function 0000017D2DD51628: RegCloseKey.ADVAPI32 ref: 0000017D2DD51734
Part of subcall function 0000017D2DD51628: RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD51754
Part of subcall function 0000017D2DD51628: RegCloseKey.ADVAPI32 ref: 0000017D2DD5176F
Part of subcall function 0000017D2DD51628: RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD5178F
Part of subcall function 0000017D2DD51628: RegCloseKey.ADVAPI32 ref: 0000017D2DD517AA
Part of subcall function 0000017D2DD51628: RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD517CA

Sleep.KERNEL32 ref: 0000017D2DD51AD7
SleepEx.KERNELBASE ref: 0000017D2DD51ADD

Part of subcall function 0000017D2DD51628: RegCloseKey.ADVAPI32 ref: 0000017D2DD517E5
Part of subcall function 0000017D2DD51628: RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD51805
Part of subcall function 0000017D2DD51628: RegCloseKey.ADVAPI32 ref: 0000017D2DD51820
Part of subcall function 0000017D2DD51628: RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD51840
Part of subcall function 0000017D2DD51628: RegCloseKey.ADVAPI32 ref: 0000017D2DD5185B
Part of subcall function 0000017D2DD51628: RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD5187B
Part of subcall function 0000017D2DD51628: RegCloseKey.ADVAPI32 ref: 0000017D2DD51896
Part of subcall function 0000017D2DD51628: RegCloseKey.ADVAPI32 ref: 0000017D2DD518A0

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: cfab3b19dcfdcf9e87aa71fa765fb915cf326640258249606d793b06c54be810
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 9A31A671208F4992FF509B26FA513E933B5AF89BD0F0C54219E0E87697EEA4D8D3C211

Function 0000017D2DD2273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 0000017D2DD2285E

Memory Dump Source

Source File: 0000002B.00000002.2643916103.0000017D2DD20000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd20000_lsass.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: fcf441e1754b082eeb0dc43f4d16f1b5c1afe7c2daf29257db32d68def31b461
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 0961CF72B09B9887DB548F15A4047ADBBB2FB54B94F58C121EE5D0778BDA38D893C700

Non-executed Functions

Function 0000017D2DD52B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 0000017D2DD52BD0
lstrlenW.KERNEL32 ref: 0000017D2DD52E0A

Part of subcall function 0000017D2DD5199C: OpenProcess.KERNEL32 ref: 0000017D2DD519C2
Part of subcall function 0000017D2DD5199C: K32GetModuleFileNameExW.KERNEL32 ref: 0000017D2DD519E0
Part of subcall function 0000017D2DD5199C: PathFindFileNameW.SHLWAPI ref: 0000017D2DD519EF
Part of subcall function 0000017D2DD5199C: lstrlenW.KERNEL32 ref: 0000017D2DD519FB
Part of subcall function 0000017D2DD5199C: StrCpyW.SHLWAPI ref: 0000017D2DD51A0E
Part of subcall function 0000017D2DD5199C: CloseHandle.KERNEL32 ref: 0000017D2DD51A1C

GetProcAddress.KERNEL32 ref: 0000017D2DD52BE5

Part of subcall function 0000017D2DD5152C: StrCmpIW.SHLWAPI ref: 0000017D2DD5155D

Part of subcall function 0000017D2DD53844: StrCmpNIW.SHLWAPI ref: 0000017D2DD5385C

StrCmpNIW.SHLWAPI ref: 0000017D2DD52C28
lstrlenW.KERNEL32 ref: 0000017D2DD52D50

Strings

NtQueryObject, xrefs: 0000017D2DD52BDB
ntdll.dll, xrefs: 0000017D2DD52BC9
\Device\Nsi, xrefs: 0000017D2DD52C1B

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 201516ddcaf24fdd76f134af1e762875554fce00627c25cbf5f5624f50459020
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 7DB1AF32219F9882EB598F65E8407E96BB4FF44B94F089016DE0D53796DBB4CCD6C380

Function 0000017D2DD57D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 0000017D2DD57DAC
RtlCaptureContext.NTDLL ref: 0000017D2DD57DD9
RtlLookupFunctionEntry.NTDLL ref: 0000017D2DD57DF3
RtlVirtualUnwind.NTDLL ref: 0000017D2DD57E34
IsDebuggerPresent.KERNEL32 ref: 0000017D2DD57E88
SetUnhandledExceptionFilter.KERNEL32 ref: 0000017D2DD57EA9
UnhandledExceptionFilter.KERNEL32 ref: 0000017D2DD57EB4

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: d09eceb89f3b3aeb48a36599c91742e07293e75ce02d211f460f49612921f3db
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: D6314C76209F849AEB609F60F8407ED7374FB84744F48402ADA4E47A95EF78C589C750

Function 0000017D2DD5D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 0000017D2DD5D31D
RtlLookupFunctionEntry.NTDLL ref: 0000017D2DD5D335
RtlVirtualUnwind.NTDLL ref: 0000017D2DD5D370
IsDebuggerPresent.KERNEL32 ref: 0000017D2DD5D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 0000017D2DD5D3B3
UnhandledExceptionFilter.KERNEL32 ref: 0000017D2DD5D3BE

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: c02fd4a5eef356ca583dd9c02c32a451806272cee0a4144696469ec3958c9c8e
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 69315E36218F8496EB608F25F8407EE73B0FB89754F580126EA9D43B5ADF78C186CB40

Function 0000017D2DD51628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000017D2DD51633
HeapAlloc.KERNEL32 ref: 0000017D2DD51642

Part of subcall function 0000017D2DD51268: GetProcessHeap.KERNEL32 ref: 0000017D2DD5126E
Part of subcall function 0000017D2DD51268: HeapAlloc.KERNEL32 ref: 0000017D2DD5127D
Part of subcall function 0000017D2DD51268: GetProcessHeap.KERNEL32 ref: 0000017D2DD51297
Part of subcall function 0000017D2DD51268: HeapAlloc.KERNEL32 ref: 0000017D2DD512A8

RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD516B2
RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD516DF
RegCloseKey.ADVAPI32 ref: 0000017D2DD516F9
RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD51719
RegCloseKey.ADVAPI32 ref: 0000017D2DD51734
RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD51754
RegCloseKey.ADVAPI32 ref: 0000017D2DD5176F
RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD5178F
RegCloseKey.ADVAPI32 ref: 0000017D2DD517AA
RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD517CA
RegCloseKey.ADVAPI32 ref: 0000017D2DD517E5
RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD51805
RegCloseKey.ADVAPI32 ref: 0000017D2DD51820
RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD51840
RegCloseKey.ADVAPI32 ref: 0000017D2DD5185B
RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD5187B
RegCloseKey.ADVAPI32 ref: 0000017D2DD51896
RegCloseKey.ADVAPI32 ref: 0000017D2DD518A0

Part of subcall function 0000017D2DD512BC: RegQueryInfoKeyW.ADVAPI32 ref: 0000017D2DD51319
Part of subcall function 0000017D2DD512BC: GetProcessHeap.KERNEL32 ref: 0000017D2DD51327
Part of subcall function 0000017D2DD512BC: HeapAlloc.KERNEL32 ref: 0000017D2DD51338
Part of subcall function 0000017D2DD512BC: RegEnumValueW.ADVAPI32 ref: 0000017D2DD51397
Part of subcall function 0000017D2DD512BC: GetProcessHeap.KERNEL32 ref: 0000017D2DD513DF
Part of subcall function 0000017D2DD512BC: HeapAlloc.KERNEL32 ref: 0000017D2DD513ED
Part of subcall function 0000017D2DD512BC: GetProcessHeap.KERNEL32 ref: 0000017D2DD5140A
Part of subcall function 0000017D2DD512BC: HeapFree.KERNEL32 ref: 0000017D2DD51418
Part of subcall function 0000017D2DD512BC: lstrlenW.KERNEL32 ref: 0000017D2DD51421
Part of subcall function 0000017D2DD512BC: GetProcessHeap.KERNEL32 ref: 0000017D2DD5142F
Part of subcall function 0000017D2DD512BC: HeapAlloc.KERNEL32 ref: 0000017D2DD5143D

Strings

service_names, xrefs: 0000017D2DD517C3
process_names, xrefs: 0000017D2DD5174D
tcp_remote, xrefs: 0000017D2DD51839
paths, xrefs: 0000017D2DD51788
SOFTWARE\dialerconfig, xrefs: 0000017D2DD51692
startup, xrefs: 0000017D2DD516D5
udp, xrefs: 0000017D2DD51874
pid, xrefs: 0000017D2DD51712
tcp_local, xrefs: 0000017D2DD517FE

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: f373a902904968e4baa70c809983a53cdb0f74efc4af513bb47583a410abd3e2
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: CB71FB3A218F5986EB209F66F8506D93374FF95B88F481121DE4E47B6ADF78C486C780

Function 0000017D2DD512BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000017D2DD51319
GetProcessHeap.KERNEL32 ref: 0000017D2DD51327
HeapAlloc.KERNEL32 ref: 0000017D2DD51338
RegEnumValueW.ADVAPI32 ref: 0000017D2DD51397

Part of subcall function 0000017D2DD5152C: StrCmpIW.SHLWAPI ref: 0000017D2DD5155D

GetProcessHeap.KERNEL32 ref: 0000017D2DD513DF
HeapAlloc.KERNEL32 ref: 0000017D2DD513ED
GetProcessHeap.KERNEL32 ref: 0000017D2DD5140A
HeapFree.KERNEL32 ref: 0000017D2DD51418
lstrlenW.KERNEL32 ref: 0000017D2DD51421
GetProcessHeap.KERNEL32 ref: 0000017D2DD5142F
HeapAlloc.KERNEL32 ref: 0000017D2DD5143D
StrCpyW.SHLWAPI ref: 0000017D2DD5145F
GetProcessHeap.KERNEL32 ref: 0000017D2DD51476
HeapFree.KERNEL32 ref: 0000017D2DD51484

Strings

d, xrefs: 0000017D2DD5135A

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: ca431eb5b86f1c7f31f016aeb69dd73664c1ec0d3564cef57299be2ebb00ac88
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 99513B36208F8886EB54CF62F54839AB7B5FB89B99F084124DA494775ADF7CC086C780

Function 0000017D2DD51D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 0000017D2DD51D1F

Part of subcall function 0000017D2DD51FD4: GetModuleHandleA.KERNEL32 ref: 0000017D2DD51FEC
Part of subcall function 0000017D2DD51FD4: GetProcAddress.KERNEL32 ref: 0000017D2DD51FFD

Part of subcall function 0000017D2DD55B30: GetCurrentThreadId.KERNEL32 ref: 0000017D2DD55B6B

Strings

NtQueryDirectoryFileEx, xrefs: 0000017D2DD51D9C
sechost.dll, xrefs: 0000017D2DD51E39
NtQuerySystemInformation, xrefs: 0000017D2DD51D45
NtDeviceIoControlFile, xrefs: 0000017D2DD51E56
NtResumeThread, xrefs: 0000017D2DD51D62
EnumServicesStatusExW, xrefs: 0000017D2DD51E11, 0000017D2DD51E32
NtEnumerateKey, xrefs: 0000017D2DD51DB9
ntdll.dll, xrefs: 0000017D2DD51D2D
EnumServiceGroupW, xrefs: 0000017D2DD51DF0
NtQueryDirectoryFile, xrefs: 0000017D2DD51D7F
advapi32.dll, xrefs: 0000017D2DD51DF7, 0000017D2DD51E18
NtEnumerateValueKey, xrefs: 0000017D2DD51DD6

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 888e83b1464c83c4bc2c18822326379b4c1162a761cc58044e87b3a2047edb67
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 34316C79208F8EA0FA05EF6AFC517E42730AF54354F889053941D1656BAEB896CFC390

Function 0000017D2DD26910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000017D2DD26938
__scrt_acquire_startup_lock.LIBCMT ref: 0000017D2DD2698A
_RTC_Initialize.LIBCMT ref: 0000017D2DD269B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000017D2DD269DE
__scrt_release_startup_lock.LIBCMT ref: 0000017D2DD26A09

Strings

`eh vector vbase copy constructor iterator', xrefs: 0000017D2DD269EE
`eh vector copy constructor iterator', xrefs: 0000017D2DD26A3B
`dynamic initializer for ', xrefs: 0000017D2DD269C7
scriptor', xrefs: 0000017D2DD26B39, 0000017D2DD26BB2, 0000017D2DD26BEC

Memory Dump Source

Source File: 0000002B.00000002.2643916103.0000017D2DD20000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd20000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 10541f2b35d742c4c84b7a2207444849f7b2fb7bb2936c4aa477646f18f77050
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 7C81917960CF8D86FAA4AB65B8493D966B0EF85780F5C80259A0D4779FDB39CCC78700

Function 0000017D2DD5CE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 0000017D2DD5CE37
FlsGetValue.KERNEL32(?,?,?,0000017D2DD60A6B,?,?,?,0000017D2DD6045C,?,?,?,0000017D2DD5C84F), ref: 0000017D2DD5CE4C
FlsSetValue.KERNEL32(?,?,?,0000017D2DD60A6B,?,?,?,0000017D2DD6045C,?,?,?,0000017D2DD5C84F), ref: 0000017D2DD5CE6D
FlsSetValue.KERNEL32(?,?,?,0000017D2DD60A6B,?,?,?,0000017D2DD6045C,?,?,?,0000017D2DD5C84F), ref: 0000017D2DD5CE9A
FlsSetValue.KERNEL32(?,?,?,0000017D2DD60A6B,?,?,?,0000017D2DD6045C,?,?,?,0000017D2DD5C84F), ref: 0000017D2DD5CEAB
FlsSetValue.KERNEL32(?,?,?,0000017D2DD60A6B,?,?,?,0000017D2DD6045C,?,?,?,0000017D2DD5C84F), ref: 0000017D2DD5CEBC
SetLastError.KERNEL32 ref: 0000017D2DD5CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,0000017D2DD60A6B,?,?,?,0000017D2DD6045C,?,?,?,0000017D2DD5C84F), ref: 0000017D2DD5CF0D
FlsSetValue.KERNEL32(?,?,00000001,0000017D2DD5ECCC,?,?,?,?,0000017D2DD5BF9F,?,?,?,?,?,0000017D2DD57AB0), ref: 0000017D2DD5CF2C

Part of subcall function 0000017D2DD5D6CC: HeapAlloc.KERNEL32 ref: 0000017D2DD5D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000017D2DD60A6B,?,?,?,0000017D2DD6045C,?,?,?,0000017D2DD5C84F), ref: 0000017D2DD5CF54

Part of subcall function 0000017D2DD5D744: HeapFree.KERNEL32 ref: 0000017D2DD5D75A
Part of subcall function 0000017D2DD5D744: GetLastError.KERNEL32 ref: 0000017D2DD5D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000017D2DD60A6B,?,?,?,0000017D2DD6045C,?,?,?,0000017D2DD5C84F), ref: 0000017D2DD5CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000017D2DD60A6B,?,?,?,0000017D2DD6045C,?,?,?,0000017D2DD5C84F), ref: 0000017D2DD5CF76

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: d68e572aac73047c3c51cb78b25c2777a471a73fa15f95309a12a5a131a6f134
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 30414F3424DF4C41FA68A77975563E923B29F457B0F1C1B24A93E4A6E7EEA894D38300

Function 0000017D2DD52244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 0000017D2DD52259
GetCurrentProcessId.KERNEL32 ref: 0000017D2DD52263

Part of subcall function 0000017D2DD51934: OpenProcess.KERNEL32 ref: 0000017D2DD51952
Part of subcall function 0000017D2DD51934: IsWow64Process.KERNEL32 ref: 0000017D2DD51968
Part of subcall function 0000017D2DD51934: CloseHandle.KERNEL32 ref: 0000017D2DD51983

CreateFileW.KERNEL32 ref: 0000017D2DD522BC
WriteFile.KERNEL32 ref: 0000017D2DD522E4
ReadFile.KERNEL32 ref: 0000017D2DD52303
CloseHandle.KERNEL32 ref: 0000017D2DD5230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 0000017D2DD52293
\\.\pipe\dialerchildproc64, xrefs: 0000017D2DD5228C

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: e1779b7dc264c41871ab8402e7fa592fe41db8376b26c2f7e3fe8b356875aab4
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: D4215336618B8883F710CB25F44439977B0FB897A4F584215EA5D03BA9CF7CC18ACB80

Function 0000017D2DD5A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000017D2DD5A5A1

Part of subcall function 0000017D2DD5B414: __GetUnwindTryBlock.LIBCMT ref: 0000017D2DD5B457
Part of subcall function 0000017D2DD5B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0000017D2DD5B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000017D2DD5A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0000017D2DD5A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 0000017D2DD5A9DA

Strings

csm, xrefs: 0000017D2DD5A69C
csm, xrefs: 0000017D2DD5A5BB
csm, xrefs: 0000017D2DD5A622

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: bdeaed834d91e066082b2cd880e464d4d74c043ab12675f5ad6e09e9ad3862f2
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 8DE17C72608F588AEB209F65E4803DD7BB0FB45798F582116EE8D57B9ACB74D0C6CB00

Function 0000017D2DD29944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000017D2DD299A1

Part of subcall function 0000017D2DD2A814: __GetUnwindTryBlock.LIBCMT ref: 0000017D2DD2A857
Part of subcall function 0000017D2DD2A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0000017D2DD2A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000017D2DD29A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0000017D2DD29CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 0000017D2DD29DDA

Strings

csm, xrefs: 0000017D2DD29A9C
csm, xrefs: 0000017D2DD299BB
csm, xrefs: 0000017D2DD29A22

Memory Dump Source

Source File: 0000002B.00000002.2643916103.0000017D2DD20000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd20000_lsass.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: cd1909da564486c33fd5c65385533ee64d4be228643e36edc2a68ea4a3a6425f
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: F6E18C72648B888AEB609B65E4883DD77B0FB85798F184115EE8D57B9FCB34C5D2C700

Function 0000017D2DD5F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 0000017D2DD5F510
GetProcAddress.KERNEL32 ref: 0000017D2DD5F51C

Strings

api-ms-, xrefs: 0000017D2DD5F45A
ext-ms-, xrefs: 0000017D2DD5F46D

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: cff03d2ade0e020ec692bca3fec052358bdd6c7ad0630a59d247d7c5ded0803b
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: FA418232319F4851FB15CB66B8047D623B5FF45BA0F5D46259D0E8B78AEA78C4878390

Function 0000017D2DD5104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000017D2DD510B1
RegEnumValueW.ADVAPI32 ref: 0000017D2DD51117
GetProcessHeap.KERNEL32 ref: 0000017D2DD5115A
HeapAlloc.KERNEL32 ref: 0000017D2DD51168
GetProcessHeap.KERNEL32 ref: 0000017D2DD51185
HeapFree.KERNEL32 ref: 0000017D2DD51193

Strings

d, xrefs: 0000017D2DD510D6

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 7ceb33411e866d5e6bad0885634960f762de516c8c48caabf9af1da6179ea09c
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 35415F36218F84C6E760CF61F44479A77B1F789B98F088129DA8947759DF7CC48ACB80

Function 0000017D2DD5D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,0000017D2DD5C7DE,?,?,?,?,?,?,?,?,0000017D2DD5CF9D,?,?,00000001), ref: 0000017D2DD5D087
FlsSetValue.KERNEL32(?,?,?,0000017D2DD5C7DE,?,?,?,?,?,?,?,?,0000017D2DD5CF9D,?,?,00000001), ref: 0000017D2DD5D0A6
FlsSetValue.KERNEL32(?,?,?,0000017D2DD5C7DE,?,?,?,?,?,?,?,?,0000017D2DD5CF9D,?,?,00000001), ref: 0000017D2DD5D0CE
FlsSetValue.KERNEL32(?,?,?,0000017D2DD5C7DE,?,?,?,?,?,?,?,?,0000017D2DD5CF9D,?,?,00000001), ref: 0000017D2DD5D0DF
FlsSetValue.KERNEL32(?,?,?,0000017D2DD5C7DE,?,?,?,?,?,?,?,?,0000017D2DD5CF9D,?,?,00000001), ref: 0000017D2DD5D0F0

Strings

Y%, xrefs: 0000017D2DD5D0A6
1%, xrefs: 0000017D2DD5D0CE

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 5154c93d068d10a1e945b58184a0e0201f16f14cb9cb9ab8264952e70cf091d5
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: AB114C3064CB4C41FA68A739B9523E96275AF447F0F1C5324E82E4A6EBDEA8C4C38210

Function 0000017D2DD57510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000017D2DD57538
__scrt_acquire_startup_lock.LIBCMT ref: 0000017D2DD5758A
_RTC_Initialize.LIBCMT ref: 0000017D2DD575B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000017D2DD575DE
__scrt_release_startup_lock.LIBCMT ref: 0000017D2DD57609

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: e2c28e9c43fdaf6d7950bc8e7dcfae3bff719fb9d48d50af83f38ace045fed18
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: B681AF3060CF4EA6FAB0AB66B4413D926B0AF45B80F2C4455E90D47797EBB8C8C78740

Function 0000017D2DD59DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 0000017D2DD59E49
GetLastError.KERNEL32 ref: 0000017D2DD59E57
LoadLibraryExW.KERNEL32 ref: 0000017D2DD59E81
FreeLibrary.KERNEL32 ref: 0000017D2DD59EC7
GetProcAddress.KERNEL32 ref: 0000017D2DD59ED3

Strings

api-ms-, xrefs: 0000017D2DD59E69

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 82f7838ad94713cf2084c215003bcf0328065fd8f0f8ad9d488098c119fc8392
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 6D31C23121BF48A1EE119B86B8007E522B4BF48BA0F5D06259D2D4B796EF78C6D78340

Function 0000017D2DD63DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 0000017D2DD63DE5
GetLastError.KERNEL32 ref: 0000017D2DD63DF1
CloseHandle.KERNEL32 ref: 0000017D2DD63E09
CreateFileW.KERNEL32 ref: 0000017D2DD63E34
WriteConsoleW.KERNEL32 ref: 0000017D2DD63E53

Strings

CONOUT$, xrefs: 0000017D2DD63E15

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: ea3a63099e4bd6fc9fc88f750c7bc55e678addbdfab8018aa84a990dcdc11d56
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 7F115E31218F8486E7508B56F84435976B0FB88FE4F084224EA6E87796CB3CC49687C4

Function 0000017D2DD53790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000017D2DD5379E
GetCurrentProcess.KERNEL32 ref: 0000017D2DD537CC
VirtualProtectEx.KERNEL32 ref: 0000017D2DD537EE
GetCurrentProcess.KERNEL32 ref: 0000017D2DD53809
VirtualProtectEx.KERNEL32 ref: 0000017D2DD5382A

Strings

wr, xrefs: 0000017D2DD537FF

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 14e430fe00e95c50cec8d9cb46a6a5414bd8b7d062380db77b6ae17ec3c80415
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 11115B3A708B8983EF189B21F4042A966B0FB89B85F480069DE8D07796EF3DC586C744

Function 0000017D2DD55B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000017D2DD55B6B
GetThreadContext.KERNEL32 ref: 0000017D2DD55CD5

Part of subcall function 0000017D2DD55960: GetCurrentThreadId.KERNEL32 ref: 0000017D2DD55964

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 335ccaf47bda0d5dd0922acdaab73b54d7caffec967b7b5861b83fc30812af85
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: E7D17B76209F8881DA71DF06F49439A77B0F788B84F140256EACD47B6ADF78C592CB40

Function 0000017D2DD52F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000017D2DD52F27
HeapAlloc.KERNEL32 ref: 0000017D2DD52F3A
StrCmpNIW.SHLWAPI ref: 0000017D2DD52FAF
GetProcessHeap.KERNEL32 ref: 0000017D2DD53015
HeapFree.KERNEL32 ref: 0000017D2DD53023

Strings

dialer, xrefs: 0000017D2DD52FA8

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 0230e169c366584fc835d7048ce1a4f9b827dda45302ed53d4d2da1fb762844c
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: D4315C36709F5983EA54DF16B9407AA6BB0FF44B84F0C81249E4C47B56EB78D4EA8780

Function 0000017D2DD514A4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000017D2DD514C5
HeapFree.KERNEL32 ref: 0000017D2DD514D4
GetProcessHeap.KERNEL32 ref: 0000017D2DD514E1
HeapFree.KERNEL32 ref: 0000017D2DD514F0
GetProcessHeap.KERNEL32 ref: 0000017D2DD51500

Strings

C:\Windows\system32\lsass.exe, xrefs: 0000017D2DD661A9, 0000017D2DD661B1

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Heap$Process$Free
String ID: C:\Windows\system32\lsass.exe
API String ID: 3168794593-3553486595
Opcode ID: 5f1dcf0d6982f64b78ee420bc41fcee6693c0fdf65c097574d0a291fc3cf39dd
Instruction ID: 2d5b6617ece1dd570ac47f263be0d53089bc250c903f123d4342631771f7ed81
Opcode Fuzzy Hash: 5f1dcf0d6982f64b78ee420bc41fcee6693c0fdf65c097574d0a291fc3cf39dd
Instruction Fuzzy Hash: 51316DBF54DFC88AE3518F75B8552992BB0FB99F40F0D8096DB8843247EA2D948687C0

Function 0000017D2DD5CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000017D2DD5CFAF
FlsSetValue.KERNEL32(?,?,?,0000017D2DD5D6B5,?,?,?,?,0000017D2DD5D778), ref: 0000017D2DD5CFE5
FlsSetValue.KERNEL32(?,?,?,0000017D2DD5D6B5,?,?,?,?,0000017D2DD5D778), ref: 0000017D2DD5D012
FlsSetValue.KERNEL32(?,?,?,0000017D2DD5D6B5,?,?,?,?,0000017D2DD5D778), ref: 0000017D2DD5D023
FlsSetValue.KERNEL32(?,?,?,0000017D2DD5D6B5,?,?,?,?,0000017D2DD5D778), ref: 0000017D2DD5D034
SetLastError.KERNEL32 ref: 0000017D2DD5D04F

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: bbc6a41099dd5a17270725d9b36443500c25c3cae1af76ce33926e4c6c33bdd2
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: 67115C3424DF8841FA64A739B5553A92272AF857B0F1C0724E83E4A7EBDEA884C38310

Function 0000017D2DD5199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 0000017D2DD519C2
K32GetModuleFileNameExW.KERNEL32 ref: 0000017D2DD519E0
PathFindFileNameW.SHLWAPI ref: 0000017D2DD519EF
lstrlenW.KERNEL32 ref: 0000017D2DD519FB
StrCpyW.SHLWAPI ref: 0000017D2DD51A0E
CloseHandle.KERNEL32 ref: 0000017D2DD51A1C

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 3df08bc0e274fd3b34b5b0dbf9f02f2257eae06cdf6fe6a10ddfa2816b121c7d
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: B3010535308B8882EA64DB52B85879963B5FB88BC4F884075DE5D43756DF3DC98A8780

Function 0000017D2DD536C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000017D2DD536E4
GetCurrentProcess.KERNEL32 ref: 0000017D2DD536F2
VirtualProtectEx.KERNEL32 ref: 0000017D2DD53714
GetCurrentProcess.KERNEL32 ref: 0000017D2DD53732
VirtualProtectEx.KERNEL32 ref: 0000017D2DD53753
TerminateThread.KERNEL32 ref: 0000017D2DD53762

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: f24fa2aad1f6ccfe3c5f40d64530b4ff01bea0f5f75abe919ea4a6c477ed8970
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: BC012979619F8982FB249B21F80879977B0FF49B86F084464CD4D07766EF3DC19A8780

Function 0000017D2DD59005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000017D2DD59013
_IsNonwritableInCurrentImage.LIBCMT ref: 0000017D2DD590A8
RtlUnwindEx.NTDLL ref: 0000017D2DD590F7

Strings

csm, xrefs: 0000017D2DD5908E
f, xrefs: 0000017D2DD59026

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: a81db0b67a2eb7f1a73ed3c669436fa5414171ee8f5b59af52ebe3c390cd136c
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 3651A436709B1886DB14DF25F448B9937B6FB58B88F188524DA0E4774AEBB5D8C2C740

Function 0000017D2DD58FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000017D2DD59013
_IsNonwritableInCurrentImage.LIBCMT ref: 0000017D2DD590A8
RtlUnwindEx.NTDLL ref: 0000017D2DD590F7

Strings

csm, xrefs: 0000017D2DD5908E
f, xrefs: 0000017D2DD59026

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: bb9ee6d5d2854114a24f2ca4c814b681745e9581d68bb0e9d4f3a3abf8f9be72
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 2931E036208B5897E710DF25F848B9937B5FB44B88F088518EE4E0778ADB79D982C744

Function 0000017D2DD51A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 0000017D2DD51A60
StrCmpNIW.SHLWAPI ref: 0000017D2DD51A7A
lstrlenW.KERNEL32 ref: 0000017D2DD51A89
StrCpyW.SHLWAPI ref: 0000017D2DD51A9E

Strings

\\?\, xrefs: 0000017D2DD51A6E

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: 5ba28880476b1b58ce267a7bdad5310d6327c2677bc23d1de7ae17b14c72ffd6
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: A2F03136308B8992E7708F25F9947996774FB48B98F884020DA4D4655ADA6DC6CFCB80

Function 0000017D2DD5BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 0000017D2DD5BCBD
GetProcAddress.KERNEL32 ref: 0000017D2DD5BCD3
FreeLibrary.KERNEL32 ref: 0000017D2DD5BCFA

Strings

CorExitProcess, xrefs: 0000017D2DD5BCCC
mscoree.dll, xrefs: 0000017D2DD5BCB4

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: a7a9063c7dca6d67b69c39055377418c24b560d5b242d4ac3647c1b5c43d6db2
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: BEF06D75219F4C91EB108F64F8443A96330EF89BA1F580259DA6E466E6DF3CC0CAC3C0

Function 0000017D2DD53044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 0000017D2DD53066
StrCpyW.SHLWAPI ref: 0000017D2DD53076
StrCatW.SHLWAPI ref: 0000017D2DD53082
PathCombineW.SHLWAPI ref: 0000017D2DD53090

Strings

\\.\pipe\, xrefs: 0000017D2DD5305C

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: d1af86b7dc9d4c02dc9e9ba88acbca0d8203c7d254f4a35dd1ad92e41bb022f5
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: ECF0F879618FC892EA148F57B914199A675AF48FD0F0C9160EE4E47B2ADE28C4968780

Function 0000017D2DD550D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000017D2DD55156

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: e7bb3d7a424d16d6639218f3a29322317eeb4f967574d6a86b6659e314bd5c8b
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: B402C43261DB8886EB61CF59F49079AB7B0F7C4790F144115EA8E87BA9DBBCC485CB00

Function 0000017D2DD55710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000017D2DD55726

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: fe8b9f1cb658fcbb6f3a66605413847c88da993d077414e375bd751c5d8fdec5
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: A461C63651DF88C6E6618F15F44435AB7B0FB88784F581255EA8E47BAADBBCC486CF00

Function 0000017D2DD64104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000017D2DD6412C
_set_statfp.LIBCMT ref: 0000017D2DD64147
_set_statfp.LIBCMT ref: 0000017D2DD64163
_set_statfp.LIBCMT ref: 0000017D2DD6419F

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: a2e73b0dc39c3a45163b5e1fe24a4393a9607e531bb5d94db0e97e30a564c429
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 7211A332A5CF5815F6A41668F4513E911706F783B8F1C4625A97E076DFCA2CE8C352C0

Function 0000017D2DD33504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000017D2DD3352C
_set_statfp.LIBCMT ref: 0000017D2DD33547
_set_statfp.LIBCMT ref: 0000017D2DD33563
_set_statfp.LIBCMT ref: 0000017D2DD3359F

Memory Dump Source

Source File: 0000002B.00000002.2643916103.0000017D2DD20000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd20000_lsass.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 477c9a34daed5c8165e8d81058373679db092c7b8c61830a0374f52ce82835b2
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 5811773361CF5917FAD41528FB553E911B16FD8374F8C4628A9EE0A6D7CA24D8C34A00

Function 0000017D2DD59650 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000017D2DD5966F
SetLastError.KERNEL32 ref: 0000017D2DD596F6

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 46c896f13dff0714c7ccebb8ca9383bb675cc38bcf091c92c481f4a556b8b138
Instruction ID: 43d9dddd7d87b068f499d0fdd4dce39bb763552f788187762af13b592a091dc5
Opcode Fuzzy Hash: 46c896f13dff0714c7ccebb8ca9383bb675cc38bcf091c92c481f4a556b8b138
Instruction Fuzzy Hash: A1114C34209F9842FE549725B8843E922B1AF48BE0F0C5624D92E077DFDA78C8CBC700

Function 0000017D2DD2F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000017D2DD2F124

Strings

Tuesday, xrefs: 0000017D2DD2F0F4
or copy constructor iterator', xrefs: 0000017D2DD2F25A, 0000017D2DD2F275
Wednesday, xrefs: 0000017D2DD2F1ED

Memory Dump Source

Source File: 0000002B.00000002.2643916103.0000017D2DD20000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd20000_lsass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 404a8fd3a07e50e84a6b6d7519f50f470db59ed2827b0a5a5bd42659157b0151
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: F3617D76608F4C42FA668A7AF5497EA2AB1AF85740F9D4C15CA0E177DFDB34C8C38200

Function 0000017D2DD5AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 0000017D2DD5AA68
_CallSETranslator.LIBVCRUNTIME ref: 0000017D2DD5AAB7

Strings

RCC, xrefs: 0000017D2DD5AA85
MOC, xrefs: 0000017D2DD5AA7C

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 7690aaae0e4b2262e5bca8c680bb55033b9461ae702e00063689349ef27dbae7
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: CD614B36608B588AEB20DF65E4403DD77B0FB44B88F085215EE4D17B9ADBB8D59AC740

Function 0000017D2DD5AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000017D2DD5ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0000017D2DD5AE88

Strings

csm, xrefs: 0000017D2DD5AEDA
csm, xrefs: 0000017D2DD5ADC2

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 154700f38c1b69783df6a378d411671468d94bd339d233544ea2a5e0ab197207
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 0551907610CB988AEB648B15B48439977B0FB54B84F1C6116EA4D47B96CBB8E4EAC700

Function 0000017D2DD2A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000017D2DD2A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0000017D2DD2A288

Strings

csm, xrefs: 0000017D2DD2A1C2
csm, xrefs: 0000017D2DD2A2DA

Memory Dump Source

Source File: 0000002B.00000002.2643916103.0000017D2DD20000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd20000_lsass.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 5febf20ca8be60a294598188ac8e06a527c5694235806c0fd98dbb137e8aa58c
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 9C518E3210CB88CAFB648B55A54839877B0FB55B94F1C6116DA9D87BDBCB38D5D2C700

Function 0000017D2DD28405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000017D2DD28413
_IsNonwritableInCurrentImage.LIBCMT ref: 0000017D2DD284A8

Strings

csm, xrefs: 0000017D2DD2848E
f, xrefs: 0000017D2DD28426

Memory Dump Source

Source File: 0000002B.00000002.2643916103.0000017D2DD20000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd20000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: ebaa93514360deb3c4a0a09a1e9737b1dd9c88c483c05ef692c930f299638c4c
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 4A51AB32649B088BEB54CB15F448BA937B5FB54B98F588124DA4E4378FEB34C8C28B04

Function 0000017D2DD283E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000017D2DD28413
_IsNonwritableInCurrentImage.LIBCMT ref: 0000017D2DD284A8

Strings

csm, xrefs: 0000017D2DD2848E
f, xrefs: 0000017D2DD28426

Memory Dump Source

Source File: 0000002B.00000002.2643916103.0000017D2DD20000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd20000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: fe002749a5d160103fa0e0e47d814535d87942aed18f2ca8a6d465f99c7a9653
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: A0318D32249B4496E754DF11F84879977B9FB44B98F198114EE9E07B8FDB38C982CB04

Function 0000017D2DD62058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 0000017D2DD620D7
WriteFile.KERNEL32 ref: 0000017D2DD6239F
WriteFile.KERNEL32 ref: 0000017D2DD623E5
GetLastError.KERNEL32 ref: 0000017D2DD6249B

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 7152cc84080426dd393db4e38e76c3e4fe8dbea9a1cbbda6f4e6e3b4679a9860
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 35D1CF32718B8889E711CFA9E4403DC3BB5FB55798F588216CE5D97B9ADA34C587C380

Function 0000017D2DD62980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 0000017D2DD62A9C
GetLastError.KERNEL32 ref: 0000017D2DD62B27

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: b044381306ab9c6176738c66a68acd90023a20d202c02ae602019e1ccdecad08
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: 79918172618F5899F7609F69B4403ED2FB0EB54B88F188109DE4E67A9ADA35C4C7C7C0

Function 0000017D2DD57960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 0000017D2DD5798C
GetCurrentThreadId.KERNEL32 ref: 0000017D2DD5799A
GetCurrentProcessId.KERNEL32 ref: 0000017D2DD579A6
QueryPerformanceCounter.KERNEL32 ref: 0000017D2DD579B6

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: b33fbbc4129736c9bf654a6e7fd5a1510d97486ebb9906592996c4b0fc058f04
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 93112A36754F498AEB00CF60F8553A833B4FB19758F481E21DA6D467A9DF78C19A8380

Function 0000017D2DD5253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000017D2DD52620
StrCpyW.SHLWAPI ref: 0000017D2DD52639

Strings

\\.\pipe\, xrefs: 0000017D2DD5262B

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: c0d3531c21c4d31313f67105679082d8c56846684e84a2b0545e0e951a74e749
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 4571D736208F8A46E725DF25F8443EA6BB4FB89784F484016DD4D53B8ADEB5C58AC700

Function 0000017D2DD29E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 0000017D2DD29EB7

Strings

MOC, xrefs: 0000017D2DD29E7C
RCC, xrefs: 0000017D2DD29E85

Memory Dump Source

Source File: 0000002B.00000002.2643916103.0000017D2DD20000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd20000_lsass.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 1839f8c3ad161bc230c463d9a6d868dcf13723bc0d4c69507e66fae6d60f642e
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 84614732609B888AEB20DF65E4843DD77B0FB48B98F084215EF4D17B9ADB38D596C710

Function 0000017D2DD52330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000017D2DD52416
StrCpyW.SHLWAPI ref: 0000017D2DD5242D

Strings

\\.\pipe\, xrefs: 0000017D2DD52421

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 5d967f130145fd2457fc1d8960457ffbf35bdc14831b63443ba8836e30615b82
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 6251193220CB8981E634CE29B4543FA6B75FB95744F4C8125DD9E03B4BDAB9C58AC780

Function 0000017D2DD626F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 0000017D2DD62807
GetLastError.KERNEL32 ref: 0000017D2DD62829

Strings

U, xrefs: 0000017D2DD627B3

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 533c181d1c4fc9b0d992494bedecaf397c0798d3602d327ef67923b0e5bd60ba
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 6E41A232719B8482EB20DF25F8447E967B0FB98794F588021EE4D87799DB7CC582C780

Function 0000017D2DD594A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 0000017D2DD594F0
RaiseException.KERNEL32 ref: 0000017D2DD59531

Strings

csm, xrefs: 0000017D2DD5951E

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 7501787f3bdaefa2e8ecfcba4a6aeb5f79ff854105b5d2d6e2058d57a5b9088e
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 9F111936219F8482EB618B15F44039977F5FB88B94F5C4224EA8D07759DF78C592CB40

Function 0000017D2DD27356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 0000017D2DD2737C

Strings

riptor at (, xrefs: 0000017D2DD27364
ierarchy Descriptor', xrefs: 0000017D2DD27381

Memory Dump Source

Source File: 0000002B.00000002.2643916103.0000017D2DD20000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd20000_lsass.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 6f68ef48875825ce838e86f1a341d560eb1e4ad070bd9e76c7a0e58232261100
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: ACE08671644F4C90DF018F21F8402D833B0DF58B64B4C9122995C07316FA38D1EAC710

Function 0000017D2DD273B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 0000017D2DD273D8

Strings

riptor at (, xrefs: 0000017D2DD273C0
Locator', xrefs: 0000017D2DD273DD

Memory Dump Source

Source File: 0000002B.00000002.2643916103.0000017D2DD20000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd20000_lsass.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 2445f953400bc03a80d3df9aa50630c983575cfd672fe7edebf9eeb921a494bc
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 79E08C71A44F4C80DF028F21E8802D873B0EB68B64B8C9122CA5C07316EA38D1EAC310

Function 0000017D2DD51BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000017D2DD51C2D
HeapAlloc.KERNEL32 ref: 0000017D2DD51C3B
GetProcessHeap.KERNEL32 ref: 0000017D2DD51C77
HeapFree.KERNEL32 ref: 0000017D2DD51C85

Part of subcall function 0000017D2DD5152C: StrCmpIW.SHLWAPI ref: 0000017D2DD5155D

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 9cee9b783636be087741f5e1b8df2ae14b651d31430e169093af8b925976ad96
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 18113A39605F8881EA54DB66B8082A9B7B1FB89FC0F1C4168DE4D97767DE79D4838380

Function 0000017D2DD51268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000017D2DD5126E
HeapAlloc.KERNEL32 ref: 0000017D2DD5127D
GetProcessHeap.KERNEL32 ref: 0000017D2DD51297
HeapAlloc.KERNEL32 ref: 0000017D2DD512A8

Memory Dump Source

Source File: 0000002B.00000002.2644113965.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: f1bcd8aa1abc8590651bf66f0bbd1f21628ae84c1cd742650bcaa24afb1b9de1
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 2FE03939641B4886EB048B62F80838A36F1EB89B06F0880248A0947352DF7D84DAC7D0

Analysis Process: svchost.exePID: 912, Parent PID: 7692COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	74
Total number of Limit Nodes:	2

Executed Functions

Function 0000022F4B92328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 0000022F4B9232AE
PathFindFileNameW.SHLWAPI ref: 0000022F4B9232BD

Part of subcall function 0000022F4B923844: StrCmpNIW.SHLWAPI ref: 0000022F4B92385C

Part of subcall function 0000022F4B923790: GetModuleHandleW.KERNEL32 ref: 0000022F4B92379E
Part of subcall function 0000022F4B923790: GetCurrentProcess.KERNEL32 ref: 0000022F4B9237CC
Part of subcall function 0000022F4B923790: VirtualProtectEx.KERNEL32 ref: 0000022F4B9237EE
Part of subcall function 0000022F4B923790: GetCurrentProcess.KERNEL32 ref: 0000022F4B923809
Part of subcall function 0000022F4B923790: VirtualProtectEx.KERNEL32 ref: 0000022F4B92382A

CreateThread.KERNEL32 ref: 0000022F4B92330B

Part of subcall function 0000022F4B921D14: GetCurrentThread.KERNEL32 ref: 0000022F4B921D1F

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 499753e5498616a5248436bfd7ad92956633407b8286327215e6ea229ab40278
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 92115E28E18200A6FBE8BFE1EB2D35B23B4A754344F8049349B4682597EFFCC148C311

Function 0000022F4B921ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000022F4B921628: GetProcessHeap.KERNEL32 ref: 0000022F4B921633
Part of subcall function 0000022F4B921628: HeapAlloc.KERNEL32 ref: 0000022F4B921642
Part of subcall function 0000022F4B921628: RegOpenKeyExW.ADVAPI32 ref: 0000022F4B9216B2
Part of subcall function 0000022F4B921628: RegOpenKeyExW.ADVAPI32 ref: 0000022F4B9216DF
Part of subcall function 0000022F4B921628: RegCloseKey.ADVAPI32 ref: 0000022F4B9216F9
Part of subcall function 0000022F4B921628: RegOpenKeyExW.ADVAPI32 ref: 0000022F4B921719
Part of subcall function 0000022F4B921628: RegCloseKey.ADVAPI32 ref: 0000022F4B921734
Part of subcall function 0000022F4B921628: RegOpenKeyExW.ADVAPI32 ref: 0000022F4B921754
Part of subcall function 0000022F4B921628: RegCloseKey.ADVAPI32 ref: 0000022F4B92176F
Part of subcall function 0000022F4B921628: RegOpenKeyExW.ADVAPI32 ref: 0000022F4B92178F
Part of subcall function 0000022F4B921628: RegCloseKey.ADVAPI32 ref: 0000022F4B9217AA
Part of subcall function 0000022F4B921628: RegOpenKeyExW.ADVAPI32 ref: 0000022F4B9217CA

Sleep.KERNEL32 ref: 0000022F4B921AD7
SleepEx.KERNELBASE ref: 0000022F4B921ADD

Part of subcall function 0000022F4B921628: RegCloseKey.ADVAPI32 ref: 0000022F4B9217E5
Part of subcall function 0000022F4B921628: RegOpenKeyExW.ADVAPI32 ref: 0000022F4B921805
Part of subcall function 0000022F4B921628: RegCloseKey.ADVAPI32 ref: 0000022F4B921820
Part of subcall function 0000022F4B921628: RegOpenKeyExW.ADVAPI32 ref: 0000022F4B921840
Part of subcall function 0000022F4B921628: RegCloseKey.ADVAPI32 ref: 0000022F4B92185B
Part of subcall function 0000022F4B921628: RegOpenKeyExW.ADVAPI32 ref: 0000022F4B92187B
Part of subcall function 0000022F4B921628: RegCloseKey.ADVAPI32 ref: 0000022F4B921896
Part of subcall function 0000022F4B921628: RegCloseKey.ADVAPI32 ref: 0000022F4B9218A0

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: cfcf9aca8d9fa6c356e958a7aeb12d4f996e4ae4aaeb90c34f58094a98a870a3
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 2831AC6DE1066161FBD8BFF6D76936B23B4AB44BC0F0459319F098769BEE98C471C210

Function 0000022F4B923844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 0000022F4B92385C

Strings

dialer, xrefs: 0000022F4B923855

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction ID: 606930cdb4700d14d3951725284149e6cd9df57b4dff78a4ff21b0a3433bbc43
Opcode Fuzzy Hash: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction Fuzzy Hash: 4DD05E68F15205AAFB98AFE6C9EC6622370EB08744F8C9030CA0045151DB98899DDB10

Function 0000022F4B8F273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 0000022F4B8F285E

Memory Dump Source

Source File: 0000002C.00000002.2634829706.0000022F4B8F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B8F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b8f0000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 4c50ac63591964c54a9a2d23cedf9431965fbbf44280cedf0482e598f9c02324
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 8D61223AF0129497DF94AF54C204F2A73A2F754BA5F588131EF490778AEA78D853C700

Non-executed Functions

Function 0000022F4B922B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 0000022F4B922BD0
lstrlenW.KERNEL32 ref: 0000022F4B922E0A

Part of subcall function 0000022F4B92199C: OpenProcess.KERNEL32 ref: 0000022F4B9219C2
Part of subcall function 0000022F4B92199C: K32GetModuleFileNameExW.KERNEL32 ref: 0000022F4B9219E0
Part of subcall function 0000022F4B92199C: PathFindFileNameW.SHLWAPI ref: 0000022F4B9219EF
Part of subcall function 0000022F4B92199C: lstrlenW.KERNEL32 ref: 0000022F4B9219FB
Part of subcall function 0000022F4B92199C: StrCpyW.SHLWAPI ref: 0000022F4B921A0E
Part of subcall function 0000022F4B92199C: CloseHandle.KERNEL32 ref: 0000022F4B921A1C

GetProcAddress.KERNEL32 ref: 0000022F4B922BE5

Part of subcall function 0000022F4B92152C: StrCmpIW.SHLWAPI ref: 0000022F4B92155D

Part of subcall function 0000022F4B923844: StrCmpNIW.SHLWAPI ref: 0000022F4B92385C

StrCmpNIW.SHLWAPI ref: 0000022F4B922C28
lstrlenW.KERNEL32 ref: 0000022F4B922D50

Strings

NtQueryObject, xrefs: 0000022F4B922BDB
ntdll.dll, xrefs: 0000022F4B922BC9
\Device\Nsi, xrefs: 0000022F4B922C1B

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: bcf7f1ee5ddb0453fe9bd56a1718b2b306548187ea50fb95823794d523efe43d
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: CBB1BF3AE10650A2FF9CAFA5D66876A73B4FB44B84F045836EF0957796DBB8C844C340

Function 0000022F4B927D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 0000022F4B927DAC
RtlCaptureContext.NTDLL ref: 0000022F4B927DD9
RtlLookupFunctionEntry.NTDLL ref: 0000022F4B927DF3
RtlVirtualUnwind.NTDLL ref: 0000022F4B927E34
IsDebuggerPresent.KERNEL32 ref: 0000022F4B927E88
SetUnhandledExceptionFilter.KERNEL32 ref: 0000022F4B927EA9
UnhandledExceptionFilter.KERNEL32 ref: 0000022F4B927EB4

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: a04e2be782a9479eefdbbbc9edbcf7652d8c43eded4af119ba3e2e7215a11d47
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: B8313C76A05A809AEBA4AFA0E8943EE6370F788744F444439DB4D57B95EF78C548C710

Function 0000022F4B92D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 0000022F4B92D31D
RtlLookupFunctionEntry.NTDLL ref: 0000022F4B92D335
RtlVirtualUnwind.NTDLL ref: 0000022F4B92D370
IsDebuggerPresent.KERNEL32 ref: 0000022F4B92D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 0000022F4B92D3B3
UnhandledExceptionFilter.KERNEL32 ref: 0000022F4B92D3BE

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 43af27b815cd5b64c3f44c815349252d9f52db7ade0dad81ec23985faf94ec88
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: F531BF3AA04B8096EBA4EF65E89439E33B0F788754F440535EB8D43B96DF78C145CB00

Function 0000022F4B921628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000022F4B921633
HeapAlloc.KERNEL32 ref: 0000022F4B921642

Part of subcall function 0000022F4B921268: GetProcessHeap.KERNEL32 ref: 0000022F4B92126E
Part of subcall function 0000022F4B921268: HeapAlloc.KERNEL32 ref: 0000022F4B92127D
Part of subcall function 0000022F4B921268: GetProcessHeap.KERNEL32 ref: 0000022F4B921297
Part of subcall function 0000022F4B921268: HeapAlloc.KERNEL32 ref: 0000022F4B9212A8

RegOpenKeyExW.ADVAPI32 ref: 0000022F4B9216B2
RegOpenKeyExW.ADVAPI32 ref: 0000022F4B9216DF
RegCloseKey.ADVAPI32 ref: 0000022F4B9216F9
RegOpenKeyExW.ADVAPI32 ref: 0000022F4B921719
RegCloseKey.ADVAPI32 ref: 0000022F4B921734
RegOpenKeyExW.ADVAPI32 ref: 0000022F4B921754
RegCloseKey.ADVAPI32 ref: 0000022F4B92176F
RegOpenKeyExW.ADVAPI32 ref: 0000022F4B92178F
RegCloseKey.ADVAPI32 ref: 0000022F4B9217AA
RegOpenKeyExW.ADVAPI32 ref: 0000022F4B9217CA
RegCloseKey.ADVAPI32 ref: 0000022F4B9217E5
RegOpenKeyExW.ADVAPI32 ref: 0000022F4B921805
RegCloseKey.ADVAPI32 ref: 0000022F4B921820
RegOpenKeyExW.ADVAPI32 ref: 0000022F4B921840
RegCloseKey.ADVAPI32 ref: 0000022F4B92185B
RegOpenKeyExW.ADVAPI32 ref: 0000022F4B92187B
RegCloseKey.ADVAPI32 ref: 0000022F4B921896
RegCloseKey.ADVAPI32 ref: 0000022F4B9218A0

Part of subcall function 0000022F4B9212BC: RegQueryInfoKeyW.ADVAPI32 ref: 0000022F4B921319
Part of subcall function 0000022F4B9212BC: GetProcessHeap.KERNEL32 ref: 0000022F4B921327
Part of subcall function 0000022F4B9212BC: HeapAlloc.KERNEL32 ref: 0000022F4B921338
Part of subcall function 0000022F4B9212BC: RegEnumValueW.ADVAPI32 ref: 0000022F4B921397
Part of subcall function 0000022F4B9212BC: GetProcessHeap.KERNEL32 ref: 0000022F4B9213DF
Part of subcall function 0000022F4B9212BC: HeapAlloc.KERNEL32 ref: 0000022F4B9213ED
Part of subcall function 0000022F4B9212BC: GetProcessHeap.KERNEL32 ref: 0000022F4B92140A
Part of subcall function 0000022F4B9212BC: HeapFree.KERNEL32 ref: 0000022F4B921418
Part of subcall function 0000022F4B9212BC: lstrlenW.KERNEL32 ref: 0000022F4B921421
Part of subcall function 0000022F4B9212BC: GetProcessHeap.KERNEL32 ref: 0000022F4B92142F
Part of subcall function 0000022F4B9212BC: HeapAlloc.KERNEL32 ref: 0000022F4B92143D

Strings

service_names, xrefs: 0000022F4B9217C3
paths, xrefs: 0000022F4B921788
tcp_remote, xrefs: 0000022F4B921839
startup, xrefs: 0000022F4B9216D5
SOFTWARE\dialerconfig, xrefs: 0000022F4B921692
tcp_local, xrefs: 0000022F4B9217FE
process_names, xrefs: 0000022F4B92174D
udp, xrefs: 0000022F4B921874
pid, xrefs: 0000022F4B921712

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: e5766046f156c363c883a85334d0fbf2df80b36a5027c18cc8da2133ea49a9b5
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 5C71243AF10A1095EB50AFE6E9A965A3374F789B88F002531DF4D8776ADF78C464C740

Function 0000022F4B9212BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000022F4B921319
GetProcessHeap.KERNEL32 ref: 0000022F4B921327
HeapAlloc.KERNEL32 ref: 0000022F4B921338
RegEnumValueW.ADVAPI32 ref: 0000022F4B921397

Part of subcall function 0000022F4B92152C: StrCmpIW.SHLWAPI ref: 0000022F4B92155D

GetProcessHeap.KERNEL32 ref: 0000022F4B9213DF
HeapAlloc.KERNEL32 ref: 0000022F4B9213ED
GetProcessHeap.KERNEL32 ref: 0000022F4B92140A
HeapFree.KERNEL32 ref: 0000022F4B921418
lstrlenW.KERNEL32 ref: 0000022F4B921421
GetProcessHeap.KERNEL32 ref: 0000022F4B92142F
HeapAlloc.KERNEL32 ref: 0000022F4B92143D
StrCpyW.SHLWAPI ref: 0000022F4B92145F
GetProcessHeap.KERNEL32 ref: 0000022F4B921476
HeapFree.KERNEL32 ref: 0000022F4B921484

Strings

d, xrefs: 0000022F4B92135A

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 46f71d7faf0e95b6912db930efd0f35ae2342ef1ddce4bcae0a06502c4c35caa
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 5B51273AA04B8496EB94EFA2E66835B77B1F789B89F048134DB490771ADFBCC055C700

Function 0000022F4B921D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 0000022F4B921D1F

Part of subcall function 0000022F4B921FD4: GetModuleHandleA.KERNEL32 ref: 0000022F4B921FEC
Part of subcall function 0000022F4B921FD4: GetProcAddress.KERNEL32 ref: 0000022F4B921FFD

Part of subcall function 0000022F4B925B30: GetCurrentThreadId.KERNEL32 ref: 0000022F4B925B6B

Strings

NtQueryDirectoryFile, xrefs: 0000022F4B921D7F
NtEnumerateValueKey, xrefs: 0000022F4B921DD6
NtResumeThread, xrefs: 0000022F4B921D62
NtEnumerateKey, xrefs: 0000022F4B921DB9
EnumServiceGroupW, xrefs: 0000022F4B921DF0
ntdll.dll, xrefs: 0000022F4B921D2D
EnumServicesStatusExW, xrefs: 0000022F4B921E11, 0000022F4B921E32
NtDeviceIoControlFile, xrefs: 0000022F4B921E56
NtQueryDirectoryFileEx, xrefs: 0000022F4B921D9C
advapi32.dll, xrefs: 0000022F4B921DF7, 0000022F4B921E18
sechost.dll, xrefs: 0000022F4B921E39
NtQuerySystemInformation, xrefs: 0000022F4B921D45

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: d207d9220f18b6cea06c763a37e9b0cb56c9ff3a490cc8220af777ee07cf9adf
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 7A31B26CD1090AB0FE8CFFE5EA796E63330BB08344F9458339619425639EFC8669D350

Function 0000022F4B8F6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000022F4B8F6938
__scrt_acquire_startup_lock.LIBCMT ref: 0000022F4B8F698A
_RTC_Initialize.LIBCMT ref: 0000022F4B8F69B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000022F4B8F69DE
__scrt_release_startup_lock.LIBCMT ref: 0000022F4B8F6A09

Strings

`eh vector vbase copy constructor iterator', xrefs: 0000022F4B8F69EE
scriptor', xrefs: 0000022F4B8F6B39, 0000022F4B8F6BB2, 0000022F4B8F6BEC
`dynamic initializer for ', xrefs: 0000022F4B8F69C7
`eh vector copy constructor iterator', xrefs: 0000022F4B8F6A3B

Memory Dump Source

Source File: 0000002C.00000002.2634829706.0000022F4B8F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B8F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b8f0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 44c41662410089b528ca2d48acd593e41cddb88394403bf67763fb9a239446ba
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 8781BF39E00201A6FAD0BFE5D659B5B22B1EB89782F5482359B4583797FBF9C847C700

Function 0000022F4B92CE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 0000022F4B92CE37
FlsGetValue.KERNEL32(?,?,?,0000022F4B930A6B,?,?,?,0000022F4B93045C,?,?,?,0000022F4B92C84F), ref: 0000022F4B92CE4C
FlsSetValue.KERNEL32(?,?,?,0000022F4B930A6B,?,?,?,0000022F4B93045C,?,?,?,0000022F4B92C84F), ref: 0000022F4B92CE6D
FlsSetValue.KERNEL32(?,?,?,0000022F4B930A6B,?,?,?,0000022F4B93045C,?,?,?,0000022F4B92C84F), ref: 0000022F4B92CE9A
FlsSetValue.KERNEL32(?,?,?,0000022F4B930A6B,?,?,?,0000022F4B93045C,?,?,?,0000022F4B92C84F), ref: 0000022F4B92CEAB
FlsSetValue.KERNEL32(?,?,?,0000022F4B930A6B,?,?,?,0000022F4B93045C,?,?,?,0000022F4B92C84F), ref: 0000022F4B92CEBC
SetLastError.KERNEL32 ref: 0000022F4B92CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,0000022F4B930A6B,?,?,?,0000022F4B93045C,?,?,?,0000022F4B92C84F), ref: 0000022F4B92CF0D
FlsSetValue.KERNEL32(?,?,00000001,0000022F4B92ECCC,?,?,?,?,0000022F4B92BF9F,?,?,?,?,?,0000022F4B927AB0), ref: 0000022F4B92CF2C

Part of subcall function 0000022F4B92D6CC: HeapAlloc.KERNEL32 ref: 0000022F4B92D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000022F4B930A6B,?,?,?,0000022F4B93045C,?,?,?,0000022F4B92C84F), ref: 0000022F4B92CF54

Part of subcall function 0000022F4B92D744: HeapFree.KERNEL32 ref: 0000022F4B92D75A
Part of subcall function 0000022F4B92D744: GetLastError.KERNEL32 ref: 0000022F4B92D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000022F4B930A6B,?,?,?,0000022F4B93045C,?,?,?,0000022F4B92C84F), ref: 0000022F4B92CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000022F4B930A6B,?,?,?,0000022F4B93045C,?,?,?,0000022F4B92C84F), ref: 0000022F4B92CF76

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: 43cd81bcdb26728153ee64f1615efb2ef4fe9c99b681245c46ce7db633faee17
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 86413C6CE0124461FAEC7FA1D77E36B22725F457B0F240F34AB36066E7DAAC8851C200

Function 0000022F4B922244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 0000022F4B922259
GetCurrentProcessId.KERNEL32 ref: 0000022F4B922263

Part of subcall function 0000022F4B921934: OpenProcess.KERNEL32 ref: 0000022F4B921952
Part of subcall function 0000022F4B921934: IsWow64Process.KERNEL32 ref: 0000022F4B921968
Part of subcall function 0000022F4B921934: CloseHandle.KERNEL32 ref: 0000022F4B921983

CreateFileW.KERNEL32 ref: 0000022F4B9222BC
WriteFile.KERNEL32 ref: 0000022F4B9222E4
ReadFile.KERNEL32 ref: 0000022F4B922303
CloseHandle.KERNEL32 ref: 0000022F4B92230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 0000022F4B92228C
\\.\pipe\dialerchildproc32, xrefs: 0000022F4B922293

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 05906820ac88f93dd4f39b3c0b5c824dab056eed99cf60f72fbd9261573551f1
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 6521603AA1864093FB54AF65F66835B73B0F789BA4F541235DB5902AA9CFBCC149CF00

Function 0000022F4B92A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000022F4B92A5A1

Part of subcall function 0000022F4B92B414: __GetUnwindTryBlock.LIBCMT ref: 0000022F4B92B457
Part of subcall function 0000022F4B92B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0000022F4B92B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000022F4B92A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0000022F4B92A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 0000022F4B92A9DA

Strings

csm, xrefs: 0000022F4B92A622
csm, xrefs: 0000022F4B92A69C
csm, xrefs: 0000022F4B92A5BB

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: 2a02c290a53c1189dee5bf018af1a8916d4d54de72c2aaec13b2c8ff930c8b50
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 29E18C3AE007409AFBA8AFA5D65939E77B0F755B98F000935DB8957B96CB78C082C700

Function 0000022F4B8F9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000022F4B8F99A1

Part of subcall function 0000022F4B8FA814: __GetUnwindTryBlock.LIBCMT ref: 0000022F4B8FA857
Part of subcall function 0000022F4B8FA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0000022F4B8FA87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000022F4B8F9A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0000022F4B8F9CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 0000022F4B8F9DDA

Strings

csm, xrefs: 0000022F4B8F9A9C
csm, xrefs: 0000022F4B8F9A22
csm, xrefs: 0000022F4B8F99BB

Memory Dump Source

Source File: 0000002C.00000002.2634829706.0000022F4B8F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B8F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b8f0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: fe26667269d8011ccc73069bfa6e4b4c25f03e493cc576837db71b885a00b806
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: F5E1B23AA047409AEBA0EFA5D548B9E37B0F7A5799F100135EF4957B57EB74C092C700

Function 0000022F4B92F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 0000022F4B92F510
GetProcAddress.KERNEL32 ref: 0000022F4B92F51C

Strings

api-ms-, xrefs: 0000022F4B92F45A
ext-ms-, xrefs: 0000022F4B92F46D

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: ddb198e122b73e8a3f28c7f5a39207ffb200a7d8f85c176143a44c7ded816286
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: FE41E62AF15A1061FE99EF96EA6C75733B1B749BA0F0449359F0987786DEBCC445C300

Function 0000022F4B92104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000022F4B9210B1
RegEnumValueW.ADVAPI32 ref: 0000022F4B921117
GetProcessHeap.KERNEL32 ref: 0000022F4B92115A
HeapAlloc.KERNEL32 ref: 0000022F4B921168
GetProcessHeap.KERNEL32 ref: 0000022F4B921185
HeapFree.KERNEL32 ref: 0000022F4B921193

Strings

d, xrefs: 0000022F4B9210D6

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: ce9cefd1f562b99d9dbd7395918815e3e2e756b4851a030e7b44f7ae27ca4f18
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 7B417B36A14B8096E7A4DFA1E55839A77B1F389B88F048139DB8907659DF7CC499CB00

Function 0000022F4B92D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,0000022F4B92C7DE,?,?,?,?,?,?,?,?,0000022F4B92CF9D,?,?,00000001), ref: 0000022F4B92D087
FlsSetValue.KERNEL32(?,?,?,0000022F4B92C7DE,?,?,?,?,?,?,?,?,0000022F4B92CF9D,?,?,00000001), ref: 0000022F4B92D0A6
FlsSetValue.KERNEL32(?,?,?,0000022F4B92C7DE,?,?,?,?,?,?,?,?,0000022F4B92CF9D,?,?,00000001), ref: 0000022F4B92D0CE
FlsSetValue.KERNEL32(?,?,?,0000022F4B92C7DE,?,?,?,?,?,?,?,?,0000022F4B92CF9D,?,?,00000001), ref: 0000022F4B92D0DF
FlsSetValue.KERNEL32(?,?,?,0000022F4B92C7DE,?,?,?,?,?,?,?,?,0000022F4B92CF9D,?,?,00000001), ref: 0000022F4B92D0F0

Strings

Y%, xrefs: 0000022F4B92D0A6
1%, xrefs: 0000022F4B92D0CE

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 68759005852adcf3171e0ff60abff8fc8c588892bed47c8f11c2368566aedfeb
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: 82116028E0524461FAEC7FA5D77A36B6271AF457A0F184B349A3906AEBDEACC441D200

Function 0000022F4B927510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000022F4B927538
__scrt_acquire_startup_lock.LIBCMT ref: 0000022F4B92758A
_RTC_Initialize.LIBCMT ref: 0000022F4B9275B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000022F4B9275DE
__scrt_release_startup_lock.LIBCMT ref: 0000022F4B927609

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 6f5e93a162b23b54c21195d557574761c6a2a135c6bf61360d10f18f6c10e5af
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 4581BE28E05211A6FAD8BFE5D7793AB66B0AB85780F1448359B04637A7DBFCCC45C701

Function 0000022F4B929DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 0000022F4B929E49
GetLastError.KERNEL32 ref: 0000022F4B929E57
LoadLibraryExW.KERNEL32 ref: 0000022F4B929E81
FreeLibrary.KERNEL32 ref: 0000022F4B929EC7
GetProcAddress.KERNEL32 ref: 0000022F4B929ED3

Strings

api-ms-, xrefs: 0000022F4B929E69

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: cfa57f484c19428b64e88ae7352f6a3b0abaf1da1530dbc16454f581c9e117d6
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 2431C639E12640B1FE99AF92F62875626B4BB59BA0F590D399F1E07392DFBCC445C300

Function 0000022F4B933DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 0000022F4B933DE5
GetLastError.KERNEL32 ref: 0000022F4B933DF1
CloseHandle.KERNEL32 ref: 0000022F4B933E09
CreateFileW.KERNEL32 ref: 0000022F4B933E34
WriteConsoleW.KERNEL32 ref: 0000022F4B933E53

Strings

CONOUT$, xrefs: 0000022F4B933E15

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 1f689572b639900c57dde68c5b7bd88d2cd7f37c2ae033ee2b9bfa03f010a894
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 7F115125A18B5096E790AF92FA6831A77B0F78CFE4F045234EB5987796CBB8C454C740

Function 0000022F4B923790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000022F4B92379E
GetCurrentProcess.KERNEL32 ref: 0000022F4B9237CC
VirtualProtectEx.KERNEL32 ref: 0000022F4B9237EE
GetCurrentProcess.KERNEL32 ref: 0000022F4B923809
VirtualProtectEx.KERNEL32 ref: 0000022F4B92382A

Strings

wr, xrefs: 0000022F4B9237FF

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 0ed048e5e3b52fc56552343c1a854fdca816720b0fdf5b44690934109365be18
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 3F115A2AB0874096FF98AFA2E62826A63B4F749B84F040438DF8907756EF6DC505C704

Function 0000022F4B925B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000022F4B925B6B
GetThreadContext.KERNEL32 ref: 0000022F4B925CD5

Part of subcall function 0000022F4B925960: GetCurrentThreadId.KERNEL32 ref: 0000022F4B925964

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: ec0cbce3550fec8339a6e946288d8a6108edade13ae5567d057380e43e41bcc5
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: 14D1BE3AA08B5491EAB4AF46E59435B77B0F788B84F110536EB8D47B66DF7CC550CB00

Function 0000022F4B922F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000022F4B922F27
HeapAlloc.KERNEL32 ref: 0000022F4B922F3A
StrCmpNIW.SHLWAPI ref: 0000022F4B922FAF
GetProcessHeap.KERNEL32 ref: 0000022F4B923015
HeapFree.KERNEL32 ref: 0000022F4B923023

Strings

dialer, xrefs: 0000022F4B922FA8

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 1fe216bd1476280168fbe223966ae833535e2b5a5efe5b68f78fbeaaa7c07e44
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: E231842AF05B51A6FA98EF96D66876B77B0FB45B84F0848309F4847756DB78C461C300

Function 0000022F4B9214A4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000022F4B9214C5
HeapFree.KERNEL32 ref: 0000022F4B9214D4
GetProcessHeap.KERNEL32 ref: 0000022F4B9214E1
HeapFree.KERNEL32 ref: 0000022F4B9214F0
GetProcessHeap.KERNEL32 ref: 0000022F4B921500

Strings

C:\Windows\system32\svchost.exe, xrefs: 0000022F4B9361A9, 0000022F4B9361B1

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID: C:\Windows\system32\svchost.exe
API String ID: 3168794593-4180442734
Opcode ID: 5f1dcf0d6982f64b78ee420bc41fcee6693c0fdf65c097574d0a291fc3cf39dd
Instruction ID: 7dfe08a534faba01666aadb2be99fbc9db53ae29dd44e0011bdb459922bf7198
Opcode Fuzzy Hash: 5f1dcf0d6982f64b78ee420bc41fcee6693c0fdf65c097574d0a291fc3cf39dd
Instruction Fuzzy Hash: A43161AF90DAD06AE795AFE5DA7D25A3FB0F789F40F09E035DB4403247EAA49414C740

Function 0000022F4B92CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000022F4B92CFAF
FlsSetValue.KERNEL32(?,?,?,0000022F4B92D6B5,?,?,?,?,0000022F4B92D778), ref: 0000022F4B92CFE5
FlsSetValue.KERNEL32(?,?,?,0000022F4B92D6B5,?,?,?,?,0000022F4B92D778), ref: 0000022F4B92D012
FlsSetValue.KERNEL32(?,?,?,0000022F4B92D6B5,?,?,?,?,0000022F4B92D778), ref: 0000022F4B92D023
FlsSetValue.KERNEL32(?,?,?,0000022F4B92D6B5,?,?,?,?,0000022F4B92D778), ref: 0000022F4B92D034
SetLastError.KERNEL32 ref: 0000022F4B92D04F

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: d3266ebbe43a9fec14f105a120a596306493a29438e3ff2f7fd42589a7465f76
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: F511812CE4525461FAEC7FA1D77D36B22716F457B0F140B349A36466EBDDEC8441D200

Function 0000022F4B92199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 0000022F4B9219C2
K32GetModuleFileNameExW.KERNEL32 ref: 0000022F4B9219E0
PathFindFileNameW.SHLWAPI ref: 0000022F4B9219EF
lstrlenW.KERNEL32 ref: 0000022F4B9219FB
StrCpyW.SHLWAPI ref: 0000022F4B921A0E
CloseHandle.KERNEL32 ref: 0000022F4B921A1C

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 004fd8f340ca5b41107a55182fc68f3281f30205b4f9deed366c2bfe8af398c8
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: E9015B25B04A4092FB94EF92E56835A63B1FB8CBC0F488435DF4943756DEBCC559C700

Function 0000022F4B9236C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000022F4B9236E4
GetCurrentProcess.KERNEL32 ref: 0000022F4B9236F2
VirtualProtectEx.KERNEL32 ref: 0000022F4B923714
GetCurrentProcess.KERNEL32 ref: 0000022F4B923732
VirtualProtectEx.KERNEL32 ref: 0000022F4B923753
TerminateThread.KERNEL32 ref: 0000022F4B923762

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 1992661986cf1566927de62f5cca71c9a2d4ed13dfab2835674116920dfabc6b
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: BF013C68E1974096FFA8AF92E92C31733B0BB49B82F044434CE4906766EFBCC048C700

Function 0000022F4B929005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000022F4B929013
_IsNonwritableInCurrentImage.LIBCMT ref: 0000022F4B9290A8
RtlUnwindEx.NTDLL ref: 0000022F4B9290F7

Strings

csm, xrefs: 0000022F4B92908E
f, xrefs: 0000022F4B929026

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 482f879c7e6b7ab2153be2aa01afc45c6a515368fdaac379362e051d810bd858
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 0D51713AE01600AAFB9CAF56E56CB5A27B5F364B88F118938DB064374BD7B9C841C740

Function 0000022F4B928FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000022F4B929013
_IsNonwritableInCurrentImage.LIBCMT ref: 0000022F4B9290A8
RtlUnwindEx.NTDLL ref: 0000022F4B9290F7

Strings

csm, xrefs: 0000022F4B92908E
f, xrefs: 0000022F4B929026

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: ca2171d7c76aee7f477534414f33c5d96a25f7bebd3a1d9c4e6aef0a79c9e0d2
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 37318D39A05640A6F798EF52F96CB1A37B5F754B88F058838EF460378ADBB9C940C704

Function 0000022F4B921A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 0000022F4B921A60
StrCmpNIW.SHLWAPI ref: 0000022F4B921A7A
lstrlenW.KERNEL32 ref: 0000022F4B921A89
StrCpyW.SHLWAPI ref: 0000022F4B921A9E

Strings

\\?\, xrefs: 0000022F4B921A6E

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: 133a9a88c9ce776ca9d3774703c0ae81491e522cc050deba10d5b16b629dbfb0
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: B2F04426B04641A2F7A0AFA1FAA875B6770F74CBC8F845030DB4946556DFBCC65DCB00

Function 0000022F4B923044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 0000022F4B923066
StrCpyW.SHLWAPI ref: 0000022F4B923076
StrCatW.SHLWAPI ref: 0000022F4B923082
PathCombineW.SHLWAPI ref: 0000022F4B923090

Strings

\\.\pipe\, xrefs: 0000022F4B92305C

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 33430503d34f6028afa2e6784cae20d1f33c5f091b07b75320c5c1eaa92182e3
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: AFF05418A1878092EA846F92FA2815A6370AB4CFC0F085130DF464771ADE6CC445C700

Function 0000022F4B92BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 0000022F4B92BCBD
GetProcAddress.KERNEL32 ref: 0000022F4B92BCD3
FreeLibrary.KERNEL32 ref: 0000022F4B92BCFA

Strings

mscoree.dll, xrefs: 0000022F4B92BCB4
CorExitProcess, xrefs: 0000022F4B92BCCC

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 73331a4341462ddd0d7341031c51da7f8e96f244de989222a1b7c81b8d3c4b1d
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 22F0C269A15A04A1FB54AFA8E56C35B2370EB89760F401639CB6A452F6CFBCC088C300

Function 0000022F4B9250D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000022F4B925156

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: 35a1819444abcae43ab1af2435fe22c5b4441829e1bdc6549ee2656936f65343
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: 6602DA36A19B8096E7A4DF95E5A475BB7B1F384780F104425EB8E47BA9DBBCC444CB00

Function 0000022F4B925710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000022F4B925726

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: b2a8a2331181c9d90e6b9cc24cb1e91e3f03e9ebea6c57d9cd61cef64ffbd4e3
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: 2561D73AD19A40D6E6E4AF95E66831B77B0F388784F500535EB8D47BAADBBCC454CB00

Function 0000022F4B934104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000022F4B93412C
_set_statfp.LIBCMT ref: 0000022F4B934147
_set_statfp.LIBCMT ref: 0000022F4B934163
_set_statfp.LIBCMT ref: 0000022F4B93419F

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 7413b50f1ebe62556fd5f8ba29c38d3d2eb0ba9e014ba1d3bf1791436f4138ec
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: F311862AE10E5031F6E47DDCD67F36715606B7C3A4F0AA634AB76067D7C6A4C841C301

Function 0000022F4B903504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000022F4B90352C
_set_statfp.LIBCMT ref: 0000022F4B903547
_set_statfp.LIBCMT ref: 0000022F4B903563
_set_statfp.LIBCMT ref: 0000022F4B90359F

Memory Dump Source

Source File: 0000002C.00000002.2634829706.0000022F4B8F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B8F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b8f0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 58d1251d3a4caaa5be95a61a0ec51b05bc2509f4479b3e5a54803fbfe94b208e
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: C611462AE1CE5131FAD43E98D67D36713B16B5C374F488638AB6A566F786A4C441D100

Function 0000022F4B8FF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000022F4B8FF124

Strings

Tuesday, xrefs: 0000022F4B8FF0F4
Wednesday, xrefs: 0000022F4B8FF1ED
or copy constructor iterator', xrefs: 0000022F4B8FF25A, 0000022F4B8FF275

Memory Dump Source

Source File: 0000002C.00000002.2634829706.0000022F4B8F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B8F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b8f0000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 67c5dc967233ec2ba9eff5d819f7d6002f33cf9720fff51d128b32dc81497d34
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 83617E3AE0224062FAE5BFE4D658B2B36B0E781782F544535DB06137A7FBB4C983C200

Function 0000022F4B92AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 0000022F4B92AA68
_CallSETranslator.LIBVCRUNTIME ref: 0000022F4B92AAB7

Strings

RCC, xrefs: 0000022F4B92AA85
MOC, xrefs: 0000022F4B92AA7C

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 1d628da4b4ef0021f2d30ec3c3050d09a040e4882c757620e9b77fc0d25bb80c
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 3D61793BE00A849AFB54EFA5D25439E77B1F754B88F044625EF4913B9ACBB8C485C700

Function 0000022F4B92AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000022F4B92ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0000022F4B92AE88

Strings

csm, xrefs: 0000022F4B92AEDA
csm, xrefs: 0000022F4B92ADC2

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: faefc77f3f04d8ada6a7abfa0fe30a78de85419a5f34c5658667cfa8b82c1201
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 4C51A07BD006809AFBA8AF91D6A839A77B0F354B94F144935DB4947B96CBBCC452C700

Function 0000022F4B8FA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000022F4B8FA1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0000022F4B8FA288

Strings

csm, xrefs: 0000022F4B8FA1C2
csm, xrefs: 0000022F4B8FA2DA

Memory Dump Source

Source File: 0000002C.00000002.2634829706.0000022F4B8F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B8F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b8f0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 85b8b23fe03455be863dcbd90ee44b4065f943986a77b00014456155e2ef9cbf
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 1351E63AA00280DAEBB4AF95D648B5A77B0F354BA6F144135DB49877C7EBB8C493C700

Function 0000022F4B8F8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000022F4B8F8413
_IsNonwritableInCurrentImage.LIBCMT ref: 0000022F4B8F84A8

Strings

csm, xrefs: 0000022F4B8F848E
f, xrefs: 0000022F4B8F8426

Memory Dump Source

Source File: 0000002C.00000002.2634829706.0000022F4B8F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B8F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b8f0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: ca06418ecc77814415e76949edbbaeb6fd96717694d8294dacc9475fe9ca23cc
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 7B518B3AB01608EBEB94EF55E648F1A37A5F358B99F508134DB164778AFBB4C842C704

Function 0000022F4B8F83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000022F4B8F8413
_IsNonwritableInCurrentImage.LIBCMT ref: 0000022F4B8F84A8

Strings

csm, xrefs: 0000022F4B8F848E
f, xrefs: 0000022F4B8F8426

Memory Dump Source

Source File: 0000002C.00000002.2634829706.0000022F4B8F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B8F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b8f0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: c2f07b366d6af2614ab0022f69670992defa05defc0c15891b58b7cbc29ec9d6
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 9831AF39B01644E7E794EF51E948B1A3BB4F344B89F558034EF5A03786EBB8C942C704

Function 0000022F4B932058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 0000022F4B9320D7
WriteFile.KERNEL32 ref: 0000022F4B93239F
WriteFile.KERNEL32 ref: 0000022F4B9323E5
GetLastError.KERNEL32 ref: 0000022F4B93249B

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: e0f14149c9858a34f957c565355aecc73758d46192fbe9cdae21f52be54db59e
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 75D12436B04A80A9EB95DFF9D65839E3BB1F348798F009235CF5997B9ADA74C406C340

Function 0000022F4B932980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 0000022F4B932A9C
GetLastError.KERNEL32 ref: 0000022F4B932B27

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 57122028f5d53c02883f600eadc49a6396775f81f38f02548465b3eef2a825eb
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: EC91D936F14650A5FF98AFB5D6683AE3BB0B709B88F146139DF0657686DBB8C481C700

Function 0000022F4B927960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 0000022F4B92798C
GetCurrentThreadId.KERNEL32 ref: 0000022F4B92799A
GetCurrentProcessId.KERNEL32 ref: 0000022F4B9279A6
QueryPerformanceCounter.KERNEL32 ref: 0000022F4B9279B6

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 02d1edb0a5e1cca039bca6663e81e070966819762127b03230a92844af748570
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: CB117326B14F1199EB40DFA0E8693A933B4F319758F441E31DB6D467A5DFB8C1A4C380

Function 0000022F4B92253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000022F4B922620
StrCpyW.SHLWAPI ref: 0000022F4B922639

Strings

\\.\pipe\, xrefs: 0000022F4B92262B

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: edd5805ef3becc3b88349778882c95b5b12efe4fc6c6a26829ab48fc4fee1c99
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 3871E62AE0478055FBACBFA5DA683AB77B4F385B84F440836DF0943B96DAB8C544C700

Function 0000022F4B8F9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 0000022F4B8F9EB7

Strings

MOC, xrefs: 0000022F4B8F9E7C
RCC, xrefs: 0000022F4B8F9E85

Memory Dump Source

Source File: 0000002C.00000002.2634829706.0000022F4B8F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B8F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b8f0000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 0ffabecdf41bcabb357420606bdc30180c917a6a9d8feee04490687f31be5e26
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 3761993AA00B44DAEB60EFA5D14479E77B1F394B8DF044225EF4907B9AEBB8C156C700

Function 0000022F4B922330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000022F4B922416
StrCpyW.SHLWAPI ref: 0000022F4B92242D

Strings

\\.\pipe\, xrefs: 0000022F4B922421

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: dfc7ffcc73b3e11647f509b5b3e025f722843702818dd276fee68ac56059c76b
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 8351A12AE08781A1FEACAEA9E27C36B7661F385740F454935DF4903B5ACABDC504C740

Function 0000022F4B9326F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 0000022F4B932807
GetLastError.KERNEL32 ref: 0000022F4B932829

Strings

U, xrefs: 0000022F4B9327B3

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 51a8b5eeb4e5ff50c2e66dde0cc123fdf87a4a6a0d6266f526e22efb781dce26
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 4A41C336B15B8092EB60AF65E5583AA77B0F388794F505031EF4E87795DBBCC441CB40

Function 0000022F4B9294A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 0000022F4B9294F0
RaiseException.KERNEL32 ref: 0000022F4B929531

Strings

csm, xrefs: 0000022F4B92951E

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 541ee36eacddfabf60ee726d306f997b15ea919d41eb024aa812d4f660364ce5
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: DB114936A09B8092EBA49F15F55825A77E0F788B94F184634EF8C07759DF7CC551CB00

Function 0000022F4B8F7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 0000022F4B8F737C

Strings

ierarchy Descriptor', xrefs: 0000022F4B8F7381
riptor at (, xrefs: 0000022F4B8F7364

Memory Dump Source

Source File: 0000002C.00000002.2634829706.0000022F4B8F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B8F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b8f0000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 55c80d3c338a0f90901285bd0ce2c41312c51eb2db4c664788685bd73fbad8fc
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: E2E08661B40B48E1DF419F61E99429973B0DB59B64B8891329A5C46312FA78D1E9C300

Function 0000022F4B8F73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 0000022F4B8F73D8

Strings

riptor at (, xrefs: 0000022F4B8F73C0
Locator', xrefs: 0000022F4B8F73DD

Memory Dump Source

Source File: 0000002C.00000002.2634829706.0000022F4B8F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B8F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b8f0000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 89a22d88f48f7fcc7d6ac2f02ba3dee9c3b8767fa78641d9caf5808c7b310efd
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 41E08661B00B48D0DF419F61D5942997370E759B54B889132CA5C06312FA78D1E9C300

Function 0000022F4B921BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000022F4B921C2D
HeapAlloc.KERNEL32 ref: 0000022F4B921C3B
GetProcessHeap.KERNEL32 ref: 0000022F4B921C77
HeapFree.KERNEL32 ref: 0000022F4B921C85

Part of subcall function 0000022F4B92152C: StrCmpIW.SHLWAPI ref: 0000022F4B92155D

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 7ff828ae3143df2aaebd1ee6216806e1023660a880acafb97f17a6dcd5bd222a
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 14115E29E01B5491EA88EFE6E51822A77B1F789FC0F1850359F4D43766DEB8C462C340

Function 0000022F4B921268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000022F4B92126E
HeapAlloc.KERNEL32 ref: 0000022F4B92127D
GetProcessHeap.KERNEL32 ref: 0000022F4B921297
HeapAlloc.KERNEL32 ref: 0000022F4B9212A8

Memory Dump Source

Source File: 0000002C.00000002.2635230246.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_22f4b920000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 3e1e9a40939542c600504de3384a6c328f8b6d35d2671f485f6e89c9c26a68de
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 6CE03939A0160486EB44AFA2D92834A3AE1EB8DB06F04D0348E0907352DFBD8499C750

Analysis Process: dwm.exePID: 976, Parent PID: 7692COMMON

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	95.1%
Signature Coverage:	0%
Total number of Nodes:	123
Total number of Limit Nodes:	16

Executed Functions

Function 00000262F1CD1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000262F1CD1633
HeapAlloc.KERNEL32 ref: 00000262F1CD1642

Part of subcall function 00000262F1CD1268: GetProcessHeap.KERNEL32 ref: 00000262F1CD126E
Part of subcall function 00000262F1CD1268: HeapAlloc.KERNEL32 ref: 00000262F1CD127D
Part of subcall function 00000262F1CD1268: GetProcessHeap.KERNEL32 ref: 00000262F1CD1297
Part of subcall function 00000262F1CD1268: HeapAlloc.KERNEL32 ref: 00000262F1CD12A8

RegOpenKeyExW.ADVAPI32 ref: 00000262F1CD16B2
RegOpenKeyExW.ADVAPI32 ref: 00000262F1CD16DF
RegCloseKey.ADVAPI32 ref: 00000262F1CD16F9
RegOpenKeyExW.ADVAPI32 ref: 00000262F1CD1719
RegCloseKey.ADVAPI32 ref: 00000262F1CD1734
RegOpenKeyExW.ADVAPI32 ref: 00000262F1CD1754
RegCloseKey.ADVAPI32 ref: 00000262F1CD176F
RegOpenKeyExW.ADVAPI32 ref: 00000262F1CD178F
RegCloseKey.ADVAPI32 ref: 00000262F1CD17AA
RegOpenKeyExW.ADVAPI32 ref: 00000262F1CD17CA
RegCloseKey.ADVAPI32 ref: 00000262F1CD17E5
RegOpenKeyExW.ADVAPI32 ref: 00000262F1CD1805
RegCloseKey.ADVAPI32 ref: 00000262F1CD1820
RegOpenKeyExW.ADVAPI32 ref: 00000262F1CD1840
RegCloseKey.ADVAPI32 ref: 00000262F1CD185B
RegOpenKeyExW.ADVAPI32 ref: 00000262F1CD187B
RegCloseKey.ADVAPI32 ref: 00000262F1CD1896
RegCloseKey.ADVAPI32 ref: 00000262F1CD18A0

Part of subcall function 00000262F1CD12BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000262F1CD1319
Part of subcall function 00000262F1CD12BC: GetProcessHeap.KERNEL32 ref: 00000262F1CD1327
Part of subcall function 00000262F1CD12BC: HeapAlloc.KERNEL32 ref: 00000262F1CD1338
Part of subcall function 00000262F1CD12BC: RegEnumValueW.ADVAPI32 ref: 00000262F1CD1397
Part of subcall function 00000262F1CD12BC: GetProcessHeap.KERNEL32 ref: 00000262F1CD13DF
Part of subcall function 00000262F1CD12BC: HeapAlloc.KERNEL32 ref: 00000262F1CD13ED
Part of subcall function 00000262F1CD12BC: GetProcessHeap.KERNEL32 ref: 00000262F1CD140A
Part of subcall function 00000262F1CD12BC: HeapFree.KERNEL32 ref: 00000262F1CD1418
Part of subcall function 00000262F1CD12BC: lstrlenW.KERNEL32 ref: 00000262F1CD1421
Part of subcall function 00000262F1CD12BC: GetProcessHeap.KERNEL32 ref: 00000262F1CD142F
Part of subcall function 00000262F1CD12BC: HeapAlloc.KERNEL32 ref: 00000262F1CD143D

Strings

process_names, xrefs: 00000262F1CD174D
tcp_local, xrefs: 00000262F1CD17FE
tcp_remote, xrefs: 00000262F1CD1839
startup, xrefs: 00000262F1CD16D5
paths, xrefs: 00000262F1CD1788
SOFTWARE\dialerconfig, xrefs: 00000262F1CD1692
service_names, xrefs: 00000262F1CD17C3
pid, xrefs: 00000262F1CD1712
udp, xrefs: 00000262F1CD1874

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 162cc10300e87f2e0ef0f468f36b720f9018e9fc9290d6ef0c852e4d82a3a8bd
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 0971F736310E31C6EB509F66E89C69937B5F784B88F801121DA9E47FA9DE3AC548C345

Function 00000262F1CD3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00000262F1CD379E
GetCurrentProcess.KERNEL32 ref: 00000262F1CD37CC
VirtualProtectEx.KERNEL32 ref: 00000262F1CD37EE
GetCurrentProcess.KERNEL32 ref: 00000262F1CD3809
VirtualProtectEx.KERNEL32 ref: 00000262F1CD382A

Strings

wr, xrefs: 00000262F1CD37FF

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 2a4f39d000dc5e0ff51a22112409821ed963dcfd8cb1496f1ec10a3734d539db
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 1A11757A310FA0C2EF549B21E40C269B6B0FB88B84F850039DE9A07B94EF3EC509C705

Function 00000262F1CD5B30 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00000262F1CD5B6B
GetThreadContext.KERNEL32 ref: 00000262F1CD5CD5

Part of subcall function 00000262F1CD5960: GetCurrentThreadId.KERNEL32 ref: 00000262F1CD5964

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 1583aff86c60747e20c7fd7e292354d5b69db1aa669fd640e36c9be7a05cd15b
Instruction ID: f515dcaf2d8ca959d8117a1283b462ed4ccb653c08f730e0e3b6dd192dd2003e
Opcode Fuzzy Hash: 1583aff86c60747e20c7fd7e292354d5b69db1aa669fd640e36c9be7a05cd15b
Instruction Fuzzy Hash: 74D19676204F98C1DA609B0AE49835AB7B0F388B84F504226EE9E47FA9DF3DC555CF11

Function 00000262F1CD50D0 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00000262F1CD5156

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 6db5c12ccb82f3d6f97d4eb5dd3bfd24aa6d026fde54f3ba11af0dc7faceaf78
Instruction ID: b2b6570a131ed07fa27134079986df203cba60a0634c7f222d769f1e73e1ebbf
Opcode Fuzzy Hash: 6db5c12ccb82f3d6f97d4eb5dd3bfd24aa6d026fde54f3ba11af0dc7faceaf78
Instruction Fuzzy Hash: A902A536219B94C6EB60CB55E49835AB7B0F3C4B94F504026EA9E87FA8DF79C458CF01

Function 00000262F1CD39E0 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 00000262F1CD3A66
VirtualAlloc.KERNEL32 ref: 00000262F1CD3AA0

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction ID: f5d4ca8b0c7221f02f22334eb3d859529a50ccd313fad52f8f1fe78a8b9eb8bc
Opcode Fuzzy Hash: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction Fuzzy Hash: E3312B72719E94C1EA309A55E44E35AB6B0F388784F901535F5DF06FE8DB7EC1888B06

Function 00000262F1CD328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000262F1CD32AE
PathFindFileNameW.SHLWAPI ref: 00000262F1CD32BD

Part of subcall function 00000262F1CD3844: StrCmpNIW.SHLWAPI ref: 00000262F1CD385C

Part of subcall function 00000262F1CD3790: GetModuleHandleW.KERNEL32 ref: 00000262F1CD379E
Part of subcall function 00000262F1CD3790: GetCurrentProcess.KERNEL32 ref: 00000262F1CD37CC
Part of subcall function 00000262F1CD3790: VirtualProtectEx.KERNEL32 ref: 00000262F1CD37EE
Part of subcall function 00000262F1CD3790: GetCurrentProcess.KERNEL32 ref: 00000262F1CD3809
Part of subcall function 00000262F1CD3790: VirtualProtectEx.KERNEL32 ref: 00000262F1CD382A

CreateThread.KERNEL32 ref: 00000262F1CD330B

Part of subcall function 00000262F1CD1D14: GetCurrentThread.KERNEL32 ref: 00000262F1CD1D1F

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 1cb0b201c473f7d4aa60c0edbe03fa02cc738559a98e3751f0b64c66dd15a5c1
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 3911ADB1620E31C2FB60AB20FA0D36AB2B4A744B04FC06139D96781ED1EF7BC14D8217

Function 00000262F1CD4DF0 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00000262F1CD4DF4
VirtualProtect.KERNEL32 ref: 00000262F1CD4E37
FlushInstructionCache.KERNEL32 ref: 00000262F1CD4E4C

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: b4082a11bd8fc7a0e50fa8074e04b9b5eee935061857b93c3988384488003b51
Instruction ID: 69158a12e240613d168a8efeae7f989a42e166dd776a10eb5d72f847b8422932
Opcode Fuzzy Hash: b4082a11bd8fc7a0e50fa8074e04b9b5eee935061857b93c3988384488003b51
Instruction Fuzzy Hash: 6AF01D36218F14C0D6319B02E44935ABBB0E388BD4F940121FA9E03FA9CA3AC5988F01

Function 00000262F1CA273C Relevance: 3.2, APIs: 2, Instructions: 187
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00000262F1CA27DB
LoadLibraryA.KERNELBASE ref: 00000262F1CA285E

Memory Dump Source

Source File: 0000002D.00000002.2670820791.00000262F1CA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1ca0000_dwm.jbxd

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: a34336a910fdf5e8fe98ec8d4af113be88c168f61e4fe22353fc71cdf5eec74a
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 51610532B01AB0C7DB55CF25902C72DB3A2F754BA4F988139DE5907BC8DA39D856E701

Function 00000262F1CD1ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000262F1CD1628: GetProcessHeap.KERNEL32 ref: 00000262F1CD1633
Part of subcall function 00000262F1CD1628: HeapAlloc.KERNEL32 ref: 00000262F1CD1642
Part of subcall function 00000262F1CD1628: RegOpenKeyExW.ADVAPI32 ref: 00000262F1CD16B2
Part of subcall function 00000262F1CD1628: RegOpenKeyExW.ADVAPI32 ref: 00000262F1CD16DF
Part of subcall function 00000262F1CD1628: RegCloseKey.ADVAPI32 ref: 00000262F1CD16F9
Part of subcall function 00000262F1CD1628: RegOpenKeyExW.ADVAPI32 ref: 00000262F1CD1719
Part of subcall function 00000262F1CD1628: RegCloseKey.ADVAPI32 ref: 00000262F1CD1734
Part of subcall function 00000262F1CD1628: RegOpenKeyExW.ADVAPI32 ref: 00000262F1CD1754
Part of subcall function 00000262F1CD1628: RegCloseKey.ADVAPI32 ref: 00000262F1CD176F
Part of subcall function 00000262F1CD1628: RegOpenKeyExW.ADVAPI32 ref: 00000262F1CD178F
Part of subcall function 00000262F1CD1628: RegCloseKey.ADVAPI32 ref: 00000262F1CD17AA
Part of subcall function 00000262F1CD1628: RegOpenKeyExW.ADVAPI32 ref: 00000262F1CD17CA

Sleep.KERNEL32 ref: 00000262F1CD1AD7
SleepEx.KERNELBASE ref: 00000262F1CD1ADD

Part of subcall function 00000262F1CD1628: RegCloseKey.ADVAPI32 ref: 00000262F1CD17E5
Part of subcall function 00000262F1CD1628: RegOpenKeyExW.ADVAPI32 ref: 00000262F1CD1805
Part of subcall function 00000262F1CD1628: RegCloseKey.ADVAPI32 ref: 00000262F1CD1820
Part of subcall function 00000262F1CD1628: RegOpenKeyExW.ADVAPI32 ref: 00000262F1CD1840
Part of subcall function 00000262F1CD1628: RegCloseKey.ADVAPI32 ref: 00000262F1CD185B
Part of subcall function 00000262F1CD1628: RegOpenKeyExW.ADVAPI32 ref: 00000262F1CD187B
Part of subcall function 00000262F1CD1628: RegCloseKey.ADVAPI32 ref: 00000262F1CD1896
Part of subcall function 00000262F1CD1628: RegCloseKey.ADVAPI32 ref: 00000262F1CD18A0

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: dd08e81586b102c995daeeeea5f39df5e02c09987114728e66334726611cffdb
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 1431DDB1200E62D1FB549B26DA5D3A933B4AB44FC0F8854319E2B87ED6FF16C459C312

Non-executed Functions

Function 00000262F1CD2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000262F1CD2BD0
lstrlenW.KERNEL32 ref: 00000262F1CD2E0A

Part of subcall function 00000262F1CD199C: OpenProcess.KERNEL32 ref: 00000262F1CD19C2
Part of subcall function 00000262F1CD199C: K32GetModuleFileNameExW.KERNEL32 ref: 00000262F1CD19E0
Part of subcall function 00000262F1CD199C: PathFindFileNameW.SHLWAPI ref: 00000262F1CD19EF
Part of subcall function 00000262F1CD199C: lstrlenW.KERNEL32 ref: 00000262F1CD19FB
Part of subcall function 00000262F1CD199C: StrCpyW.SHLWAPI ref: 00000262F1CD1A0E
Part of subcall function 00000262F1CD199C: CloseHandle.KERNEL32 ref: 00000262F1CD1A1C

GetProcAddress.KERNEL32 ref: 00000262F1CD2BE5

Part of subcall function 00000262F1CD152C: StrCmpIW.SHLWAPI ref: 00000262F1CD155D

Part of subcall function 00000262F1CD3844: StrCmpNIW.SHLWAPI ref: 00000262F1CD385C

StrCmpNIW.SHLWAPI ref: 00000262F1CD2C28
lstrlenW.KERNEL32 ref: 00000262F1CD2D50

Strings

NtQueryObject, xrefs: 00000262F1CD2BDB
ntdll.dll, xrefs: 00000262F1CD2BC9
\Device\Nsi, xrefs: 00000262F1CD2C1B

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: a177fddec4b88f16ad46b532f8d0131db3d251d55888a683a3291251559f78e9
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 9BB16C72210E60C6EB689F25D44C7A9B3B5F744B85F84502AEE5A53FD4EB36CC48C742

Function 00000262F1CD7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000262F1CD7DAC
RtlCaptureContext.NTDLL ref: 00000262F1CD7DD9
RtlLookupFunctionEntry.NTDLL ref: 00000262F1CD7DF3
RtlVirtualUnwind.NTDLL ref: 00000262F1CD7E34
IsDebuggerPresent.KERNEL32 ref: 00000262F1CD7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 00000262F1CD7EA9
UnhandledExceptionFilter.KERNEL32 ref: 00000262F1CD7EB4

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: efcd35b1337ab5df1fe294d76f9b706763eb5fa9cb9746bd727f4cee349ea837
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: DA311972215FA0CAEB609F61E8487ED7374F784748F84442ADA8E57B98EF39C548C711

Function 00000262F1CDD2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000262F1CDD31D
RtlLookupFunctionEntry.NTDLL ref: 00000262F1CDD335
RtlVirtualUnwind.NTDLL ref: 00000262F1CDD370
IsDebuggerPresent.KERNEL32 ref: 00000262F1CDD3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 00000262F1CDD3B3
UnhandledExceptionFilter.KERNEL32 ref: 00000262F1CDD3BE

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: da021ba86110892effe39d4fc11828f8e823c15a7bb22e1c0f27b3b3a58a8297
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: CB314F36214F90C6DB60CF25E8483AE73B4F789B54F940125EA9E43B98DF39C559CB01

Function 00000262F1CD12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000262F1CD1319
GetProcessHeap.KERNEL32 ref: 00000262F1CD1327
HeapAlloc.KERNEL32 ref: 00000262F1CD1338
RegEnumValueW.ADVAPI32 ref: 00000262F1CD1397

Part of subcall function 00000262F1CD152C: StrCmpIW.SHLWAPI ref: 00000262F1CD155D

GetProcessHeap.KERNEL32 ref: 00000262F1CD13DF
HeapAlloc.KERNEL32 ref: 00000262F1CD13ED
GetProcessHeap.KERNEL32 ref: 00000262F1CD140A
HeapFree.KERNEL32 ref: 00000262F1CD1418
lstrlenW.KERNEL32 ref: 00000262F1CD1421
GetProcessHeap.KERNEL32 ref: 00000262F1CD142F
HeapAlloc.KERNEL32 ref: 00000262F1CD143D
StrCpyW.SHLWAPI ref: 00000262F1CD145F
GetProcessHeap.KERNEL32 ref: 00000262F1CD1476
HeapFree.KERNEL32 ref: 00000262F1CD1484

Strings

d, xrefs: 00000262F1CD135A

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 8b2d74f67ada98dcabe44bd247889f986e2a56db0fc33629ede240e1049ec8c9
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: AE512736210BA5C6EB55CF62E54C39AB7B1F789F99F844124DA8A07B98DF3DC049CB01

Function 00000262F1CD1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000262F1CD1D1F

Part of subcall function 00000262F1CD1FD4: GetModuleHandleA.KERNEL32 ref: 00000262F1CD1FEC
Part of subcall function 00000262F1CD1FD4: GetProcAddress.KERNEL32 ref: 00000262F1CD1FFD

Part of subcall function 00000262F1CD5B30: GetCurrentThreadId.KERNEL32 ref: 00000262F1CD5B6B

Strings

EnumServicesStatusExW, xrefs: 00000262F1CD1E11, 00000262F1CD1E32
NtResumeThread, xrefs: 00000262F1CD1D62
advapi32.dll, xrefs: 00000262F1CD1DF7, 00000262F1CD1E18
ntdll.dll, xrefs: 00000262F1CD1D2D
NtQueryDirectoryFile, xrefs: 00000262F1CD1D7F
sechost.dll, xrefs: 00000262F1CD1E39
NtEnumerateValueKey, xrefs: 00000262F1CD1DD6
NtEnumerateKey, xrefs: 00000262F1CD1DB9
NtQueryDirectoryFileEx, xrefs: 00000262F1CD1D9C
NtQuerySystemInformation, xrefs: 00000262F1CD1D45
NtDeviceIoControlFile, xrefs: 00000262F1CD1E56
EnumServiceGroupW, xrefs: 00000262F1CD1DF0

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 3a74d2599801aa6a1e11c32b3677720e74a77169cd2eab6a390e9b77b6f4c89c
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: C0316D74610E6AE0FA04EBA9E85D7E87331A714744FC05077D86A07DE6EE7AC24DC362

Function 00000262F1CA6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000262F1CA6938
__scrt_acquire_startup_lock.LIBCMT ref: 00000262F1CA698A
_RTC_Initialize.LIBCMT ref: 00000262F1CA69B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000262F1CA69DE
__scrt_release_startup_lock.LIBCMT ref: 00000262F1CA6A09

Strings

`eh vector copy constructor iterator', xrefs: 00000262F1CA6A3B
`dynamic initializer for ', xrefs: 00000262F1CA69C7
`eh vector vbase copy constructor iterator', xrefs: 00000262F1CA69EE
scriptor', xrefs: 00000262F1CA6B39, 00000262F1CA6BB2, 00000262F1CA6BEC

Memory Dump Source

Source File: 0000002D.00000002.2670820791.00000262F1CA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1ca0000_dwm.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 0e9dfa9ba647b6cb2cca73de8109350fb044866cc330f2674e80b782b893b8e3
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 4A81B131700E71C6FA529B66947D39962F0A785F80FD480359A8987FD7DB3BC84E8702

Function 00000262F1CDCE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00000262F1CDCE37
FlsGetValue.KERNEL32(?,?,?,00000262F1CE0A6B,?,?,?,00000262F1CE045C,?,?,?,00000262F1CDC84F), ref: 00000262F1CDCE4C
FlsSetValue.KERNEL32(?,?,?,00000262F1CE0A6B,?,?,?,00000262F1CE045C,?,?,?,00000262F1CDC84F), ref: 00000262F1CDCE6D
FlsSetValue.KERNEL32(?,?,?,00000262F1CE0A6B,?,?,?,00000262F1CE045C,?,?,?,00000262F1CDC84F), ref: 00000262F1CDCE9A
FlsSetValue.KERNEL32(?,?,?,00000262F1CE0A6B,?,?,?,00000262F1CE045C,?,?,?,00000262F1CDC84F), ref: 00000262F1CDCEAB
FlsSetValue.KERNEL32(?,?,?,00000262F1CE0A6B,?,?,?,00000262F1CE045C,?,?,?,00000262F1CDC84F), ref: 00000262F1CDCEBC
SetLastError.KERNEL32 ref: 00000262F1CDCED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000262F1CE0A6B,?,?,?,00000262F1CE045C,?,?,?,00000262F1CDC84F), ref: 00000262F1CDCF0D
FlsSetValue.KERNEL32(?,?,00000001,00000262F1CDECCC,?,?,?,?,00000262F1CDBF9F,?,?,?,?,?,00000262F1CD7AB0), ref: 00000262F1CDCF2C

Part of subcall function 00000262F1CDD6CC: HeapAlloc.KERNEL32 ref: 00000262F1CDD721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000262F1CE0A6B,?,?,?,00000262F1CE045C,?,?,?,00000262F1CDC84F), ref: 00000262F1CDCF54

Part of subcall function 00000262F1CDD744: HeapFree.KERNEL32 ref: 00000262F1CDD75A
Part of subcall function 00000262F1CDD744: GetLastError.KERNEL32 ref: 00000262F1CDD764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000262F1CE0A6B,?,?,?,00000262F1CE045C,?,?,?,00000262F1CDC84F), ref: 00000262F1CDCF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000262F1CE0A6B,?,?,?,00000262F1CE045C,?,?,?,00000262F1CDC84F), ref: 00000262F1CDCF76

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: d06c3d33f0f0fd0271a37b1289249116d06ceeb430432acfb907694d34498e0a
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: FD414170341E64C1FA69A735955D36D32B1AB847B0FD40B38AA3746ED6DE2B940B820B

Function 00000262F1CD2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000262F1CD2259
GetCurrentProcessId.KERNEL32 ref: 00000262F1CD2263

Part of subcall function 00000262F1CD1934: OpenProcess.KERNEL32 ref: 00000262F1CD1952
Part of subcall function 00000262F1CD1934: IsWow64Process.KERNEL32 ref: 00000262F1CD1968
Part of subcall function 00000262F1CD1934: CloseHandle.KERNEL32 ref: 00000262F1CD1983

CreateFileW.KERNEL32 ref: 00000262F1CD22BC
WriteFile.KERNEL32 ref: 00000262F1CD22E4
ReadFile.KERNEL32 ref: 00000262F1CD2303
CloseHandle.KERNEL32 ref: 00000262F1CD230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 00000262F1CD228C
\\.\pipe\dialerchildproc32, xrefs: 00000262F1CD2293

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 0ea8ddb42258dda75713cf8af91465ce8e8a78f01ede03bf60da084cf4e0b9be
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: F9213D32624B60C2FB10CB25E44C35977B0F789BA4F900225EA9A03EE8CF3DC549CB01

Function 00000262F1CDA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000262F1CDA5A1

Part of subcall function 00000262F1CDB414: __GetUnwindTryBlock.LIBCMT ref: 00000262F1CDB457
Part of subcall function 00000262F1CDB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000262F1CDB47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000262F1CDA679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000262F1CDA8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000262F1CDA9DA

Strings

csm, xrefs: 00000262F1CDA5BB
csm, xrefs: 00000262F1CDA69C
csm, xrefs: 00000262F1CDA622

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: 58bbee964291ef7a1c134da0f52c8e406f854176cdcd209ea994e6a8979c7ea1
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: E5E19D76600BA0CAEB609F25D48D39D77B0F785B98F900126EEAA57FD5CB35C089C702

Function 00000262F1CA9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000262F1CA99A1

Part of subcall function 00000262F1CAA814: __GetUnwindTryBlock.LIBCMT ref: 00000262F1CAA857
Part of subcall function 00000262F1CAA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000262F1CAA87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000262F1CA9A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000262F1CA9CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000262F1CA9DDA

Strings

csm, xrefs: 00000262F1CA9A22
csm, xrefs: 00000262F1CA99BB
csm, xrefs: 00000262F1CA9A9C

Memory Dump Source

Source File: 0000002D.00000002.2670820791.00000262F1CA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1ca0000_dwm.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 6b38e376778b149bdc4c3b380cedac2756958ca53bbab11c65d89ff85828ace3
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: C4E1AD32600F60CAEB628B65D4AE39D77B0F745B88F900125EE8987FD9CB35C499C742

Function 00000262F1CDF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00000262F1CDF510
GetProcAddress.KERNEL32 ref: 00000262F1CDF51C

Strings

api-ms-, xrefs: 00000262F1CDF45A
ext-ms-, xrefs: 00000262F1CDF46D

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 971e2b2f94565b96c39bb62ced53fa46b29d5b9aeb7626148599951c3138b5b8
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: D7418132311E20D1EA1ACB56A80C75973B5BB45BA0F8541399D2B97BC4EF3AC44E8356

Function 00000262F1CD104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000262F1CD10B1
RegEnumValueW.ADVAPI32 ref: 00000262F1CD1117
GetProcessHeap.KERNEL32 ref: 00000262F1CD115A
HeapAlloc.KERNEL32 ref: 00000262F1CD1168
GetProcessHeap.KERNEL32 ref: 00000262F1CD1185
HeapFree.KERNEL32 ref: 00000262F1CD1193

Strings

d, xrefs: 00000262F1CD10D6

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 2efe49ca40e7873f17f2b68a3be79d0dbfb95e7132eac6a5a2eb20c80eeaff34
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 47416D33214F94C6E760CF61E44879E77B1F389B98F848129DA8A07B98DF39C589CB41

Function 00000262F1CDD068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00000262F1CDC7DE,?,?,?,?,?,?,?,?,00000262F1CDCF9D,?,?,00000001), ref: 00000262F1CDD087
FlsSetValue.KERNEL32(?,?,?,00000262F1CDC7DE,?,?,?,?,?,?,?,?,00000262F1CDCF9D,?,?,00000001), ref: 00000262F1CDD0A6
FlsSetValue.KERNEL32(?,?,?,00000262F1CDC7DE,?,?,?,?,?,?,?,?,00000262F1CDCF9D,?,?,00000001), ref: 00000262F1CDD0CE
FlsSetValue.KERNEL32(?,?,?,00000262F1CDC7DE,?,?,?,?,?,?,?,?,00000262F1CDCF9D,?,?,00000001), ref: 00000262F1CDD0DF
FlsSetValue.KERNEL32(?,?,?,00000262F1CDC7DE,?,?,?,?,?,?,?,?,00000262F1CDCF9D,?,?,00000001), ref: 00000262F1CDD0F0

Strings

Y%, xrefs: 00000262F1CDD0A6
1%, xrefs: 00000262F1CDD0CE

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 820928b7479fd351fce2649da040f22c56de618b943f07477389abe3c93ddb75
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: 43116370B04E64C1FA685735995D3797171AB847F0FD44335983B06EDADE2BD40B8202

Function 00000262F1CD7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000262F1CD7538
__scrt_acquire_startup_lock.LIBCMT ref: 00000262F1CD758A
_RTC_Initialize.LIBCMT ref: 00000262F1CD75B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000262F1CD75DE
__scrt_release_startup_lock.LIBCMT ref: 00000262F1CD7609

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 7211ad9d6946ce46b383be27fe99703570c9c10e6a01704c1e265bb96fdcd71e
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: B581E431600F71C6FA50AB67984E35932B0A785B88FD54435996A43FD6EB3BC84D8703

Function 00000262F1CD9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000262F1CD9E49
GetLastError.KERNEL32 ref: 00000262F1CD9E57
LoadLibraryExW.KERNEL32 ref: 00000262F1CD9E81
FreeLibrary.KERNEL32 ref: 00000262F1CD9EC7
GetProcAddress.KERNEL32 ref: 00000262F1CD9ED3

Strings

api-ms-, xrefs: 00000262F1CD9E69

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 594f1bafc856d3893149251d18731171b5591d061620a8c510eaacab37603846
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 4B31B035212E60E1EE129B46A45C75972B4B748BA0F9906359D7F0BFD0DF3AC449C302

Function 00000262F1CE3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000262F1CE3DE5
GetLastError.KERNEL32 ref: 00000262F1CE3DF1
CloseHandle.KERNEL32 ref: 00000262F1CE3E09
CreateFileW.KERNEL32 ref: 00000262F1CE3E34
WriteConsoleW.KERNEL32 ref: 00000262F1CE3E53

Strings

CONOUT$, xrefs: 00000262F1CE3E15

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 14673d5ced4b66fc83c68de323fbdd6b1489ff4b37213dfb289c5fd47534d038
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: FF114F31320FA0C6E7508B56E85C31976B0F788FE5F844235EA9A87BE4DF7AC9188745

Function 00000262F1CD2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000262F1CD2F27
HeapAlloc.KERNEL32 ref: 00000262F1CD2F3A
StrCmpNIW.SHLWAPI ref: 00000262F1CD2FAF
GetProcessHeap.KERNEL32 ref: 00000262F1CD3015
HeapFree.KERNEL32 ref: 00000262F1CD3023

Strings

dialer, xrefs: 00000262F1CD2FA8

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 64c08a5114c7a6086307fb48856dbc9f686564c89c43232cf22d0abf90b4150b
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 7D318B32701F71C2EA15DF56A54C769B7B0FB44B80F8884389E9A47F95EB3AD4A98301

Function 00000262F1CD14A4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000262F1CD14C5
HeapFree.KERNEL32 ref: 00000262F1CD14D4
GetProcessHeap.KERNEL32 ref: 00000262F1CD14E1
HeapFree.KERNEL32 ref: 00000262F1CD14F0
GetProcessHeap.KERNEL32 ref: 00000262F1CD1500

Strings

C:\Windows\system32\dwm.exe, xrefs: 00000262F1CE61A9, 00000262F1CE61B1

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: Heap$Process$Free
String ID: C:\Windows\system32\dwm.exe
API String ID: 3168794593-3609004125
Opcode ID: 5f1dcf0d6982f64b78ee420bc41fcee6693c0fdf65c097574d0a291fc3cf39dd
Instruction ID: 44e1152b7863bb9b5c3f84e982e3eb927e907ea64dad4eee753e5f4e4bebec2d
Opcode Fuzzy Hash: 5f1dcf0d6982f64b78ee420bc41fcee6693c0fdf65c097574d0a291fc3cf39dd
Instruction Fuzzy Hash: F4318FB7529FF0CAE7568BB5985D2492FB0F785F40F899035DAC503AC7EA2AC4088702

Function 00000262F1CDCFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000262F1CDCFAF
FlsSetValue.KERNEL32(?,?,?,00000262F1CDD6B5,?,?,?,?,00000262F1CDD778), ref: 00000262F1CDCFE5
FlsSetValue.KERNEL32(?,?,?,00000262F1CDD6B5,?,?,?,?,00000262F1CDD778), ref: 00000262F1CDD012
FlsSetValue.KERNEL32(?,?,?,00000262F1CDD6B5,?,?,?,?,00000262F1CDD778), ref: 00000262F1CDD023
FlsSetValue.KERNEL32(?,?,?,00000262F1CDD6B5,?,?,?,?,00000262F1CDD778), ref: 00000262F1CDD034
SetLastError.KERNEL32 ref: 00000262F1CDD04F

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: d6b5690b273dde7f86d1aef24005c9843eb03217595945b6431cec2bc08f3bdb
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: 1C115C30700EA0C1FA68A731954D37932B2AB847F0F944738A93747EDADE2BD40A8206

Function 00000262F1CD199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000262F1CD19C2
K32GetModuleFileNameExW.KERNEL32 ref: 00000262F1CD19E0
PathFindFileNameW.SHLWAPI ref: 00000262F1CD19EF
lstrlenW.KERNEL32 ref: 00000262F1CD19FB
StrCpyW.SHLWAPI ref: 00000262F1CD1A0E
CloseHandle.KERNEL32 ref: 00000262F1CD1A1C

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 4e5e5c9f592a94b35fcc19fc5a254d532979f6271d4486124a607123559c275e
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: ED013531310EA1C2EA60DB52A84C35A63B1B788FC0F884035DE9A43B94DE3AC9898701

Function 00000262F1CD36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000262F1CD36E4
GetCurrentProcess.KERNEL32 ref: 00000262F1CD36F2
VirtualProtectEx.KERNEL32 ref: 00000262F1CD3714
GetCurrentProcess.KERNEL32 ref: 00000262F1CD3732
VirtualProtectEx.KERNEL32 ref: 00000262F1CD3753
TerminateThread.KERNEL32 ref: 00000262F1CD3762

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 6cba21a4af934833e3eb2d3d44d937bf6f4740555bc069a1712a68904c824b22
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 3A01F375221F60C2EB249B61E80C31976B0BB49B86F850439C99A07BA4EF3EC50C8716

Function 00000262F1CD8FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000262F1CD9013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000262F1CD90A8
RtlUnwindEx.NTDLL ref: 00000262F1CD90F7

Strings

csm, xrefs: 00000262F1CD908E
f, xrefs: 00000262F1CD9026

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: 308ce32e7411e87eab6d2806d4a3004e8ba28075277838c5d5c20db3d123e404
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: B451D13A311A20C6EB14DF25E85CB6937B6F345B88F908138DA6743BC8DB36D848C702

Function 00000262F1CD1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000262F1CD1A60
StrCmpNIW.SHLWAPI ref: 00000262F1CD1A7A
lstrlenW.KERNEL32 ref: 00000262F1CD1A89
StrCpyW.SHLWAPI ref: 00000262F1CD1A9E

Strings

\\?\, xrefs: 00000262F1CD1A6E

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: f82c31242e31d407b2306c6930e02845cac712b6177922ae2e0cb7a41ec940b0
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 33F03C32714A61D2EB608B61E8CC75967B0F748B98FC44030DA8A46D94DB2EC68DCB01

Function 00000262F1CDBC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000262F1CDBCBD
GetProcAddress.KERNEL32 ref: 00000262F1CDBCD3
FreeLibrary.KERNEL32 ref: 00000262F1CDBCFA

Strings

CorExitProcess, xrefs: 00000262F1CDBCCC
mscoree.dll, xrefs: 00000262F1CDBCB4

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: b440c6b17e2f2db1e5b56e6d9735305995e3fe1d05fd780c0ed9454c074bdac1
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 88F06D71221F24C1EB148F25E84D3696370FB89BA5F940229CAAB46AE4CF2EC14C8742

Function 00000262F1CD3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 00000262F1CD3066
StrCpyW.SHLWAPI ref: 00000262F1CD3076
StrCatW.SHLWAPI ref: 00000262F1CD3082
PathCombineW.SHLWAPI ref: 00000262F1CD3090

Strings

\\.\pipe\, xrefs: 00000262F1CD305C

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: df11b0761cea6230b71b1c40b6af23e9633ad912a449cec17baf7e3fbe88cbd0
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: EDF05870324FA0C2EA108B12B90C129A270AB48FD0F889130EE9A07F98DF29C4498701

Function 00000262F1CD5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000262F1CD5726

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 4678552974c2dc3df73a17a4dcf6fd2c3d7689486890f7c1069e8590a64c51b2
Instruction ID: c5e72abcfce9d79b8b7567304ceb78ee16b8cd055a3aa9df2eaf4005f17435df
Opcode Fuzzy Hash: 4678552974c2dc3df73a17a4dcf6fd2c3d7689486890f7c1069e8590a64c51b2
Instruction Fuzzy Hash: 4E619536529F94C6E6608B16E44D31AB7F0F388784F910126EA9E47FA8DB7AC4598F01

Function 00000262F1CE4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000262F1CE412C
_set_statfp.LIBCMT ref: 00000262F1CE4147
_set_statfp.LIBCMT ref: 00000262F1CE4163
_set_statfp.LIBCMT ref: 00000262F1CE419F

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 952807aa8fc61c7a0db381fec0d1238efe038242c98caa6c498a4c6b26e50c80
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: E2117332B10F7391FE7415A8D45D3A511716BBC3B8FD90634A976C7ED6DA2AC8498302

Function 00000262F1CB3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000262F1CB352C
_set_statfp.LIBCMT ref: 00000262F1CB3547
_set_statfp.LIBCMT ref: 00000262F1CB3563
_set_statfp.LIBCMT ref: 00000262F1CB359F

Memory Dump Source

Source File: 0000002D.00000002.2670820791.00000262F1CA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1ca0000_dwm.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 86fd9da19b3e7711020116dfbdbff4163035235e29876a1cd1bb7a4f50a89112
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: AA110672A10E31D1FB64D169E45D36910A06B68370FC8A738ED76C6FD7CB26C84C4212

Function 00000262F1CAF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000262F1CAF124

Strings

or copy constructor iterator', xrefs: 00000262F1CAF25A, 00000262F1CAF275
Tuesday, xrefs: 00000262F1CAF0F4
Wednesday, xrefs: 00000262F1CAF1ED

Memory Dump Source

Source File: 0000002D.00000002.2670820791.00000262F1CA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1ca0000_dwm.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 2693d75cc8a488b232686ff892eab7a8759045e31ec2c5ca6fae8e57f74764f9
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: D861B536600E60C2FA6F9BA5D56C36E6AB1E785780FD14535CA0A13FE5DB36D84D8303

Function 00000262F1CDAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000262F1CDAA68
_CallSETranslator.LIBVCRUNTIME ref: 00000262F1CDAAB7

Strings

RCC, xrefs: 00000262F1CDAA85
MOC, xrefs: 00000262F1CDAA7C

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: e1a20fd508caf8a5f6765fb50d681b03690da12f7eb7d60a8bb628ac6abbe8ef
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 78616736600F94CAEB20DF65D48839D77B0F384B98F444226EF5A17B98DB39C599C702

Function 00000262F1CDAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000262F1CDADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000262F1CDAE88

Strings

csm, xrefs: 00000262F1CDADC2
csm, xrefs: 00000262F1CDAEDA

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: e5ed4b0152f49c0584dddd997cf4ef3ea3f20a19e60deff956db04587ce3b8b6
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: B3518E72100AA0CAEB648F25948C35D77B0F354B85F944165DAAA47FD5CB39D469C702

Function 00000262F1CAA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000262F1CAA1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000262F1CAA288

Strings

csm, xrefs: 00000262F1CAA2DA
csm, xrefs: 00000262F1CAA1C2

Memory Dump Source

Source File: 0000002D.00000002.2670820791.00000262F1CA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1ca0000_dwm.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: cc31e3b1dfcfdf7aeedbaa52416e1423e52d3f8c216e73a053aa67470b5f28ef
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 7D51C132100BA0CAEB758F55946C35C77B0F359B84F984226DB8987FD5CB7AD46AC702

Function 00000262F1CA8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000262F1CA8413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000262F1CA84A8

Strings

csm, xrefs: 00000262F1CA848E
f, xrefs: 00000262F1CA8426

Memory Dump Source

Source File: 0000002D.00000002.2670820791.00000262F1CA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1ca0000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: efbe961e6b335ef7d56e398f86f0b5f3ec05cd67d3f30bdc0fa12f15912bc9e8
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 5F51AE32A11A20CBEB56DB16E46CB1937B5F354B99F908134DE9643BCCEB36C8498706

Function 00000262F1CA83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000262F1CA8413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000262F1CA84A8

Strings

csm, xrefs: 00000262F1CA848E
f, xrefs: 00000262F1CA8426

Memory Dump Source

Source File: 0000002D.00000002.2670820791.00000262F1CA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1ca0000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 05a2582f9f2a6767bc9f2ee15fce962ba51685f6fc6f45ca99ea4af669743e36
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 3131AF31601A60DBE716DF12E86C71937B4F340B89F858028EE9B43BC9DB3AC949C706

Function 00000262F1CE2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000262F1CE20D7
WriteFile.KERNEL32 ref: 00000262F1CE239F
WriteFile.KERNEL32 ref: 00000262F1CE23E5
GetLastError.KERNEL32 ref: 00000262F1CE249B

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 8d17b31efa7475d674c976f0faebc428cce531d4e84e975da1d5a3a3e9c3de9e
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 04D1F272714AA0C9E711CFB9D44839C3BB1F354B98F84422ACE5AA7FD9DA36C50AC741

Function 00000262F1CE2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00000262F1CE2A9C
GetLastError.KERNEL32 ref: 00000262F1CE2B27

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 9cfef866bf38972d2de149b9677fc042e8c1b929b052f182c3db5e27ed9b98a4
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: C891BD72B10E70C5FB609F65948C3AD2BB0B744B88F94512DDE4A67EC5DB36C48AC702

Function 00000262F1CD7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000262F1CD798C
GetCurrentThreadId.KERNEL32 ref: 00000262F1CD799A
GetCurrentProcessId.KERNEL32 ref: 00000262F1CD79A6
QueryPerformanceCounter.KERNEL32 ref: 00000262F1CD79B6

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: e01a779cea9c93616cd5f610ee93c3cd7353dec22c12f9fd5c10b425570b4b5e
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 81112E32710F21C9EB00CF61E8593A833B4F759B68F841E35DA6D46BA4DB79C1988381

Function 00000262F1CD253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000262F1CD2620
StrCpyW.SHLWAPI ref: 00000262F1CD2639

Strings

\\.\pipe\, xrefs: 00000262F1CD262B

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 89e297436789c9c4a704c7320c297aae3d163685001dcc85eb85acc3ebbcb7ba
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 2C717F36200FA1C5E6359A25D84C3AA77B4F785B84F86003ADD2A53FC9DB36C5498701

Function 00000262F1CA9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 00000262F1CA9EB7

Strings

MOC, xrefs: 00000262F1CA9E7C
RCC, xrefs: 00000262F1CA9E85

Memory Dump Source

Source File: 0000002D.00000002.2670820791.00000262F1CA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1ca0000_dwm.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: eef630dc3bc335752803be99c518d3569bc3ab5f1573de092e965d7aeb617247
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: B1617532A00B94CAEB22CF65D4A939D77B0F348B88F444225EF4957BD9DB3AD099C701

Function 00000262F1CD2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000262F1CD2416
StrCpyW.SHLWAPI ref: 00000262F1CD242D

Strings

\\.\pipe\, xrefs: 00000262F1CD2421

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 581490ec37eb12b4a49e26f746fbe94e91d80e0a7dc13fbd6d0b42662468dd3c
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 2551B332204BA1C1E6759A2AA45C7AAB7B1F385790FC5013ADD6B03FD9DA3BC50D8742

Function 00000262F1CE26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000262F1CE2807
GetLastError.KERNEL32 ref: 00000262F1CE2829

Strings

U, xrefs: 00000262F1CE27B3

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: ff9e6a88fde6903ee08071c4cd7e32a881b35447146b2413937c6eeff5d318d2
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: A0419F33214AA0C2DB208F25E84C3AA77B0F798794F804035EE4E87B94EB3DC549C741

Function 00000262F1CD94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000262F1CD94F0
RaiseException.KERNEL32 ref: 00000262F1CD9531

Strings

csm, xrefs: 00000262F1CD951E

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: ef5009e02e70c4d5282558955f89a2fc2d9ae05583a6035f1908105723be9ce8
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 12111936214F9082EB618B15E45825977E5F788B94F984220EA8E07BA9EF3DC555CB00

Function 00000262F1CA7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000262F1CA737C

Strings

ierarchy Descriptor', xrefs: 00000262F1CA7381
riptor at (, xrefs: 00000262F1CA7364

Memory Dump Source

Source File: 0000002D.00000002.2670820791.00000262F1CA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1ca0000_dwm.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 7bf5f5965613a0a8b1d9dfa8b824b68f951a15287d7b07ca51ce1174b80c9a98
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 88E08671A40F84D1DF028F22E85829833B0DB59B64B889132D95C46395FA38D1FEC701

Function 00000262F1CA73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000262F1CA73D8

Strings

Locator', xrefs: 00000262F1CA73DD
riptor at (, xrefs: 00000262F1CA73C0

Memory Dump Source

Source File: 0000002D.00000002.2670820791.00000262F1CA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1ca0000_dwm.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: ba80466b532ef0c5e980a269dca26dcd20034a65d9df5038e5d6078ae73a35b7
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 5DE08671A00F44C0DF028F21D4541987370E759B64BC89132D94C46391EA38D1E9C301

Function 00000262F1CD1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000262F1CD1C2D
HeapAlloc.KERNEL32 ref: 00000262F1CD1C3B
GetProcessHeap.KERNEL32 ref: 00000262F1CD1C77
HeapFree.KERNEL32 ref: 00000262F1CD1C85

Part of subcall function 00000262F1CD152C: StrCmpIW.SHLWAPI ref: 00000262F1CD155D

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: c2dd492a370e18534819ce78c266ab2d626ad6c2575c03d119badc930bcd18a0
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: DE116D35611F65C1EA05DB66A40C22973B1FB89FC0F984038DE8E43BA5DF7AC446C301

Function 00000262F1CD1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000262F1CD126E
HeapAlloc.KERNEL32 ref: 00000262F1CD127D
GetProcessHeap.KERNEL32 ref: 00000262F1CD1297
HeapAlloc.KERNEL32 ref: 00000262F1CD12A8

Memory Dump Source

Source File: 0000002D.00000002.2670867164.00000262F1CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_262f1cd0000_dwm.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: e0bac6b3f5b15c70722f9493a1e9469b73309d7d80f815f2ab4276cd36964230
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 21E06D35621A24C6EB058FA2D80C34E36F1FB89F16F84C028C98907791DF7EC499C751

Analysis Process: svchost.exePID: 356, Parent PID: 7692COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	74
Total number of Limit Nodes:	2

Executed Functions

Function 0000023942B11628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000023942B11633
HeapAlloc.KERNEL32 ref: 0000023942B11642

Part of subcall function 0000023942B11268: GetProcessHeap.KERNEL32 ref: 0000023942B1126E
Part of subcall function 0000023942B11268: HeapAlloc.KERNEL32 ref: 0000023942B1127D
Part of subcall function 0000023942B11268: GetProcessHeap.KERNEL32 ref: 0000023942B11297
Part of subcall function 0000023942B11268: HeapAlloc.KERNEL32 ref: 0000023942B112A8

RegOpenKeyExW.ADVAPI32 ref: 0000023942B116B2
RegOpenKeyExW.ADVAPI32 ref: 0000023942B116DF
RegCloseKey.ADVAPI32 ref: 0000023942B116F9
RegOpenKeyExW.ADVAPI32 ref: 0000023942B11719
RegCloseKey.ADVAPI32 ref: 0000023942B11734
RegOpenKeyExW.ADVAPI32 ref: 0000023942B11754
RegCloseKey.ADVAPI32 ref: 0000023942B1176F
RegOpenKeyExW.ADVAPI32 ref: 0000023942B1178F
RegCloseKey.ADVAPI32 ref: 0000023942B117AA
RegOpenKeyExW.ADVAPI32 ref: 0000023942B117CA
RegCloseKey.ADVAPI32 ref: 0000023942B117E5
RegOpenKeyExW.ADVAPI32 ref: 0000023942B11805
RegCloseKey.ADVAPI32 ref: 0000023942B11820
RegOpenKeyExW.ADVAPI32 ref: 0000023942B11840
RegCloseKey.ADVAPI32 ref: 0000023942B1185B
RegOpenKeyExW.ADVAPI32 ref: 0000023942B1187B
RegCloseKey.ADVAPI32 ref: 0000023942B11896
RegCloseKey.ADVAPI32 ref: 0000023942B118A0

Part of subcall function 0000023942B112BC: RegQueryInfoKeyW.ADVAPI32 ref: 0000023942B11319
Part of subcall function 0000023942B112BC: GetProcessHeap.KERNEL32 ref: 0000023942B11327
Part of subcall function 0000023942B112BC: HeapAlloc.KERNEL32 ref: 0000023942B11338
Part of subcall function 0000023942B112BC: RegEnumValueW.ADVAPI32 ref: 0000023942B11397
Part of subcall function 0000023942B112BC: GetProcessHeap.KERNEL32 ref: 0000023942B113DF
Part of subcall function 0000023942B112BC: HeapAlloc.KERNEL32 ref: 0000023942B113ED
Part of subcall function 0000023942B112BC: GetProcessHeap.KERNEL32 ref: 0000023942B1140A
Part of subcall function 0000023942B112BC: HeapFree.KERNEL32 ref: 0000023942B11418
Part of subcall function 0000023942B112BC: lstrlenW.KERNEL32 ref: 0000023942B11421
Part of subcall function 0000023942B112BC: GetProcessHeap.KERNEL32 ref: 0000023942B1142F
Part of subcall function 0000023942B112BC: HeapAlloc.KERNEL32 ref: 0000023942B1143D

Strings

tcp_remote, xrefs: 0000023942B11839
service_names, xrefs: 0000023942B117C3
process_names, xrefs: 0000023942B1174D
SOFTWARE\dialerconfig, xrefs: 0000023942B11692
startup, xrefs: 0000023942B116D5
pid, xrefs: 0000023942B11712
tcp_local, xrefs: 0000023942B117FE
udp, xrefs: 0000023942B11874
paths, xrefs: 0000023942B11788

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 8e95634b417f9c2d9da6f32b8bf17eb9a4111fbeb57898cc911cc05395a135c5
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: F6712D36730B5285EB109F25E89C69923A4FB87B88F001111DF8E57B69DFBCC686C750

Function 0000023942B1328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 0000023942B132AE
PathFindFileNameW.SHLWAPI ref: 0000023942B132BD

Part of subcall function 0000023942B13844: StrCmpNIW.SHLWAPI ref: 0000023942B1385C

Part of subcall function 0000023942B13790: GetModuleHandleW.KERNEL32 ref: 0000023942B1379E
Part of subcall function 0000023942B13790: GetCurrentProcess.KERNEL32 ref: 0000023942B137CC
Part of subcall function 0000023942B13790: VirtualProtectEx.KERNEL32 ref: 0000023942B137EE
Part of subcall function 0000023942B13790: GetCurrentProcess.KERNEL32 ref: 0000023942B13809
Part of subcall function 0000023942B13790: VirtualProtectEx.KERNEL32 ref: 0000023942B1382A

CreateThread.KERNEL32 ref: 0000023942B1330B

Part of subcall function 0000023942B11D14: GetCurrentThread.KERNEL32 ref: 0000023942B11D1F

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: f6ed66e6c857628b1aec2f6fea2e40741d54a2e76cc1fb3134c341e7300a5224
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 59118030A3474382FB609B61F84D779A294BB97384F5081269BC682691FFFCC7CA8314

Function 0000023942B11ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000023942B11628: GetProcessHeap.KERNEL32 ref: 0000023942B11633
Part of subcall function 0000023942B11628: HeapAlloc.KERNEL32 ref: 0000023942B11642
Part of subcall function 0000023942B11628: RegOpenKeyExW.ADVAPI32 ref: 0000023942B116B2
Part of subcall function 0000023942B11628: RegOpenKeyExW.ADVAPI32 ref: 0000023942B116DF
Part of subcall function 0000023942B11628: RegCloseKey.ADVAPI32 ref: 0000023942B116F9
Part of subcall function 0000023942B11628: RegOpenKeyExW.ADVAPI32 ref: 0000023942B11719
Part of subcall function 0000023942B11628: RegCloseKey.ADVAPI32 ref: 0000023942B11734
Part of subcall function 0000023942B11628: RegOpenKeyExW.ADVAPI32 ref: 0000023942B11754
Part of subcall function 0000023942B11628: RegCloseKey.ADVAPI32 ref: 0000023942B1176F
Part of subcall function 0000023942B11628: RegOpenKeyExW.ADVAPI32 ref: 0000023942B1178F
Part of subcall function 0000023942B11628: RegCloseKey.ADVAPI32 ref: 0000023942B117AA
Part of subcall function 0000023942B11628: RegOpenKeyExW.ADVAPI32 ref: 0000023942B117CA

Sleep.KERNEL32 ref: 0000023942B11AD7
SleepEx.KERNELBASE ref: 0000023942B11ADD

Part of subcall function 0000023942B11628: RegCloseKey.ADVAPI32 ref: 0000023942B117E5
Part of subcall function 0000023942B11628: RegOpenKeyExW.ADVAPI32 ref: 0000023942B11805
Part of subcall function 0000023942B11628: RegCloseKey.ADVAPI32 ref: 0000023942B11820
Part of subcall function 0000023942B11628: RegOpenKeyExW.ADVAPI32 ref: 0000023942B11840
Part of subcall function 0000023942B11628: RegCloseKey.ADVAPI32 ref: 0000023942B1185B
Part of subcall function 0000023942B11628: RegOpenKeyExW.ADVAPI32 ref: 0000023942B1187B
Part of subcall function 0000023942B11628: RegCloseKey.ADVAPI32 ref: 0000023942B11896
Part of subcall function 0000023942B11628: RegCloseKey.ADVAPI32 ref: 0000023942B118A0

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: c0b36ddecb4b78bb1cc064b77a00913705e26ff548cf8165a7e1bab33c7c9d27
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: F931F26123164781FF549B2ADA4937A23A5BB47BC0F0454219F898779BEEACCAD3C210

Function 0000023942AE273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 0000023942AE285E

Memory Dump Source

Source File: 0000002E.00000002.2631167338.0000023942AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942ae0000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 15a706ecd1b405147a48140e3fbf88b857eb186e307940224290b178e3835ab6
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 0E611232B6169087EB54CF95900872DB3A2FB65BA8F189121DF990B7C8DE7CD993C700

Non-executed Functions

Function 0000023942B12B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 0000023942B12BD0
lstrlenW.KERNEL32 ref: 0000023942B12E0A

Part of subcall function 0000023942B1199C: OpenProcess.KERNEL32 ref: 0000023942B119C2
Part of subcall function 0000023942B1199C: K32GetModuleFileNameExW.KERNEL32 ref: 0000023942B119E0
Part of subcall function 0000023942B1199C: PathFindFileNameW.SHLWAPI ref: 0000023942B119EF
Part of subcall function 0000023942B1199C: lstrlenW.KERNEL32 ref: 0000023942B119FB
Part of subcall function 0000023942B1199C: StrCpyW.SHLWAPI ref: 0000023942B11A0E
Part of subcall function 0000023942B1199C: CloseHandle.KERNEL32 ref: 0000023942B11A1C

GetProcAddress.KERNEL32 ref: 0000023942B12BE5

Part of subcall function 0000023942B1152C: StrCmpIW.SHLWAPI ref: 0000023942B1155D

Part of subcall function 0000023942B13844: StrCmpNIW.SHLWAPI ref: 0000023942B1385C

StrCmpNIW.SHLWAPI ref: 0000023942B12C28
lstrlenW.KERNEL32 ref: 0000023942B12D50

Strings

NtQueryObject, xrefs: 0000023942B12BDB
ntdll.dll, xrefs: 0000023942B12BC9
\Device\Nsi, xrefs: 0000023942B12C1B

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: a6acf68b3921f701c8504bca25139df1e7b4bdc3607fc547ce9d744e90d2a69e
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: B7B19362230AA286EB648F25D84877963A5F747BC4F545016DF8953795DFBCCEC2C340

Function 0000023942B17D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 0000023942B17DAC
RtlCaptureContext.NTDLL ref: 0000023942B17DD9
RtlLookupFunctionEntry.NTDLL ref: 0000023942B17DF3
RtlVirtualUnwind.NTDLL ref: 0000023942B17E34
IsDebuggerPresent.KERNEL32 ref: 0000023942B17E88
SetUnhandledExceptionFilter.KERNEL32 ref: 0000023942B17EA9
UnhandledExceptionFilter.KERNEL32 ref: 0000023942B17EB4

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 315b2f58abf9bf9a1873c310fd848496801c496d9154e0ec45ebcbc619b3c56d
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: E5316D72215B818AEB609F64E8883ED7364F786744F44402ADB8E57B98EF7CC789C710

Function 0000023942B1D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 0000023942B1D31D
RtlLookupFunctionEntry.NTDLL ref: 0000023942B1D335
RtlVirtualUnwind.NTDLL ref: 0000023942B1D370
IsDebuggerPresent.KERNEL32 ref: 0000023942B1D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 0000023942B1D3B3
UnhandledExceptionFilter.KERNEL32 ref: 0000023942B1D3BE

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: a1bf3ea65b53a230693ceb58b7ec858648380258a01017bacab39c83b8775197
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 8D312F36224B8185DB608F25E8483AE73A4F78A794F544125EBDD43B95DF7CC696CB00

Function 0000023942B112BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000023942B11319
GetProcessHeap.KERNEL32 ref: 0000023942B11327
HeapAlloc.KERNEL32 ref: 0000023942B11338
RegEnumValueW.ADVAPI32 ref: 0000023942B11397

Part of subcall function 0000023942B1152C: StrCmpIW.SHLWAPI ref: 0000023942B1155D

GetProcessHeap.KERNEL32 ref: 0000023942B113DF
HeapAlloc.KERNEL32 ref: 0000023942B113ED
GetProcessHeap.KERNEL32 ref: 0000023942B1140A
HeapFree.KERNEL32 ref: 0000023942B11418
lstrlenW.KERNEL32 ref: 0000023942B11421
GetProcessHeap.KERNEL32 ref: 0000023942B1142F
HeapAlloc.KERNEL32 ref: 0000023942B1143D
StrCpyW.SHLWAPI ref: 0000023942B1145F
GetProcessHeap.KERNEL32 ref: 0000023942B11476
HeapFree.KERNEL32 ref: 0000023942B11484

Strings

d, xrefs: 0000023942B1135A

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 1f58c1730686cff35fae4be151adb5fbdd9a5d371eadc9521cfc252201a034d6
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 32513836620B8586EB54CF62E54C36A77A1F78AFC9F048124DB8907719DF7CD28ACB10

Function 0000023942B11D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 0000023942B11D1F

Part of subcall function 0000023942B11FD4: GetModuleHandleA.KERNEL32 ref: 0000023942B11FEC
Part of subcall function 0000023942B11FD4: GetProcAddress.KERNEL32 ref: 0000023942B11FFD

Part of subcall function 0000023942B15B30: GetCurrentThreadId.KERNEL32 ref: 0000023942B15B6B

Strings

NtEnumerateKey, xrefs: 0000023942B11DB9
NtQueryDirectoryFileEx, xrefs: 0000023942B11D9C
EnumServicesStatusExW, xrefs: 0000023942B11E11, 0000023942B11E32
advapi32.dll, xrefs: 0000023942B11DF7, 0000023942B11E18
NtQuerySystemInformation, xrefs: 0000023942B11D45
NtEnumerateValueKey, xrefs: 0000023942B11DD6
NtQueryDirectoryFile, xrefs: 0000023942B11D7F
NtDeviceIoControlFile, xrefs: 0000023942B11E56
sechost.dll, xrefs: 0000023942B11E39
ntdll.dll, xrefs: 0000023942B11D2D
EnumServiceGroupW, xrefs: 0000023942B11DF0
NtResumeThread, xrefs: 0000023942B11D62

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 5d84426d5822a5146854de49aca2f59d9a837ffb8b89124756eff3ea606ab116
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 3C316264130A5BA0EA05EB69FC6D6E46321B707384FD054139AD9836A6DEFC87CBC360

Function 0000023942AE6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000023942AE6938
__scrt_acquire_startup_lock.LIBCMT ref: 0000023942AE698A
_RTC_Initialize.LIBCMT ref: 0000023942AE69B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000023942AE69DE
__scrt_release_startup_lock.LIBCMT ref: 0000023942AE6A09

Strings

`eh vector vbase copy constructor iterator', xrefs: 0000023942AE69EE
scriptor', xrefs: 0000023942AE6B39, 0000023942AE6BB2, 0000023942AE6BEC
`eh vector copy constructor iterator', xrefs: 0000023942AE6A3B
`dynamic initializer for ', xrefs: 0000023942AE69C7

Memory Dump Source

Source File: 0000002E.00000002.2631167338.0000023942AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942ae0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: caf12f7a350e9b8d44ee4a57aca92316fafc694d0e01f291f42c6b5726c6cece
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 6481D1216B060186FA54ABE6984935962A0F797F84F5C88259FC44B7D6DFFCCBC78700

Function 0000023942B1CE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 0000023942B1CE37
FlsGetValue.KERNEL32(?,?,?,0000023942B20A6B,?,?,?,0000023942B2045C,?,?,?,0000023942B1C84F), ref: 0000023942B1CE4C
FlsSetValue.KERNEL32(?,?,?,0000023942B20A6B,?,?,?,0000023942B2045C,?,?,?,0000023942B1C84F), ref: 0000023942B1CE6D
FlsSetValue.KERNEL32(?,?,?,0000023942B20A6B,?,?,?,0000023942B2045C,?,?,?,0000023942B1C84F), ref: 0000023942B1CE9A
FlsSetValue.KERNEL32(?,?,?,0000023942B20A6B,?,?,?,0000023942B2045C,?,?,?,0000023942B1C84F), ref: 0000023942B1CEAB
FlsSetValue.KERNEL32(?,?,?,0000023942B20A6B,?,?,?,0000023942B2045C,?,?,?,0000023942B1C84F), ref: 0000023942B1CEBC
SetLastError.KERNEL32 ref: 0000023942B1CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,0000023942B20A6B,?,?,?,0000023942B2045C,?,?,?,0000023942B1C84F), ref: 0000023942B1CF0D
FlsSetValue.KERNEL32(?,?,00000001,0000023942B1ECCC,?,?,?,?,0000023942B1BF9F,?,?,?,?,?,0000023942B17AB0), ref: 0000023942B1CF2C

Part of subcall function 0000023942B1D6CC: HeapAlloc.KERNEL32 ref: 0000023942B1D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000023942B20A6B,?,?,?,0000023942B2045C,?,?,?,0000023942B1C84F), ref: 0000023942B1CF54

Part of subcall function 0000023942B1D744: HeapFree.KERNEL32 ref: 0000023942B1D75A
Part of subcall function 0000023942B1D744: GetLastError.KERNEL32 ref: 0000023942B1D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000023942B20A6B,?,?,?,0000023942B2045C,?,?,?,0000023942B1C84F), ref: 0000023942B1CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000023942B20A6B,?,?,?,0000023942B2045C,?,?,?,0000023942B1C84F), ref: 0000023942B1CF76

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: ad34361947ada7336f86b31bf6a30ea32a5efe1354d09a1a9eb47ec0705df2a1
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: E1413B2123124742FA6AA735555D3792282BF877F0F240724ABB6477E6DEEC96C3C602

Function 0000023942B12244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 0000023942B12259
GetCurrentProcessId.KERNEL32 ref: 0000023942B12263

Part of subcall function 0000023942B11934: OpenProcess.KERNEL32 ref: 0000023942B11952
Part of subcall function 0000023942B11934: IsWow64Process.KERNEL32 ref: 0000023942B11968
Part of subcall function 0000023942B11934: CloseHandle.KERNEL32 ref: 0000023942B11983

CreateFileW.KERNEL32 ref: 0000023942B122BC
WriteFile.KERNEL32 ref: 0000023942B122E4
ReadFile.KERNEL32 ref: 0000023942B12303
CloseHandle.KERNEL32 ref: 0000023942B1230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 0000023942B1228C
\\.\pipe\dialerchildproc32, xrefs: 0000023942B12293

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: b91cd49770797e91654f6589a5bf3b0ced0199a432c8182d52d05585c0e07e28
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: F521413662475282F7108B25F44C36A73A0F78BBE5F504215DB9943BA8CFBCC68ACB10

Function 0000023942B1A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000023942B1A5A1

Part of subcall function 0000023942B1B414: __GetUnwindTryBlock.LIBCMT ref: 0000023942B1B457
Part of subcall function 0000023942B1B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0000023942B1B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000023942B1A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0000023942B1A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 0000023942B1A9DA

Strings

csm, xrefs: 0000023942B1A69C
csm, xrefs: 0000023942B1A622
csm, xrefs: 0000023942B1A5BB

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: 509c5f4b31c8dd97d519f852364254b292217338161d423dea8d118605589a27
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: F7E17F72624B818AEB209F65D4883AD77A0F747BD8F140215EFC957B99CB78E2D2C740

Function 0000023942AE9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000023942AE99A1

Part of subcall function 0000023942AEA814: __GetUnwindTryBlock.LIBCMT ref: 0000023942AEA857
Part of subcall function 0000023942AEA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0000023942AEA87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000023942AE9A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0000023942AE9CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 0000023942AE9DDA

Strings

csm, xrefs: 0000023942AE9A9C
csm, xrefs: 0000023942AE9A22
csm, xrefs: 0000023942AE99BB

Memory Dump Source

Source File: 0000002E.00000002.2631167338.0000023942AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942ae0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 073912d3211c5d6717307d2f309cd06fe85d05d1636f728bfc057ea8065464e1
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 46E19D72660B418AFB60DFA5D48839D77A0F786B98F000115EF895BB9ACB78D2D3C705

Function 0000023942B1F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 0000023942B1F510
GetProcAddress.KERNEL32 ref: 0000023942B1F51C

Strings

api-ms-, xrefs: 0000023942B1F45A
ext-ms-, xrefs: 0000023942B1F46D

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 6f09c8afb4744aa4f42c16c278fae59e5da394e82cbe07c496c427064fdf3a43
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 8A41D662331B1281FA16CB16A84C7652395F74BBE0F1941259F8E87784EEBCC6C7C350

Function 0000023942B1104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000023942B110B1
RegEnumValueW.ADVAPI32 ref: 0000023942B11117
GetProcessHeap.KERNEL32 ref: 0000023942B1115A
HeapAlloc.KERNEL32 ref: 0000023942B11168
GetProcessHeap.KERNEL32 ref: 0000023942B11185
HeapFree.KERNEL32 ref: 0000023942B11193

Strings

d, xrefs: 0000023942B110D6

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: ba2e1a69578fa26a8eb83c5b8d2ac302807f51cbbda50584621712cd8f64e72a
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: BB416033624B85C6E760CF21E4487AAB7A1F38AB99F048119DB8907758DF7CD5D6CB00

Function 0000023942B1D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FlsGetValue.KERNEL32(?,?,?,0000023942B1C7DE,?,?,?,?,?,?,?,?,0000023942B1CF9D,?,?,00000001), ref: 0000023942B1D087
FlsSetValue.KERNEL32(?,?,?,0000023942B1C7DE,?,?,?,?,?,?,?,?,0000023942B1CF9D,?,?,00000001), ref: 0000023942B1D0A6
FlsSetValue.KERNEL32(?,?,?,0000023942B1C7DE,?,?,?,?,?,?,?,?,0000023942B1CF9D,?,?,00000001), ref: 0000023942B1D0CE
FlsSetValue.KERNEL32(?,?,?,0000023942B1C7DE,?,?,?,?,?,?,?,?,0000023942B1CF9D,?,?,00000001), ref: 0000023942B1D0DF
FlsSetValue.KERNEL32(?,?,?,0000023942B1C7DE,?,?,?,?,?,?,?,?,0000023942B1CF9D,?,?,00000001), ref: 0000023942B1D0F0

Strings

1%, xrefs: 0000023942B1D0CE
Y%, xrefs: 0000023942B1D0A6

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 1366050ce7901682985b7bf589f054659e8773b74c0cd1428d08d3fa763177e0
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: F0115E2072464741FA68A7355A5D3797245BB477F0F244325AAB9877EADEECC6C3C300

Function 0000023942B17510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000023942B17538
__scrt_acquire_startup_lock.LIBCMT ref: 0000023942B1758A
_RTC_Initialize.LIBCMT ref: 0000023942B175B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000023942B175DE
__scrt_release_startup_lock.LIBCMT ref: 0000023942B17609

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: fac1d9ea20639018c545c796994c51a6349c67e2045e7664030306e392332911
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: C381A16163034386FB50AB29A84D3B96290BB477C0F248495AFD547796EBFCCBC7A710

Function 0000023942B19DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 0000023942B19E49
GetLastError.KERNEL32 ref: 0000023942B19E57
LoadLibraryExW.KERNEL32 ref: 0000023942B19E81
FreeLibrary.KERNEL32 ref: 0000023942B19EC7
GetProcAddress.KERNEL32 ref: 0000023942B19ED3

Strings

api-ms-, xrefs: 0000023942B19E69

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 8e2889272daa88d2947e958fd6f51755779e79237471ab9d41a56a59431c0cd8
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: C331C722222F82D1EE15DB02E5487752294B74BBE0F5909259FAD07798DFBDC6CB8314

Function 0000023942B23DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 0000023942B23DE5
GetLastError.KERNEL32 ref: 0000023942B23DF1
CloseHandle.KERNEL32 ref: 0000023942B23E09
CreateFileW.KERNEL32 ref: 0000023942B23E34
WriteConsoleW.KERNEL32 ref: 0000023942B23E53

Strings

CONOUT$, xrefs: 0000023942B23E15

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 44262b9d8466f2c7b704b98cde3ada5aece7e77720a6c996d800aa764bf28769
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 12119021330B8182E7508B12F84C319A2A4F78BFE5F140215EB9A87794CFBCCA868750

Function 0000023942B13790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000023942B1379E
GetCurrentProcess.KERNEL32 ref: 0000023942B137CC
VirtualProtectEx.KERNEL32 ref: 0000023942B137EE
GetCurrentProcess.KERNEL32 ref: 0000023942B13809
VirtualProtectEx.KERNEL32 ref: 0000023942B1382A

Strings

wr, xrefs: 0000023942B137FF

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 6d78b6ab06c7c64b8a33ebf2251cdb695a45f71392c3723117dc17bbcffd75bd
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: D9115B26724B82C2EF149B21F40C66AA2A0FB8BBC5F440029DFC907794EF7DC686C714

Function 0000023942B15B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000023942B15B6B
GetThreadContext.KERNEL32 ref: 0000023942B15CD5

Part of subcall function 0000023942B15960: GetCurrentThreadId.KERNEL32 ref: 0000023942B15964

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: fb5e2bef970acb4034aecacb76368e30c76a1bf963be145c9e38c67f6f937ea4
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: 17D19C76224B8985DA70DB0AE49436A77A0F38ABC4F144116EBCD47BA5DF7CC682CB50

Function 0000023942B12F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000023942B12F27
HeapAlloc.KERNEL32 ref: 0000023942B12F3A
StrCmpNIW.SHLWAPI ref: 0000023942B12FAF
GetProcessHeap.KERNEL32 ref: 0000023942B13015
HeapFree.KERNEL32 ref: 0000023942B13023

Strings

dialer, xrefs: 0000023942B12FA8

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 064c722188d233ad65b930cc70b5d07b99ade6ac42e459fa3451119cc07e8000
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 77318222721B6682E614DF16E54C779A7A0FB57BC4F0841249FC847B55EF7CD6E28700

Function 0000023942B114A4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000023942B114C5
HeapFree.KERNEL32 ref: 0000023942B114D4
GetProcessHeap.KERNEL32 ref: 0000023942B114E1
HeapFree.KERNEL32 ref: 0000023942B114F0
GetProcessHeap.KERNEL32 ref: 0000023942B11500

Strings

C:\Windows\system32\svchost.exe, xrefs: 0000023942B261A9, 0000023942B261B1

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID: C:\Windows\system32\svchost.exe
API String ID: 3168794593-4180442734
Opcode ID: 5f1dcf0d6982f64b78ee420bc41fcee6693c0fdf65c097574d0a291fc3cf39dd
Instruction ID: c8b53b3ecd09693694152222658e1a39a340923377275ab5dac0079b3d425c02
Opcode Fuzzy Hash: 5f1dcf0d6982f64b78ee420bc41fcee6693c0fdf65c097574d0a291fc3cf39dd
Instruction Fuzzy Hash: BF31C9A7929BE14AF351CF75A85D2592F60F787F42F099015DBC003247E97CA6C2C710

Function 0000023942B1CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000023942B1CFAF
FlsSetValue.KERNEL32(?,?,?,0000023942B1D6B5,?,?,?,?,0000023942B1D778), ref: 0000023942B1CFE5
FlsSetValue.KERNEL32(?,?,?,0000023942B1D6B5,?,?,?,?,0000023942B1D778), ref: 0000023942B1D012
FlsSetValue.KERNEL32(?,?,?,0000023942B1D6B5,?,?,?,?,0000023942B1D778), ref: 0000023942B1D023
FlsSetValue.KERNEL32(?,?,?,0000023942B1D6B5,?,?,?,?,0000023942B1D778), ref: 0000023942B1D034
SetLastError.KERNEL32 ref: 0000023942B1D04F

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: dde30ba085f46f4be51c0527e20ead402f76c30e788019a484bcf12f8054e561
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: F0113D2023178341FA65A725665D3396242BF877F0F144725ABB6877DADEEC86C3C701

Function 0000023942B1199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 0000023942B119C2
K32GetModuleFileNameExW.KERNEL32 ref: 0000023942B119E0
PathFindFileNameW.SHLWAPI ref: 0000023942B119EF
lstrlenW.KERNEL32 ref: 0000023942B119FB
StrCpyW.SHLWAPI ref: 0000023942B11A0E
CloseHandle.KERNEL32 ref: 0000023942B11A1C

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: f409e17eebd297bf9963a5e552d7556d9f7d2eb4a0fc8c0255c232cf5353d79f
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: CA016D21720B8282EB14DB52B44C35963A1F78ABC1F484035DFA943755DF7CCACAC710

Function 0000023942B136C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000023942B136E4
GetCurrentProcess.KERNEL32 ref: 0000023942B136F2
VirtualProtectEx.KERNEL32 ref: 0000023942B13714
GetCurrentProcess.KERNEL32 ref: 0000023942B13732
VirtualProtectEx.KERNEL32 ref: 0000023942B13753
TerminateThread.KERNEL32 ref: 0000023942B13762

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: b0caa4f5406828a1d39c246a49c1e7bc2fd622be21ad0fd35cefd66e73b13d1e
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: B5012D7562174282FB249B22F84C72663A0BB4BB86F140425CFC907755EFBDC69AC714

Function 0000023942B19005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000023942B19013
_IsNonwritableInCurrentImage.LIBCMT ref: 0000023942B190A8
RtlUnwindEx.NTDLL ref: 0000023942B190F7

Strings

csm, xrefs: 0000023942B1908E
f, xrefs: 0000023942B19026

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 53f5518fb106970c30f56deb6f623ca7e9cce37319c403db4fff949b66d3a64d
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: D051B532721A8296EB14DB15E44CB6937A6F347BC8F148124DB974374CEBB9DAD2C708

Function 0000023942B18FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000023942B19013
_IsNonwritableInCurrentImage.LIBCMT ref: 0000023942B190A8
RtlUnwindEx.NTDLL ref: 0000023942B190F7

Strings

csm, xrefs: 0000023942B1908E
f, xrefs: 0000023942B19026

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: b9f75dc467751a99437ae7f03861d494dcd42f8ff6a56fb7fb8d31bb7ccbd68e
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: A3317832220B8196E7149B11E84C76937A5F347BC8F158114AF9603789DBBDCAD2C708

Function 0000023942B11A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 0000023942B11A60
StrCmpNIW.SHLWAPI ref: 0000023942B11A7A
lstrlenW.KERNEL32 ref: 0000023942B11A89
StrCpyW.SHLWAPI ref: 0000023942B11A9E

Strings

\\?\, xrefs: 0000023942B11A6E

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: 7ca44ef29f4aff3bcab73f95657e8595597cd3d0611ff8467564ac0cf8c78ebf
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 52F0312273464292E7608B25F99C7696760F74ABC8F948020DB9947699DBBCC7CECB10

Function 0000023942B13044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 0000023942B13066
StrCpyW.SHLWAPI ref: 0000023942B13076
StrCatW.SHLWAPI ref: 0000023942B13082
PathCombineW.SHLWAPI ref: 0000023942B13090

Strings

\\.\pipe\, xrefs: 0000023942B1305C

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: a1628757d0e9da781840cd611e3f79bf31a9c160a25f0478d2664ec4a4615cc8
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 4BF0891072478281EA004B17BA1C1156260B74BFD0F049130DFD647718DF7CC6C68710

Function 0000023942B1BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 0000023942B1BCBD
GetProcAddress.KERNEL32 ref: 0000023942B1BCD3
FreeLibrary.KERNEL32 ref: 0000023942B1BCFA

Strings

mscoree.dll, xrefs: 0000023942B1BCB4
CorExitProcess, xrefs: 0000023942B1BCCC

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 41dd131dfa2b13d3b94f2975155a8e1987f367c92947d5c0744863424d67b722
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: B2F0626122170681EB148B24F44C36A6320FB8BBA1F540219CBEA451E4CFACC6C69350

Function 0000023942B150D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000023942B15156

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: c86a1d372a19ab8a2744613c9679dd834f9d58daf48a29dc023fcc98bc137003
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: 5F02B732229B8586E760CB55E49436AB7A0F3C67D4F104016EBCE87BA9DFBCC595CB40

Function 0000023942B15710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000023942B15726

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: 224ea272dc5eecf1d0052d918d1ef293b74cd5bf02aa352f521ac72b73274aea
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: F961B936539A85C6E760CB15E45832AB7A4F38A7C4F105116EBDD47BA8DBBCC685CB00

Function 0000023942B24104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000023942B2412C
_set_statfp.LIBCMT ref: 0000023942B24147
_set_statfp.LIBCMT ref: 0000023942B24163
_set_statfp.LIBCMT ref: 0000023942B2419F

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: da746408b6cc68a3cb8bd09f2db51aecfc04f3aee712ae28c6d27dee3989b8e7
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: D1115426A30F6311F7641568F45D36529717F6B3B5F180A24E7F62AED6CAACCAC34120

Function 0000023942AF3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000023942AF352C
_set_statfp.LIBCMT ref: 0000023942AF3547
_set_statfp.LIBCMT ref: 0000023942AF3563
_set_statfp.LIBCMT ref: 0000023942AF359F

Memory Dump Source

Source File: 0000002E.00000002.2631167338.0000023942AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942ae0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: bcfb743df6b1fb7b95f5edcc7ebcb7be68c3a5eff787f8e2b9f49dd2d6ab7bfe
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: E111A722630AD119FB941528E44D36991917BDB3B4F4B4638AFE606ED6CAECCBC74310

Function 0000023942AEF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000023942AEF124

Strings

Wednesday, xrefs: 0000023942AEF1ED
or copy constructor iterator', xrefs: 0000023942AEF25A, 0000023942AEF275
Tuesday, xrefs: 0000023942AEF0F4

Memory Dump Source

Source File: 0000002E.00000002.2631167338.0000023942AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942ae0000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: d199e228225c13f6ae760aed665bfbd7965bc8e44ba4255bb8646d476e028407
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: DD61C3325A064442FA699BE9E44C32A66A1F787740F554415CFC68B7E4EBFCCBC78300

Function 0000023942B1AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 0000023942B1AA68
_CallSETranslator.LIBVCRUNTIME ref: 0000023942B1AAB7

Strings

RCC, xrefs: 0000023942B1AA85
MOC, xrefs: 0000023942B1AA7C

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 34e72fca31f5eb4414bda259b86940dd9f3e4ef6086a5234e3626a0a57130d90
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: CF618D33620B85CAEB20DF65D4843AD7BA0F746BD8F044215EF9917B98DBB8D696C700

Function 0000023942B1AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000023942B1ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0000023942B1AE88

Strings

csm, xrefs: 0000023942B1ADC2
csm, xrefs: 0000023942B1AEDA

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 29e17a76cbabb995257f6db8a5ca0e1810aa87abfe664f9ba87808eb57e71e1a
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 3A51AE731207828AEB648F15948836977A0F357BD5F284226DBC987BD5CBBCE6D2C701

Function 0000023942AEA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000023942AEA1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0000023942AEA288

Strings

csm, xrefs: 0000023942AEA1C2
csm, xrefs: 0000023942AEA2DA

Memory Dump Source

Source File: 0000002E.00000002.2631167338.0000023942AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942ae0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 1b9365f03d34b6dc57578e1260d2c93e236accd498f7b23265355e699e576540
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 2651AB361A0381CAFB648BA5944835877A1F756B84F188216DFC98BBD6CBBCD6D3C700

Function 0000023942AE8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000023942AE8413
_IsNonwritableInCurrentImage.LIBCMT ref: 0000023942AE84A8

Strings

csm, xrefs: 0000023942AE848E
f, xrefs: 0000023942AE8426

Memory Dump Source

Source File: 0000002E.00000002.2631167338.0000023942AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942ae0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: e74e1e224bcf41bf01ea9c6f267f0fba6dfb801d83f69a23fabd60320087302b
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 3551DC326616008EFB14CB55E448B183796F352B98F118024DF964B7E8EBBCCAC3CB16

Function 0000023942AE83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000023942AE8413
_IsNonwritableInCurrentImage.LIBCMT ref: 0000023942AE84A8

Strings

csm, xrefs: 0000023942AE848E
f, xrefs: 0000023942AE8426

Memory Dump Source

Source File: 0000002E.00000002.2631167338.0000023942AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942ae0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 2a2de6c6fcec5a077e1bc623eac62f6d895a39a713b52a8d39e04b89562d1b8c
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 7C316B322616409AF714DF51E84C71977A5F742B98F158414EF9A0BBE8DBBCCA83C705

Function 0000023942B22058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 0000023942B220D7
WriteFile.KERNEL32 ref: 0000023942B2239F
WriteFile.KERNEL32 ref: 0000023942B223E5
GetLastError.KERNEL32 ref: 0000023942B2249B

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 2cd817ec5555f0650c412721b830e7a8e354b6aad94e5975e721488ea3da1665
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: EAD1EF32B24B8189E711CF69E4482EC3BB1F356798F048616CF9997B99DE78C687C350

Function 0000023942B22980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 0000023942B22A9C
GetLastError.KERNEL32 ref: 0000023942B22B27

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 72f4c9d48a1e0cda175b17f239b11b1585c5ffa99c8b842dc6ca323fbddd0fc7
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: F991B23272075285F7609F75A48C3AD2BA0B747B88F144509DF8AA7A94DEBCC6C3C720

Function 0000023942B17960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 0000023942B1798C
GetCurrentThreadId.KERNEL32 ref: 0000023942B1799A
GetCurrentProcessId.KERNEL32 ref: 0000023942B179A6
QueryPerformanceCounter.KERNEL32 ref: 0000023942B179B6

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 4f400a5b69aa5bf2688d588b867f5f55590513b85eff8db344cae02cb2629fa9
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 4A112126720F0189EB00CF60E8593A833A4F71A758F441D21DBAD47794DBBCD2D98380

Function 0000023942B1253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000023942B12620
StrCpyW.SHLWAPI ref: 0000023942B12639

Strings

\\.\pipe\, xrefs: 0000023942B1262B

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 901b46a8688f0d9e7c740215a400069a21b07742ddb5f3b56e76d8d3c0e13bff
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: D571B53622079286E765DF25A84C3BA6794F7877C4F540016DF8953B89DEBDCB86C700

Function 0000023942AE9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 0000023942AE9EB7

Strings

RCC, xrefs: 0000023942AE9E85
MOC, xrefs: 0000023942AE9E7C

Memory Dump Source

Source File: 0000002E.00000002.2631167338.0000023942AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942ae0000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 21c8198df3b1e5cd375fae852c744e26035c11536e0a1da27959340dead36c94
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: EF617B33610B848AFB24DFA5D48439D77A0F749B88F044216EF891BB99DBB8D696C704

Function 0000023942B12330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000023942B12416
StrCpyW.SHLWAPI ref: 0000023942B1242D

Strings

\\.\pipe\, xrefs: 0000023942B12421

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 1dc68bb2d1d3ef29900816e6d85fd1d51d972f6bb2c80bb66fc3cdf77c7ea21f
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: DB51E83222479381E674DA29A5AC3BAAB51F3877C0F490125DFD903B5ADEBDC786C740

Function 0000023942B226F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 0000023942B22807
GetLastError.KERNEL32 ref: 0000023942B22829

Strings

U, xrefs: 0000023942B227B3

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 958032e7bb851407a2659dff6c69b9df7d1aca6d337ad4864dae1845bd63d866
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 14419332725B8186DB209F25F4483AA77A0F79A794F504521EF8D87794DFBCC682C750

Function 0000023942B194A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 0000023942B194F0
RaiseException.KERNEL32 ref: 0000023942B19531

Strings

csm, xrefs: 0000023942B1951E

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 65bdccc0272201d2a73ffbd8f351ef5306a2c3c9d075da414e0aa8d95f34276c
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 4B112B32224B8182EB618B15F448359B7E5F78AB94F584220EFCC47759DF7CC692CB04

Function 0000023942AE7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 0000023942AE737C

Strings

riptor at (, xrefs: 0000023942AE7364
ierarchy Descriptor', xrefs: 0000023942AE7381

Memory Dump Source

Source File: 0000002E.00000002.2631167338.0000023942AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942ae0000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 28efb64d62c58961beedb1f191654261833f2e1c2e864d206abf1bae801bab21
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 32E08661651B44D0EF058F61E88429833A0EB59B64F4991229E9C07351FA7CD2EAC300

Function 0000023942AE73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 0000023942AE73D8

Strings

riptor at (, xrefs: 0000023942AE73C0
Locator', xrefs: 0000023942AE73DD

Memory Dump Source

Source File: 0000002E.00000002.2631167338.0000023942AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942ae0000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 03aa8619a34496d11caf5e8da6618501c6f01f2862542e5aa263bed658a6699f
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 11E0CD61651B44C4EF058F61D8801987360F759B54F89D122CF8C07391FB7CD2E6C300

Function 0000023942B11BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000023942B11C2D
HeapAlloc.KERNEL32 ref: 0000023942B11C3B
GetProcessHeap.KERNEL32 ref: 0000023942B11C77
HeapFree.KERNEL32 ref: 0000023942B11C85

Part of subcall function 0000023942B1152C: StrCmpIW.SHLWAPI ref: 0000023942B1155D

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: b70eb6b1f7f97ab75b431eab33cb6ef54f9e59f666c37de9c7e639b2dc8268d7
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: E0118C25A21B8681EA04DB66A80C22973A1FB8BFC1F185028DF8D47766DEBCD583D300

Function 0000023942B11268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000023942B1126E
HeapAlloc.KERNEL32 ref: 0000023942B1127D
GetProcessHeap.KERNEL32 ref: 0000023942B11297
HeapAlloc.KERNEL32 ref: 0000023942B112A8

Memory Dump Source

Source File: 0000002E.00000002.2631674506.0000023942B10000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000023942B10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_23942b10000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: ed07e78da87d333663c65548bce91fcffebdfa90fda8703a7a98be8604c97a31
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 7CE06D35A2171586EB048F62E80C34A36E1FB9FF06F04D024CA8907351DFBD95DACB60

Analysis Process: svchost.exePID: 704, Parent PID: 7692COMMON

Execution Graph

Execution Coverage:	0.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	480
Total number of Limit Nodes:	9

Executed Functions

Function 000001EF056D1268 Relevance: 5.0, APIs: 4, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001EF056D126E
HeapAlloc.KERNEL32 ref: 000001EF056D127D
GetProcessHeap.KERNEL32 ref: 000001EF056D1297
HeapAlloc.KERNEL32 ref: 000001EF056D12A8

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: cd2a018c2ca89667107471ebb9e9103cc521687726bafa83e98e7cd0330a8c99
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 0BE0393562265486EB158B66E80838E36E2EB99B16F0480288D0907352DFBD849AC750

Function 000001EF056DF1EC Relevance: 4.6, APIs: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32 ref: 000001EF056DF205
FreeEnvironmentStringsW.KERNEL32 ref: 000001EF056DF277

Part of subcall function 000001EF056DCA0C: HeapAlloc.KERNEL32 ref: 000001EF056DCA4A

FreeEnvironmentStringsW.KERNEL32 ref: 000001EF056DF2D6

Part of subcall function 000001EF056DD744: HeapFree.KERNEL32 ref: 000001EF056DD75A
Part of subcall function 000001EF056DD744: GetLastError.KERNEL32 ref: 000001EF056DD764

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: EnvironmentFreeStrings$Heap$AllocErrorLast
String ID:
API String ID: 3331406755-0
Opcode ID: 987753ff894a599cb567346e89517f1ee9597d4cd7e0ed4d9062b173d8f816d4
Instruction ID: 2051d0fb3feaa8111bbf8230b710eb358136df25e19bada8ab1caa850ffd535d
Opcode Fuzzy Hash: 987753ff894a599cb567346e89517f1ee9597d4cd7e0ed4d9062b173d8f816d4
Instruction Fuzzy Hash: BC31B531A047D081EA349F62E8442DEB6A6B794BD4F08463DBD4B53BC6DFB8C5028740

Function 000001EF056D328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000001EF056D32AE
PathFindFileNameW.SHLWAPI ref: 000001EF056D32BD

Part of subcall function 000001EF056D3844: StrCmpNIW.SHLWAPI ref: 000001EF056D385C

Part of subcall function 000001EF056D3790: GetModuleHandleW.KERNEL32 ref: 000001EF056D379E
Part of subcall function 000001EF056D3790: GetCurrentProcess.KERNEL32 ref: 000001EF056D37CC
Part of subcall function 000001EF056D3790: VirtualProtectEx.KERNEL32 ref: 000001EF056D37EE
Part of subcall function 000001EF056D3790: GetCurrentProcess.KERNEL32 ref: 000001EF056D3809
Part of subcall function 000001EF056D3790: VirtualProtectEx.KERNEL32 ref: 000001EF056D382A

CreateThread.KERNEL32 ref: 000001EF056D330B

Part of subcall function 000001EF056D1D14: GetCurrentThread.KERNEL32 ref: 000001EF056D1D1F

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 487ca6d69ca5f5b92772906fe0199dc39dbab06cf3531d28a77e50b3ab1c8008
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: A3110335F106C082FA709B25FA1D3DD2296A754344F51493CBD0681697EFF8C1868662

Function 000001EF056D1ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001EF056D1628: GetProcessHeap.KERNEL32 ref: 000001EF056D1633
Part of subcall function 000001EF056D1628: HeapAlloc.KERNEL32 ref: 000001EF056D1642
Part of subcall function 000001EF056D1628: RegOpenKeyExW.ADVAPI32 ref: 000001EF056D16B2
Part of subcall function 000001EF056D1628: RegOpenKeyExW.ADVAPI32 ref: 000001EF056D16DF
Part of subcall function 000001EF056D1628: RegCloseKey.ADVAPI32 ref: 000001EF056D16F9
Part of subcall function 000001EF056D1628: RegOpenKeyExW.ADVAPI32 ref: 000001EF056D1719
Part of subcall function 000001EF056D1628: RegCloseKey.ADVAPI32 ref: 000001EF056D1734
Part of subcall function 000001EF056D1628: RegOpenKeyExW.ADVAPI32 ref: 000001EF056D1754
Part of subcall function 000001EF056D1628: RegCloseKey.ADVAPI32 ref: 000001EF056D176F
Part of subcall function 000001EF056D1628: RegOpenKeyExW.ADVAPI32 ref: 000001EF056D178F
Part of subcall function 000001EF056D1628: RegCloseKey.ADVAPI32 ref: 000001EF056D17AA
Part of subcall function 000001EF056D1628: RegOpenKeyExW.ADVAPI32 ref: 000001EF056D17CA

Sleep.KERNEL32 ref: 000001EF056D1AD7
SleepEx.KERNELBASE ref: 000001EF056D1ADD

Part of subcall function 000001EF056D1628: RegCloseKey.ADVAPI32 ref: 000001EF056D17E5
Part of subcall function 000001EF056D1628: RegOpenKeyExW.ADVAPI32 ref: 000001EF056D1805
Part of subcall function 000001EF056D1628: RegCloseKey.ADVAPI32 ref: 000001EF056D1820
Part of subcall function 000001EF056D1628: RegOpenKeyExW.ADVAPI32 ref: 000001EF056D1840
Part of subcall function 000001EF056D1628: RegCloseKey.ADVAPI32 ref: 000001EF056D185B
Part of subcall function 000001EF056D1628: RegOpenKeyExW.ADVAPI32 ref: 000001EF056D187B
Part of subcall function 000001EF056D1628: RegCloseKey.ADVAPI32 ref: 000001EF056D1896
Part of subcall function 000001EF056D1628: RegCloseKey.ADVAPI32 ref: 000001EF056D18A0

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 56a61ed1c22aa70809ba1ef552c9e7adef8cbb8a14280a803190e53eea46f358
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 7331F072B106C541FF709B26DA693ED13A6AB95BC4F045839BE0987697FEF4C453C220

Function 000001EF056D3844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 000001EF056D385C

Strings

dialer, xrefs: 000001EF056D3855

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction ID: ede4f874cc69a4b5ca352588f7248873ba5645b9888b763ed146c10f1c22a78f
Opcode Fuzzy Hash: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction Fuzzy Hash: 6CD0A77072228586FF74DFE6D8CD6E82363EB14B54F88543CED0002251DB988D8F9760

Function 000001EF056A273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000001EF056A285E

Memory Dump Source

Source File: 0000002F.00000002.2629591192.000001EF056A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056a0000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 0c5674226d783c956eadadbc144633e65e9082b701126f73034fc91fa37fbeee
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: EE61123AB416D087DB648F56D0287ADB393F754BA4F988139EE590378ADA78D853CB00

Function 000001EF056DD6CC Relevance: 1.3, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32 ref: 000001EF056DD721

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: dd9fd347fe8d251c64e9f03e0b9c8ce045e185238ab486bcf6df9ff2ab176017
Instruction ID: f2385afa0adc2066639d79047e4076e3cf136975bd7d27afbdbcc2edf776a143
Opcode Fuzzy Hash: dd9fd347fe8d251c64e9f03e0b9c8ce045e185238ab486bcf6df9ff2ab176017
Instruction Fuzzy Hash: 52F06D78B012C041FEB466A5E81D3ED12A35B88B80F0C583C6D0A862C3DDECC48386B0

Non-executed Functions

Function 000001EF056D2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000001EF056D2BD0
lstrlenW.KERNEL32 ref: 000001EF056D2E0A

Part of subcall function 000001EF056D199C: OpenProcess.KERNEL32 ref: 000001EF056D19C2
Part of subcall function 000001EF056D199C: K32GetModuleFileNameExW.KERNEL32 ref: 000001EF056D19E0
Part of subcall function 000001EF056D199C: PathFindFileNameW.SHLWAPI ref: 000001EF056D19EF
Part of subcall function 000001EF056D199C: lstrlenW.KERNEL32 ref: 000001EF056D19FB
Part of subcall function 000001EF056D199C: StrCpyW.SHLWAPI ref: 000001EF056D1A0E
Part of subcall function 000001EF056D199C: CloseHandle.KERNEL32 ref: 000001EF056D1A1C

GetProcAddress.KERNEL32 ref: 000001EF056D2BE5

Part of subcall function 000001EF056D152C: StrCmpIW.SHLWAPI ref: 000001EF056D155D

Part of subcall function 000001EF056D3844: StrCmpNIW.SHLWAPI ref: 000001EF056D385C

StrCmpNIW.SHLWAPI ref: 000001EF056D2C28
lstrlenW.KERNEL32 ref: 000001EF056D2D50

Strings

\Device\Nsi, xrefs: 000001EF056D2C1B
ntdll.dll, xrefs: 000001EF056D2BC9
NtQueryObject, xrefs: 000001EF056D2BDB

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: bc34481fe6d1cb0786dc2a19affd63ab5fc76c92cc80969be77305afbdaf40f3
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 4CB19D7AA10AD082EBB48F25D4687ED63A6FB44B84F04583AFE0953796DFB5CC42C750

Function 000001EF056D7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000001EF056D7DAC
RtlCaptureContext.NTDLL ref: 000001EF056D7DD9
RtlLookupFunctionEntry.NTDLL ref: 000001EF056D7DF3
RtlVirtualUnwind.NTDLL ref: 000001EF056D7E34
IsDebuggerPresent.KERNEL32 ref: 000001EF056D7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000001EF056D7EA9
UnhandledExceptionFilter.KERNEL32 ref: 000001EF056D7EB4

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 6e1b243ca6a839fdabc52388a1b6cb249c9ecbbc774d54353a458daea446c3f3
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 7D314A72605BC08AEB709F60E8843ED7362F794744F44443AEE4E47A9AEFB8C649C710

Function 000001EF056DD2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000001EF056DD31D
RtlLookupFunctionEntry.NTDLL ref: 000001EF056DD335
RtlVirtualUnwind.NTDLL ref: 000001EF056DD370
IsDebuggerPresent.KERNEL32 ref: 000001EF056DD3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000001EF056DD3B3
UnhandledExceptionFilter.KERNEL32 ref: 000001EF056DD3BE

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 4d243f8bde402fdfb98c494d0b0b6b8002be006aa2a51aad393a08c56a91869e
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: DE315B32614BC086DB709B25E8443EE73A2F789754F54053AEE9D43B96DF78C546CB00

Function 000001EF056D1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001EF056D1633
HeapAlloc.KERNEL32 ref: 000001EF056D1642

Part of subcall function 000001EF056D1268: GetProcessHeap.KERNEL32 ref: 000001EF056D126E
Part of subcall function 000001EF056D1268: HeapAlloc.KERNEL32 ref: 000001EF056D127D
Part of subcall function 000001EF056D1268: GetProcessHeap.KERNEL32 ref: 000001EF056D1297
Part of subcall function 000001EF056D1268: HeapAlloc.KERNEL32 ref: 000001EF056D12A8

RegOpenKeyExW.ADVAPI32 ref: 000001EF056D16B2
RegOpenKeyExW.ADVAPI32 ref: 000001EF056D16DF
RegCloseKey.ADVAPI32 ref: 000001EF056D16F9
RegOpenKeyExW.ADVAPI32 ref: 000001EF056D1719
RegCloseKey.ADVAPI32 ref: 000001EF056D1734
RegOpenKeyExW.ADVAPI32 ref: 000001EF056D1754
RegCloseKey.ADVAPI32 ref: 000001EF056D176F
RegOpenKeyExW.ADVAPI32 ref: 000001EF056D178F
RegCloseKey.ADVAPI32 ref: 000001EF056D17AA
RegOpenKeyExW.ADVAPI32 ref: 000001EF056D17CA
RegCloseKey.ADVAPI32 ref: 000001EF056D17E5
RegOpenKeyExW.ADVAPI32 ref: 000001EF056D1805
RegCloseKey.ADVAPI32 ref: 000001EF056D1820
RegOpenKeyExW.ADVAPI32 ref: 000001EF056D1840
RegCloseKey.ADVAPI32 ref: 000001EF056D185B
RegOpenKeyExW.ADVAPI32 ref: 000001EF056D187B
RegCloseKey.ADVAPI32 ref: 000001EF056D1896
RegCloseKey.ADVAPI32 ref: 000001EF056D18A0

Part of subcall function 000001EF056D12BC: RegQueryInfoKeyW.ADVAPI32 ref: 000001EF056D1319
Part of subcall function 000001EF056D12BC: GetProcessHeap.KERNEL32 ref: 000001EF056D1327
Part of subcall function 000001EF056D12BC: HeapAlloc.KERNEL32 ref: 000001EF056D1338
Part of subcall function 000001EF056D12BC: RegEnumValueW.ADVAPI32 ref: 000001EF056D1397
Part of subcall function 000001EF056D12BC: GetProcessHeap.KERNEL32 ref: 000001EF056D13DF
Part of subcall function 000001EF056D12BC: HeapAlloc.KERNEL32 ref: 000001EF056D13ED
Part of subcall function 000001EF056D12BC: GetProcessHeap.KERNEL32 ref: 000001EF056D140A
Part of subcall function 000001EF056D12BC: HeapFree.KERNEL32 ref: 000001EF056D1418
Part of subcall function 000001EF056D12BC: lstrlenW.KERNEL32 ref: 000001EF056D1421
Part of subcall function 000001EF056D12BC: GetProcessHeap.KERNEL32 ref: 000001EF056D142F
Part of subcall function 000001EF056D12BC: HeapAlloc.KERNEL32 ref: 000001EF056D143D

Strings

startup, xrefs: 000001EF056D16D5
udp, xrefs: 000001EF056D1874
service_names, xrefs: 000001EF056D17C3
paths, xrefs: 000001EF056D1788
SOFTWARE\dialerconfig, xrefs: 000001EF056D1692
tcp_remote, xrefs: 000001EF056D1839
process_names, xrefs: 000001EF056D174D
tcp_local, xrefs: 000001EF056D17FE
pid, xrefs: 000001EF056D1712

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: aadf18decef27ea70d145300f483afa7d657a1880e2cca24712fcebeacc82d83
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: DD715C36711AA086EB709F65E8486DD23B7F795B88F001539EE4E47B2AEFB4C546C340

Function 000001EF056D12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001EF056D1319
GetProcessHeap.KERNEL32 ref: 000001EF056D1327
HeapAlloc.KERNEL32 ref: 000001EF056D1338
RegEnumValueW.ADVAPI32 ref: 000001EF056D1397

Part of subcall function 000001EF056D152C: StrCmpIW.SHLWAPI ref: 000001EF056D155D

GetProcessHeap.KERNEL32 ref: 000001EF056D13DF
HeapAlloc.KERNEL32 ref: 000001EF056D13ED
GetProcessHeap.KERNEL32 ref: 000001EF056D140A
HeapFree.KERNEL32 ref: 000001EF056D1418
lstrlenW.KERNEL32 ref: 000001EF056D1421
GetProcessHeap.KERNEL32 ref: 000001EF056D142F
HeapAlloc.KERNEL32 ref: 000001EF056D143D
StrCpyW.SHLWAPI ref: 000001EF056D145F
GetProcessHeap.KERNEL32 ref: 000001EF056D1476
HeapFree.KERNEL32 ref: 000001EF056D1484

Strings

d, xrefs: 000001EF056D135A

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: ec03f580a342f8ddd3090ab47cd5febb6379062bce6b34ccc72dfbc7d0792102
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 76515C32611B9486EB61CF66E9483DE77A2F389B99F044138EE4907719DFB8C046C700

Function 000001EF056D1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000001EF056D1D1F

Part of subcall function 000001EF056D1FD4: GetModuleHandleA.KERNEL32 ref: 000001EF056D1FEC
Part of subcall function 000001EF056D1FD4: GetProcAddress.KERNEL32 ref: 000001EF056D1FFD

Part of subcall function 000001EF056D5B30: GetCurrentThreadId.KERNEL32 ref: 000001EF056D5B6B

Strings

NtQueryDirectoryFileEx, xrefs: 000001EF056D1D9C
ntdll.dll, xrefs: 000001EF056D1D2D
NtDeviceIoControlFile, xrefs: 000001EF056D1E56
NtResumeThread, xrefs: 000001EF056D1D62
EnumServicesStatusExW, xrefs: 000001EF056D1E11, 000001EF056D1E32
NtEnumerateKey, xrefs: 000001EF056D1DB9
sechost.dll, xrefs: 000001EF056D1E39
NtQueryDirectoryFile, xrefs: 000001EF056D1D7F
NtQuerySystemInformation, xrefs: 000001EF056D1D45
advapi32.dll, xrefs: 000001EF056D1DF7, 000001EF056D1E18
EnumServiceGroupW, xrefs: 000001EF056D1DF0
NtEnumerateValueKey, xrefs: 000001EF056D1DD6

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: a9fdfbc933244c704832b729428d4f766ae64f69a530f2701a05f1dfb8ab6faf
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: A1319AB8A019DAA0EB34DB55EC696DC6363B744744F80583FBC0916667AEF8C24BC760

Function 000001EF056A6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001EF056A6938
__scrt_acquire_startup_lock.LIBCMT ref: 000001EF056A698A
_RTC_Initialize.LIBCMT ref: 000001EF056A69B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001EF056A69DE
__scrt_release_startup_lock.LIBCMT ref: 000001EF056A6A09

Strings

scriptor', xrefs: 000001EF056A6B39, 000001EF056A6BB2, 000001EF056A6BEC
`eh vector vbase copy constructor iterator', xrefs: 000001EF056A69EE
`dynamic initializer for ', xrefs: 000001EF056A69C7
`eh vector copy constructor iterator', xrefs: 000001EF056A6A3B

Memory Dump Source

Source File: 0000002F.00000002.2629591192.000001EF056A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056a0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 31da79c6488f16e94e029edb70b1af133860c8b34bbac48184f4da1a1d9ecc47
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 3F817C71A002C186FA70ABA5D44D3DDB693AB95780F5C803DBE0647797EBB8C8878B00

Function 000001EF056DCE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 000001EF056DCE37
FlsGetValue.KERNEL32(?,?,?,000001EF056E0A6B,?,?,?,000001EF056E045C,?,?,?,000001EF056DC84F), ref: 000001EF056DCE4C
FlsSetValue.KERNEL32(?,?,?,000001EF056E0A6B,?,?,?,000001EF056E045C,?,?,?,000001EF056DC84F), ref: 000001EF056DCE6D
FlsSetValue.KERNEL32(?,?,?,000001EF056E0A6B,?,?,?,000001EF056E045C,?,?,?,000001EF056DC84F), ref: 000001EF056DCE9A
FlsSetValue.KERNEL32(?,?,?,000001EF056E0A6B,?,?,?,000001EF056E045C,?,?,?,000001EF056DC84F), ref: 000001EF056DCEAB
FlsSetValue.KERNEL32(?,?,?,000001EF056E0A6B,?,?,?,000001EF056E045C,?,?,?,000001EF056DC84F), ref: 000001EF056DCEBC
SetLastError.KERNEL32 ref: 000001EF056DCED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000001EF056E0A6B,?,?,?,000001EF056E045C,?,?,?,000001EF056DC84F), ref: 000001EF056DCF0D
FlsSetValue.KERNEL32(?,?,00000001,000001EF056DECCC,?,?,?,?,000001EF056DBF9F,?,?,?,?,?,000001EF056D7AB0), ref: 000001EF056DCF2C

Part of subcall function 000001EF056DD6CC: HeapAlloc.KERNEL32 ref: 000001EF056DD721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001EF056E0A6B,?,?,?,000001EF056E045C,?,?,?,000001EF056DC84F), ref: 000001EF056DCF54

Part of subcall function 000001EF056DD744: HeapFree.KERNEL32 ref: 000001EF056DD75A
Part of subcall function 000001EF056DD744: GetLastError.KERNEL32 ref: 000001EF056DD764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001EF056E0A6B,?,?,?,000001EF056E045C,?,?,?,000001EF056DC84F), ref: 000001EF056DCF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001EF056E0A6B,?,?,?,000001EF056E045C,?,?,?,000001EF056DC84F), ref: 000001EF056DCF76

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: 67c5afce92a63b65f19050179c0d62ece87effc3a4b1bca25b0f817e10d23d2d
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 8C411770B412C881FA79A725D55D3EDA2939F957B0F140F3CBD26466E7DEE98883C220

Function 000001EF056D2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001EF056D2259
GetCurrentProcessId.KERNEL32 ref: 000001EF056D2263

Part of subcall function 000001EF056D1934: OpenProcess.KERNEL32 ref: 000001EF056D1952
Part of subcall function 000001EF056D1934: IsWow64Process.KERNEL32 ref: 000001EF056D1968
Part of subcall function 000001EF056D1934: CloseHandle.KERNEL32 ref: 000001EF056D1983

CreateFileW.KERNEL32 ref: 000001EF056D22BC
WriteFile.KERNEL32 ref: 000001EF056D22E4
ReadFile.KERNEL32 ref: 000001EF056D2303
CloseHandle.KERNEL32 ref: 000001EF056D230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 000001EF056D2293
\\.\pipe\dialerchildproc64, xrefs: 000001EF056D228C

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: aeb96f3d5c5a2a112554736e3f93f72679af0b49db1cb1799eebc8a021b52739
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 3C2121366147A083FB20CB25F55839D77A2F795BA4F504229EE5903BA9DFBCC54ACB00

Function 000001EF056A9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001EF056A99A1

Part of subcall function 000001EF056AA814: __GetUnwindTryBlock.LIBCMT ref: 000001EF056AA857
Part of subcall function 000001EF056AA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001EF056AA87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001EF056A9A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001EF056A9CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001EF056A9DDA

Strings

csm, xrefs: 000001EF056A99BB
csm, xrefs: 000001EF056A9A22
csm, xrefs: 000001EF056A9A9C

Memory Dump Source

Source File: 0000002F.00000002.2629591192.000001EF056A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056a0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 6982df47c188d4e366e8061e8b6ec9c4e75e4d81b76fe62e134036ad0916524f
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 0DE15E72604BC08AEB709BA5D4483DDB7A2F755798F20412AFE4957B9BCF74C592CB00

Function 000001EF056DA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001EF056DA5A1

Part of subcall function 000001EF056DB414: __GetUnwindTryBlock.LIBCMT ref: 000001EF056DB457
Part of subcall function 000001EF056DB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001EF056DB47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001EF056DA679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001EF056DA8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001EF056DA9DA

Strings

csm, xrefs: 000001EF056DA69C
csm, xrefs: 000001EF056DA5BB
csm, xrefs: 000001EF056DA622

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: 265c21803fc96880afd6f203238d106f9b6b28b4e800c19147ad8799df22a2c4
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: D0E16D72A08BC08AEB709FA5D4483DD77A2F745798F140939FE8957B9ACB78C482C710

Function 000001EF056DF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000001EF056DF510
GetProcAddress.KERNEL32 ref: 000001EF056DF51C

Strings

api-ms-, xrefs: 000001EF056DF45A
ext-ms-, xrefs: 000001EF056DF46D

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 81af30677225664974826b26ed58c4314f69550e8db5858cf03e6b92dd4f7242
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 1741C532711A9091EB36CB16E90C7ED6393B745BE0F054A3DAD0A87787EEB8C4478320

Function 000001EF056D104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001EF056D10B1
RegEnumValueW.ADVAPI32 ref: 000001EF056D1117
GetProcessHeap.KERNEL32 ref: 000001EF056D115A
HeapAlloc.KERNEL32 ref: 000001EF056D1168
GetProcessHeap.KERNEL32 ref: 000001EF056D1185
HeapFree.KERNEL32 ref: 000001EF056D1193

Strings

d, xrefs: 000001EF056D10D6

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 698eced6b22baa66ddc1e6839135e4ecab214628fe1241a280653f08a97fe177
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: F7414E33614BC4C6E760CF21E84879E77A2F389B98F448129EE8907759DFB8C54ACB50

Function 000001EF056DD068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000001EF056DC7DE,?,?,?,?,?,?,?,?,000001EF056DCF9D,?,?,00000001), ref: 000001EF056DD087
FlsSetValue.KERNEL32(?,?,?,000001EF056DC7DE,?,?,?,?,?,?,?,?,000001EF056DCF9D,?,?,00000001), ref: 000001EF056DD0A6
FlsSetValue.KERNEL32(?,?,?,000001EF056DC7DE,?,?,?,?,?,?,?,?,000001EF056DCF9D,?,?,00000001), ref: 000001EF056DD0CE
FlsSetValue.KERNEL32(?,?,?,000001EF056DC7DE,?,?,?,?,?,?,?,?,000001EF056DCF9D,?,?,00000001), ref: 000001EF056DD0DF
FlsSetValue.KERNEL32(?,?,?,000001EF056DC7DE,?,?,?,?,?,?,?,?,000001EF056DCF9D,?,?,00000001), ref: 000001EF056DD0F0

Strings

1%, xrefs: 000001EF056DD0CE
Y%, xrefs: 000001EF056DD0A6

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 4298fa7a489992e5017646c619130d062d1300e42a39b57531581410785aa05f
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: 35114F30F046C841FA786726D9593ED62639B957F0F544B3CBC2A066DBDEE9C4438220

Function 000001EF056D7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001EF056D7538
__scrt_acquire_startup_lock.LIBCMT ref: 000001EF056D758A
_RTC_Initialize.LIBCMT ref: 000001EF056D75B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001EF056D75DE
__scrt_release_startup_lock.LIBCMT ref: 000001EF056D7609

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 2022e1a1d8ea8e3f7e27cf0857c159d34407ead0b038d4bcae873d90657ae1e9
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 95817E31E006C186FAB0AB66E4493ED6293E795780F544C3DBD0847797EBF9C9478722

Function 000001EF056D9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000001EF056D9E49
GetLastError.KERNEL32 ref: 000001EF056D9E57
LoadLibraryExW.KERNEL32 ref: 000001EF056D9E81
FreeLibrary.KERNEL32 ref: 000001EF056D9EC7
GetProcAddress.KERNEL32 ref: 000001EF056D9ED3

Strings

api-ms-, xrefs: 000001EF056D9E69

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: bc91c6d956ba39a4cac39bd5116ecfe2c759d3b24ddbf4aaf5ba169a19f31918
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 5431C731712690E1EE36DB42E4087DD6296BB48BA0F590E3DBD1D47392EFB8C446C320

Function 000001EF056E3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001EF056E3DE5
GetLastError.KERNEL32 ref: 000001EF056E3DF1
CloseHandle.KERNEL32 ref: 000001EF056E3E09
CreateFileW.KERNEL32 ref: 000001EF056E3E34
WriteConsoleW.KERNEL32 ref: 000001EF056E3E53

Strings

CONOUT$, xrefs: 000001EF056E3E15

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: f2742a7d5909eea428b741b80b7849ceba276a99b7be5a319b353e76878fc810
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: CB118E31311A9086E7608B16F84839D72A2F798FE4F040229FE5A87796CFB8C9068740

Function 000001EF056D3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001EF056D379E
GetCurrentProcess.KERNEL32 ref: 000001EF056D37CC
VirtualProtectEx.KERNEL32 ref: 000001EF056D37EE
GetCurrentProcess.KERNEL32 ref: 000001EF056D3809
VirtualProtectEx.KERNEL32 ref: 000001EF056D382A

Strings

wr, xrefs: 000001EF056D37FF

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: acadbe3eb09f7d71bc35bf6b8241b61ba8bfaceadb6639e931da8a42f7133f90
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 44118E36701B9082EF649B11F40C2AD63A2F788B84F04083CEE8903756EF7DC506C714

Function 000001EF056D5B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001EF056D5B6B
GetThreadContext.KERNEL32 ref: 000001EF056D5CD5

Part of subcall function 000001EF056D5960: GetCurrentThreadId.KERNEL32 ref: 000001EF056D5964

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: ae8693864295e5a35c3e9f536fdff30c866fb4c2346fda94f2a556b2cc8ed26c
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: CED18B76605B8881DB709B06E49439E77A1F3D8B84F10062AEECE47BA6DF7CC552CB50

Function 000001EF056D2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001EF056D2F27
HeapAlloc.KERNEL32 ref: 000001EF056D2F3A
StrCmpNIW.SHLWAPI ref: 000001EF056D2FAF
GetProcessHeap.KERNEL32 ref: 000001EF056D3015
HeapFree.KERNEL32 ref: 000001EF056D3023

Strings

dialer, xrefs: 000001EF056D2FA8

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 92ec10b019f45fdcae44462127da5290307aff9666fb16c2acd25f204a8a6070
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 8A31C936B01B9182EB35CF16E5587ADA792FB54B84F044838BE4847B57EFB4C462C710

Function 000001EF056D14A4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001EF056D14C5
HeapFree.KERNEL32 ref: 000001EF056D14D4
GetProcessHeap.KERNEL32 ref: 000001EF056D14E1
HeapFree.KERNEL32 ref: 000001EF056D14F0
GetProcessHeap.KERNEL32 ref: 000001EF056D1500

Strings

C:\Windows\System32\svchost.exe, xrefs: 000001EF056E61A9, 000001EF056E61B1

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID: C:\Windows\System32\svchost.exe
API String ID: 3168794593-3822071397
Opcode ID: 5f1dcf0d6982f64b78ee420bc41fcee6693c0fdf65c097574d0a291fc3cf39dd
Instruction ID: 02b52be66b6ff45706aec94799afad1dcb6b305fa9ec0917883751663b106472
Opcode Fuzzy Hash: 5f1dcf0d6982f64b78ee420bc41fcee6693c0fdf65c097574d0a291fc3cf39dd
Instruction Fuzzy Hash: 233197B750ABE08AFB66CB79EC592DD2F63F7A5F40F09803DEE4503257E9A484068700

Function 000001EF056DCFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001EF056DCFAF
FlsSetValue.KERNEL32(?,?,?,000001EF056DD6B5,?,?,?,?,000001EF056DD778), ref: 000001EF056DCFE5
FlsSetValue.KERNEL32(?,?,?,000001EF056DD6B5,?,?,?,?,000001EF056DD778), ref: 000001EF056DD012
FlsSetValue.KERNEL32(?,?,?,000001EF056DD6B5,?,?,?,?,000001EF056DD778), ref: 000001EF056DD023
FlsSetValue.KERNEL32(?,?,?,000001EF056DD6B5,?,?,?,?,000001EF056DD778), ref: 000001EF056DD034
SetLastError.KERNEL32 ref: 000001EF056DD04F

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: ad6bd71dbb2ffb916a646703f8db6216379822b8deb01a87a2f0dce894905efe
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: 85113B30B012C881FA74A726D54D3ED61539B997E4F144A3CBC26467D7DEE9C8438220

Function 000001EF056D199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000001EF056D19C2
K32GetModuleFileNameExW.KERNEL32 ref: 000001EF056D19E0
PathFindFileNameW.SHLWAPI ref: 000001EF056D19EF
lstrlenW.KERNEL32 ref: 000001EF056D19FB
StrCpyW.SHLWAPI ref: 000001EF056D1A0E
CloseHandle.KERNEL32 ref: 000001EF056D1A1C

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: f7dbd9ec9688cc2d10328496d15616cee54abef8c3c11c69e1693a7ffdc8deae
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: F1015731701A9082EA60DB52F84839D63A2F798BC4F884439EE4943756DEBCC98AC740

Function 000001EF056D36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001EF056D36E4
GetCurrentProcess.KERNEL32 ref: 000001EF056D36F2
VirtualProtectEx.KERNEL32 ref: 000001EF056D3714
GetCurrentProcess.KERNEL32 ref: 000001EF056D3732
VirtualProtectEx.KERNEL32 ref: 000001EF056D3753
TerminateThread.KERNEL32 ref: 000001EF056D3762

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: fef18b8453c1c466e35b9681547360562c0e391c63b42431d9fa1743bbd9d084
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: C5013974712B9482EB759B21F81C79D23A2BB55B86F04083CED4906756EFBCC10A8710

Function 000001EF056D8FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001EF056D9013
_IsNonwritableInCurrentImage.LIBCMT ref: 000001EF056D90A8
RtlUnwindEx.NTDLL ref: 000001EF056D90F7

Strings

csm, xrefs: 000001EF056D908E
f, xrefs: 000001EF056D9026

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: 8c2693f3d9bf7d5bb1aee9af743be6b30933a64ee2da31fdc9b00e7aa035c004
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: 3451BF32B016818AEB24DF15E84CB9D37A7F355B98F118938FE164778ADBB5C842C710

Function 000001EF056D1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000001EF056D1A60
StrCmpNIW.SHLWAPI ref: 000001EF056D1A7A
lstrlenW.KERNEL32 ref: 000001EF056D1A89
StrCpyW.SHLWAPI ref: 000001EF056D1A9E

Strings

\\?\, xrefs: 000001EF056D1A6E

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: 5454e596d9030c573d6d3ed28252b642caab70548bd3eefdfc23d8c158034a51
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 7AF0A43270069082EB308B20F8887DD6363F758B98F844038EE4947956DFBCC64ECB00

Function 000001EF056D3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000001EF056D3066
StrCpyW.SHLWAPI ref: 000001EF056D3076
StrCatW.SHLWAPI ref: 000001EF056D3082
PathCombineW.SHLWAPI ref: 000001EF056D3090

Strings

\\.\pipe\, xrefs: 000001EF056D305C

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 94df4960d741f2a3c5eeb7f78af4665eabfef1e918f8397a6dddf511ae0bfb9d
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 41F08230705BD082EA208F13F90C19D6263AB58FD0F085538FE4607B1ADFBCC8468700

Function 000001EF056DBC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001EF056DBCBD
GetProcAddress.KERNEL32 ref: 000001EF056DBCD3
FreeLibrary.KERNEL32 ref: 000001EF056DBCFA

Strings

CorExitProcess, xrefs: 000001EF056DBCCC
mscoree.dll, xrefs: 000001EF056DBCB4

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 2098809f51e181b349ee9a53ce976b49affc76bc21c28d1038c1a31a2751e5de
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: A5F0627121269481EB348B24F44C39D6323FB99765F54063DEE6A451FACFACC5468710

Function 000001EF056D50D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001EF056D5156

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: 02bffea5d5a63f876107c2e123ff812cb1cd26ccd15b216ae589367254470c07
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: EF02C732619BC486EB60CB55E49439EB7A1F3C5780F100529FE8E87BA9DFB8C485CB10

Function 000001EF056D5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001EF056D5726

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: d4233fab29152cf36919dbe7845e61aa8570b793a33cbd469737cd7ce18de2af
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: 27619A36A19B84C6E7B08B15E44835E77A2F398784F100539FE8E47BA9DBB8C551CF10

Function 000001EF056B3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001EF056B352C
_set_statfp.LIBCMT ref: 000001EF056B3547
_set_statfp.LIBCMT ref: 000001EF056B3563
_set_statfp.LIBCMT ref: 000001EF056B359F

Memory Dump Source

Source File: 0000002F.00000002.2629591192.000001EF056A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056a0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 014165b0d9afff56cfa31d5c085a9c1e6d1e9842e63309e2058e453b71de3237
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 3511A073B20AD1D1FAB41568E45E3ED11836B58375F588E3CBE66063E7CAE8CAC74210

Function 000001EF056E4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001EF056E412C
_set_statfp.LIBCMT ref: 000001EF056E4147
_set_statfp.LIBCMT ref: 000001EF056E4163
_set_statfp.LIBCMT ref: 000001EF056E419F

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: e5757c668b37d16235c730b9b7cceac289a5c93896c0571bdaa5a9130e4c3bbd
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 1D114F32A16BF111FE741578DC5D3FE11436BA83AAE19063CBD76466D79EA8C8434200

Function 000001EF056D9650 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001EF056D966F
SetLastError.KERNEL32 ref: 000001EF056D96F6

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 46c896f13dff0714c7ccebb8ca9383bb675cc38bcf091c92c481f4a556b8b138
Instruction ID: c113b4958e5f20a70ea71a357c1ce8e9e46d250940ae5b5f0b4fd1c9716d9fe7
Opcode Fuzzy Hash: 46c896f13dff0714c7ccebb8ca9383bb675cc38bcf091c92c481f4a556b8b138
Instruction Fuzzy Hash: E3111A30B012D482FA749B25E8487ED6293AB547E0F144A3CBD26477D7DAA9C883C720

Function 000001EF056AF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001EF056AF124

Strings

Wednesday, xrefs: 000001EF056AF1ED
or copy constructor iterator', xrefs: 000001EF056AF25A, 000001EF056AF275
Tuesday, xrefs: 000001EF056AF0F4

Memory Dump Source

Source File: 0000002F.00000002.2629591192.000001EF056A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056a0000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 2afd3f955c3733ff75654bc777ddb71a6366763002e127ebd15de92134bf44ab
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 3E61717A6006C082FA759BE5D55C3EEFAA3A785780F50453DFD06137A6EAB4C843CB02

Function 000001EF056DAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000001EF056DAA68
_CallSETranslator.LIBVCRUNTIME ref: 000001EF056DAAB7

Strings

RCC, xrefs: 000001EF056DAA85
MOC, xrefs: 000001EF056DAA7C

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: d64edb6d373f34353f81fe1b268f4877e95f6ea497e85000576f9e30a9c03425
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: C2618133A05B848AEB20DFA5D4443DD77B2F344B98F084629EF4917B9ADBB8C596C710

Function 000001EF056AA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001EF056AA1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001EF056AA288

Strings

csm, xrefs: 000001EF056AA1C2
csm, xrefs: 000001EF056AA2DA

Memory Dump Source

Source File: 0000002F.00000002.2629591192.000001EF056A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056a0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 24c411ae24807c4599a27bf230a48bfe1504b3fc32e6d0480625a10cdebbac59
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: F3515F321002C0CAEB748BD5D54839DB7A2F755B94F18412FEE5987B96CBB9D4A2CF00

Function 000001EF056DAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001EF056DADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001EF056DAE88

Strings

csm, xrefs: 000001EF056DADC2
csm, xrefs: 000001EF056DAEDA

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 9ecfab4edfd1fd56d045ee83b6b2270469e698a7a7b751939a45457873505ac7
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 59518F729082C08AEB748BA6D48839DB7A2F394B84F144939FE4947B96CBB8D452C710

Function 000001EF056A8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001EF056A8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001EF056A84A8

Strings

csm, xrefs: 000001EF056A848E
f, xrefs: 000001EF056A8426

Memory Dump Source

Source File: 0000002F.00000002.2629591192.000001EF056A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056a0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: dd166a5c7f25b1a577e0d12c289f1c62938f0d774839d14c28ea42d60efb64e5
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 8F51A1327116808AEBA4DF55E45CB9DB796F354B98F508138EE164378AEBB4DC428F04

Function 000001EF056A83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001EF056A8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001EF056A84A8

Strings

csm, xrefs: 000001EF056A848E
f, xrefs: 000001EF056A8426

Memory Dump Source

Source File: 0000002F.00000002.2629591192.000001EF056A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056a0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: f4816deb9ea21b8525842fc009ad17c6db12633bead108611eb7a77a8f9cda5b
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 59318D32201680DAE764DF61E84C79DB7A6F340B98F158138FE5B47786DBB8C942CB44

Function 000001EF056E2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000001EF056E20D7
WriteFile.KERNEL32 ref: 000001EF056E239F
WriteFile.KERNEL32 ref: 000001EF056E23E5
GetLastError.KERNEL32 ref: 000001EF056E249B

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 35fa8b51676c63c2aa4f12b7d3506a7db590a6713866780e1e7050beff1da529
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 98D10076B05AD089E721CFA9D4583DC3BB7F354798F00422AEE5A97B9AEA74C507C340

Function 000001EF056E2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000001EF056E2A9C
GetLastError.KERNEL32 ref: 000001EF056E2B27

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 56b34034fb45b03d444ce6d30033f178a03d155f14d4e2316c83aafdffe4279c
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: 4D91D476B116E485F7709F29D4A83ED3BABB704B88F14412DEE0A67696DBB4C487C700

Function 000001EF056D7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000001EF056D798C
GetCurrentThreadId.KERNEL32 ref: 000001EF056D799A
GetCurrentProcessId.KERNEL32 ref: 000001EF056D79A6
QueryPerformanceCounter.KERNEL32 ref: 000001EF056D79B6

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: f569dad9ef132b2a29f801372b2d5feb3b57ddbdb9280db14cacda7fbe510697
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: A9114C32B11B4489EF10CB60E8583EC33A5F719768F440E39EE6D467A5DFB8C1998380

Function 000001EF056D253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001EF056D2620
StrCpyW.SHLWAPI ref: 000001EF056D2639

Strings

\\.\pipe\, xrefs: 000001EF056D262B

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 23d0e5b2af487a24cdae1e249f101a26cb68bcc93e168c9f1c74df57096f67df
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: D971B33AA007C186EBB59F25D8683EE6796F389B84F44043EFD0953B8ADEB5C546C710

Function 000001EF056A9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000001EF056A9EB7

Strings

MOC, xrefs: 000001EF056A9E7C
RCC, xrefs: 000001EF056A9E85

Memory Dump Source

Source File: 0000002F.00000002.2629591192.000001EF056A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056a0000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: ce1aa31338a9c0a6f29c55333db4f2e6b74a1849ac8fcb95c043c384e2f0275f
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: FD616037600B848AEB20DFA5D4443DDB7A2F744B8CF144229EF4917B9ADBB8D596CB00

Function 000001EF056D2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001EF056D2416
StrCpyW.SHLWAPI ref: 000001EF056D242D

Strings

\\.\pipe\, xrefs: 000001EF056D2421

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 840cd630a9b204a4dcf434410a26aa12b829491f1cf504a6646e3c8aef41c21f
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 9251E33AA043C181E6759F29E4AC3FE6753F385780F44093DED4903B5BCAB9C54687A0

Function 000001EF056E26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001EF056E2807
GetLastError.KERNEL32 ref: 000001EF056E2829

Strings

U, xrefs: 000001EF056E27B3

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 1ad4ea21f82d8cd1cdfa34d65a9764b4613e72ab5f15ef25734cba0a9a8e891e
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 2641C272715A9082DB608F25E8583EEB7A7F398794F404039EE4D87795EBBCC446CB40

Function 000001EF056D94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000001EF056D94F0
RaiseException.KERNEL32 ref: 000001EF056D9531

Strings

csm, xrefs: 000001EF056D951E

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: e58183df9718549d57438d426fd561fdfbf145723386fed7df5a9e86cadfa811
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 25112B32615B8082EB618B15F44839D77E6F788B98F584634EE8D07B6ADF7CC552CB00

Function 000001EF056A7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001EF056A737C

Strings

ierarchy Descriptor', xrefs: 000001EF056A7381
riptor at (, xrefs: 000001EF056A7364

Memory Dump Source

Source File: 0000002F.00000002.2629591192.000001EF056A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056a0000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 7b4f4cbdac5b013444302c874f5a74344fbc239b742e3c13087d61d08bfbcab7
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 56E08671640BC4D0EF129F61E8442DC73A1DB68B64B489132EE5C07312FA78D1FAC700

Function 000001EF056A73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001EF056A73D8

Strings

Locator', xrefs: 000001EF056A73DD
riptor at (, xrefs: 000001EF056A73C0

Memory Dump Source

Source File: 0000002F.00000002.2629591192.000001EF056A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056a0000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 42b3c8cad6d169595bb9e830532a938ef58254861cbba5ededc86e54876b1acd
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 62E08671600B84C0EF129F61D4401DC7361E768B54B889132DD4C07312FA78D1E6C700

Function 000001EF056D1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001EF056D1C2D
HeapAlloc.KERNEL32 ref: 000001EF056D1C3B
GetProcessHeap.KERNEL32 ref: 000001EF056D1C77
HeapFree.KERNEL32 ref: 000001EF056D1C85

Part of subcall function 000001EF056D152C: StrCmpIW.SHLWAPI ref: 000001EF056D155D

Memory Dump Source

Source File: 0000002F.00000002.2630089398.000001EF056D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EF056D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_1ef056d0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 9143bb0182314890c745dcae0ff08f898dae5a54ba465a7b310e66d38477ce92
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: C5118235B11B8881EA65DB6AE8082AD73A2F789FC0F18403DEE4D43766DEB8C443C300

Analysis Process: svchost.exePID: 932, Parent PID: 7692COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1680
Total number of Limit Nodes:	7

Executed Functions

Function 000002287AD4202C Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 000002287AD420C6

Part of subcall function 000002287AD42F04: GetProcessHeap.KERNEL32 ref: 000002287AD42F27
Part of subcall function 000002287AD42F04: HeapAlloc.KERNEL32 ref: 000002287AD42F3A
Part of subcall function 000002287AD42F04: StrCmpNIW.SHLWAPI ref: 000002287AD42FAF
Part of subcall function 000002287AD42F04: GetProcessHeap.KERNEL32 ref: 000002287AD43015
Part of subcall function 000002287AD42F04: HeapFree.KERNEL32 ref: 000002287AD43023

Strings

S, xrefs: 000002287AD421E7
dialer, xrefs: 000002287AD420BF

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: S$dialer
API String ID: 756756679-3873981283
Opcode ID: 10a6181ad89868b013f95f8d430f86fb0b73c76b57149a1256a42c526e771eaa
Instruction ID: 15662bb074b80e72114cfb3423b8f995855cf4940197a5156a9bca70ee0bf009
Opcode Fuzzy Hash: 10a6181ad89868b013f95f8d430f86fb0b73c76b57149a1256a42c526e771eaa
Instruction Fuzzy Hash: 3B51B23AB12620A6E7A1CFA5EC4866EEBF5F704B84F658011DF0562B85EF39E841C300

Function 000002287AD41628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000002287AD41633
HeapAlloc.KERNEL32 ref: 000002287AD41642

Part of subcall function 000002287AD41268: GetProcessHeap.KERNEL32 ref: 000002287AD4126E
Part of subcall function 000002287AD41268: HeapAlloc.KERNEL32 ref: 000002287AD4127D
Part of subcall function 000002287AD41268: GetProcessHeap.KERNEL32 ref: 000002287AD41297
Part of subcall function 000002287AD41268: HeapAlloc.KERNEL32 ref: 000002287AD412A8

RegOpenKeyExW.ADVAPI32 ref: 000002287AD416B2
RegOpenKeyExW.ADVAPI32 ref: 000002287AD416DF
RegCloseKey.ADVAPI32 ref: 000002287AD416F9
RegOpenKeyExW.ADVAPI32 ref: 000002287AD41719
RegCloseKey.ADVAPI32 ref: 000002287AD41734
RegOpenKeyExW.ADVAPI32 ref: 000002287AD41754
RegCloseKey.ADVAPI32 ref: 000002287AD4176F
RegOpenKeyExW.ADVAPI32 ref: 000002287AD4178F
RegCloseKey.ADVAPI32 ref: 000002287AD417AA
RegOpenKeyExW.ADVAPI32 ref: 000002287AD417CA
RegCloseKey.ADVAPI32 ref: 000002287AD417E5
RegOpenKeyExW.ADVAPI32 ref: 000002287AD41805
RegCloseKey.ADVAPI32 ref: 000002287AD41820
RegOpenKeyExW.ADVAPI32 ref: 000002287AD41840
RegCloseKey.ADVAPI32 ref: 000002287AD4185B
RegOpenKeyExW.ADVAPI32 ref: 000002287AD4187B
RegCloseKey.ADVAPI32 ref: 000002287AD41896
RegCloseKey.ADVAPI32 ref: 000002287AD418A0

Part of subcall function 000002287AD412BC: RegQueryInfoKeyW.ADVAPI32 ref: 000002287AD41319
Part of subcall function 000002287AD412BC: GetProcessHeap.KERNEL32 ref: 000002287AD41327
Part of subcall function 000002287AD412BC: HeapAlloc.KERNEL32 ref: 000002287AD41338
Part of subcall function 000002287AD412BC: RegEnumValueW.ADVAPI32 ref: 000002287AD41397
Part of subcall function 000002287AD412BC: GetProcessHeap.KERNEL32 ref: 000002287AD413DF
Part of subcall function 000002287AD412BC: HeapAlloc.KERNEL32 ref: 000002287AD413ED
Part of subcall function 000002287AD412BC: GetProcessHeap.KERNEL32 ref: 000002287AD4140A
Part of subcall function 000002287AD412BC: HeapFree.KERNEL32 ref: 000002287AD41418
Part of subcall function 000002287AD412BC: lstrlenW.KERNEL32 ref: 000002287AD41421
Part of subcall function 000002287AD412BC: GetProcessHeap.KERNEL32 ref: 000002287AD4142F
Part of subcall function 000002287AD412BC: HeapAlloc.KERNEL32 ref: 000002287AD4143D

Strings

SOFTWARE\dialerconfig, xrefs: 000002287AD41692
tcp_remote, xrefs: 000002287AD41839
pid, xrefs: 000002287AD41712
udp, xrefs: 000002287AD41874
process_names, xrefs: 000002287AD4174D
service_names, xrefs: 000002287AD417C3
startup, xrefs: 000002287AD416D5
tcp_local, xrefs: 000002287AD417FE
paths, xrefs: 000002287AD41788

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: a596706817863b87f838aa179f978421c9f4ae86b227c0539ecd4e4a78882b94
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: F3713C3A313A10A6EB50DFA5EC98699BBA4F784F99F641111EE4E43B28EF3DD444C340

Function 000002287AD4328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000002287AD432AE
PathFindFileNameW.SHLWAPI ref: 000002287AD432BD

Part of subcall function 000002287AD43844: StrCmpNIW.SHLWAPI ref: 000002287AD4385C

Part of subcall function 000002287AD43790: GetModuleHandleW.KERNEL32 ref: 000002287AD4379E
Part of subcall function 000002287AD43790: GetCurrentProcess.KERNEL32 ref: 000002287AD437CC
Part of subcall function 000002287AD43790: VirtualProtectEx.KERNEL32 ref: 000002287AD437EE
Part of subcall function 000002287AD43790: GetCurrentProcess.KERNEL32 ref: 000002287AD43809
Part of subcall function 000002287AD43790: VirtualProtectEx.KERNEL32 ref: 000002287AD4382A

CreateThread.KERNEL32 ref: 000002287AD4330B

Part of subcall function 000002287AD41D14: GetCurrentThread.KERNEL32 ref: 000002287AD41D1F

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 4549171a1f5c531afcf0fe7ab49f21d0d99b579a59effde18e62c3ae510d035f
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: FB11C03CA13740B2FBA8ABE8FC0D359EA94AB55FC5F745124ED0681590EFBCE0448601

Function 000002287AD41ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002287AD41628: GetProcessHeap.KERNEL32 ref: 000002287AD41633
Part of subcall function 000002287AD41628: HeapAlloc.KERNEL32 ref: 000002287AD41642
Part of subcall function 000002287AD41628: RegOpenKeyExW.ADVAPI32 ref: 000002287AD416B2
Part of subcall function 000002287AD41628: RegOpenKeyExW.ADVAPI32 ref: 000002287AD416DF
Part of subcall function 000002287AD41628: RegCloseKey.ADVAPI32 ref: 000002287AD416F9
Part of subcall function 000002287AD41628: RegOpenKeyExW.ADVAPI32 ref: 000002287AD41719
Part of subcall function 000002287AD41628: RegCloseKey.ADVAPI32 ref: 000002287AD41734
Part of subcall function 000002287AD41628: RegOpenKeyExW.ADVAPI32 ref: 000002287AD41754
Part of subcall function 000002287AD41628: RegCloseKey.ADVAPI32 ref: 000002287AD4176F
Part of subcall function 000002287AD41628: RegOpenKeyExW.ADVAPI32 ref: 000002287AD4178F
Part of subcall function 000002287AD41628: RegCloseKey.ADVAPI32 ref: 000002287AD417AA
Part of subcall function 000002287AD41628: RegOpenKeyExW.ADVAPI32 ref: 000002287AD417CA

Sleep.KERNEL32 ref: 000002287AD41AD7
SleepEx.KERNELBASE ref: 000002287AD41ADD

Part of subcall function 000002287AD41628: RegCloseKey.ADVAPI32 ref: 000002287AD417E5
Part of subcall function 000002287AD41628: RegOpenKeyExW.ADVAPI32 ref: 000002287AD41805
Part of subcall function 000002287AD41628: RegCloseKey.ADVAPI32 ref: 000002287AD41820
Part of subcall function 000002287AD41628: RegOpenKeyExW.ADVAPI32 ref: 000002287AD41840
Part of subcall function 000002287AD41628: RegCloseKey.ADVAPI32 ref: 000002287AD4185B
Part of subcall function 000002287AD41628: RegOpenKeyExW.ADVAPI32 ref: 000002287AD4187B
Part of subcall function 000002287AD41628: RegCloseKey.ADVAPI32 ref: 000002287AD41896
Part of subcall function 000002287AD41628: RegCloseKey.ADVAPI32 ref: 000002287AD418A0

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: e9ba6546107a02f3a590862e2e3c679fc4efb8482df81dc3ce6c9a5a738cc9a0
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 76312F6921264172FFD09BA6DE4D3A9ABA4AB45FC0F345421BE0D87395FF3CE851C210

Non-executed Functions

Function 000002287AD42B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000002287AD42BD0
lstrlenW.KERNEL32 ref: 000002287AD42E0A

Part of subcall function 000002287AD4199C: OpenProcess.KERNEL32 ref: 000002287AD419C2
Part of subcall function 000002287AD4199C: K32GetModuleFileNameExW.KERNEL32 ref: 000002287AD419E0
Part of subcall function 000002287AD4199C: PathFindFileNameW.SHLWAPI ref: 000002287AD419EF
Part of subcall function 000002287AD4199C: lstrlenW.KERNEL32 ref: 000002287AD419FB
Part of subcall function 000002287AD4199C: StrCpyW.SHLWAPI ref: 000002287AD41A0E
Part of subcall function 000002287AD4199C: CloseHandle.KERNEL32 ref: 000002287AD41A1C

GetProcAddress.KERNEL32 ref: 000002287AD42BE5

Part of subcall function 000002287AD4152C: StrCmpIW.SHLWAPI ref: 000002287AD4155D

Part of subcall function 000002287AD43844: StrCmpNIW.SHLWAPI ref: 000002287AD4385C

StrCmpNIW.SHLWAPI ref: 000002287AD42C28
lstrlenW.KERNEL32 ref: 000002287AD42D50

Strings

\Device\Nsi, xrefs: 000002287AD42C1B
NtQueryObject, xrefs: 000002287AD42BDB
ntdll.dll, xrefs: 000002287AD42BC9

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: f1f287d8c6bd32bb43e22e86b497f71c806742b9dd0cf4e6da2d652e8d3b8f54
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: E9B1B56E212B50A2EB94CFA5CC487A9EBA9F744F94F245026EE4953794EF3DEC40C740

Function 000002287AD47D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000002287AD47DAC
RtlCaptureContext.NTDLL ref: 000002287AD47DD9
RtlLookupFunctionEntry.NTDLL ref: 000002287AD47DF3
RtlVirtualUnwind.NTDLL ref: 000002287AD47E34
IsDebuggerPresent.KERNEL32 ref: 000002287AD47E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000002287AD47EA9
UnhandledExceptionFilter.KERNEL32 ref: 000002287AD47EB4

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 8d2513ba9eaed1391154caeca1eddf54d8d4b2d85d5b07c40d5d908adf50f10f
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: E631617A206B8099EBA0DFA0E8443EDB760F784B44F584029DB4E57B94EF3CD548CB10

Function 000002287AD4D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000002287AD4D31D
RtlLookupFunctionEntry.NTDLL ref: 000002287AD4D335
RtlVirtualUnwind.NTDLL ref: 000002287AD4D370
IsDebuggerPresent.KERNEL32 ref: 000002287AD4D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000002287AD4D3B3
UnhandledExceptionFilter.KERNEL32 ref: 000002287AD4D3BE

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 692eaa25d5cf8136ecb5abbd59807d3f4d9a241190cbb6b218dcb9e765191134
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: F2316F3A216B8096EBA0CFA5EC4839EB7A4F789B94F640125EE9D43B54DF3CD145CB00

Function 000002287AD412BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002287AD41319
GetProcessHeap.KERNEL32 ref: 000002287AD41327
HeapAlloc.KERNEL32 ref: 000002287AD41338
RegEnumValueW.ADVAPI32 ref: 000002287AD41397

Part of subcall function 000002287AD4152C: StrCmpIW.SHLWAPI ref: 000002287AD4155D

GetProcessHeap.KERNEL32 ref: 000002287AD413DF
HeapAlloc.KERNEL32 ref: 000002287AD413ED
GetProcessHeap.KERNEL32 ref: 000002287AD4140A
HeapFree.KERNEL32 ref: 000002287AD41418
lstrlenW.KERNEL32 ref: 000002287AD41421
GetProcessHeap.KERNEL32 ref: 000002287AD4142F
HeapAlloc.KERNEL32 ref: 000002287AD4143D
StrCpyW.SHLWAPI ref: 000002287AD4145F
GetProcessHeap.KERNEL32 ref: 000002287AD41476
HeapFree.KERNEL32 ref: 000002287AD41484

Strings

d, xrefs: 000002287AD4135A

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: cd7504fe5d4a49f2a9dd15fd037e1db9fc2661ed73265c538814aa76c4a94205
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: F451933A602B8496EB50CFA2E84C76ABBA1F788FC9F284124DE4907B58DF3DD045C700

Function 000002287AD41D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000002287AD41D1F

Part of subcall function 000002287AD41FD4: GetModuleHandleA.KERNEL32 ref: 000002287AD41FEC
Part of subcall function 000002287AD41FD4: GetProcAddress.KERNEL32 ref: 000002287AD41FFD

Part of subcall function 000002287AD45B30: GetCurrentThreadId.KERNEL32 ref: 000002287AD45B6B

Strings

sechost.dll, xrefs: 000002287AD41E39
NtQueryDirectoryFileEx, xrefs: 000002287AD41D9C
NtEnumerateKey, xrefs: 000002287AD41DB9
NtResumeThread, xrefs: 000002287AD41D62
NtDeviceIoControlFile, xrefs: 000002287AD41E56
NtEnumerateValueKey, xrefs: 000002287AD41DD6
NtQueryDirectoryFile, xrefs: 000002287AD41D7F
NtQuerySystemInformation, xrefs: 000002287AD41D45
EnumServiceGroupW, xrefs: 000002287AD41DF0
ntdll.dll, xrefs: 000002287AD41D2D
EnumServicesStatusExW, xrefs: 000002287AD41E11, 000002287AD41E32
advapi32.dll, xrefs: 000002287AD41DF7, 000002287AD41E18

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 2f4f859470ee0d0b61f0151da4ad4c532a0151ac24b806971137e82f7f756ca3
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: C131B76C50394AB0FA40DFE5EC6D6E4EB31B705B84FB00013A85902565AF3CE64AC361

Function 000002287AD4CE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 000002287AD4CE37
FlsGetValue.KERNEL32(?,?,?,000002287AD50A6B,?,?,?,000002287AD5045C,?,?,?,000002287AD4C84F), ref: 000002287AD4CE4C
FlsSetValue.KERNEL32(?,?,?,000002287AD50A6B,?,?,?,000002287AD5045C,?,?,?,000002287AD4C84F), ref: 000002287AD4CE6D
FlsSetValue.KERNEL32(?,?,?,000002287AD50A6B,?,?,?,000002287AD5045C,?,?,?,000002287AD4C84F), ref: 000002287AD4CE9A
FlsSetValue.KERNEL32(?,?,?,000002287AD50A6B,?,?,?,000002287AD5045C,?,?,?,000002287AD4C84F), ref: 000002287AD4CEAB
FlsSetValue.KERNEL32(?,?,?,000002287AD50A6B,?,?,?,000002287AD5045C,?,?,?,000002287AD4C84F), ref: 000002287AD4CEBC
SetLastError.KERNEL32 ref: 000002287AD4CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000002287AD50A6B,?,?,?,000002287AD5045C,?,?,?,000002287AD4C84F), ref: 000002287AD4CF0D
FlsSetValue.KERNEL32(?,?,00000001,000002287AD4ECCC,?,?,?,?,000002287AD4BF9F,?,?,?,?,?,000002287AD47AB0), ref: 000002287AD4CF2C

Part of subcall function 000002287AD4D6CC: HeapAlloc.KERNEL32 ref: 000002287AD4D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002287AD50A6B,?,?,?,000002287AD5045C,?,?,?,000002287AD4C84F), ref: 000002287AD4CF54

Part of subcall function 000002287AD4D744: HeapFree.KERNEL32 ref: 000002287AD4D75A
Part of subcall function 000002287AD4D744: GetLastError.KERNEL32 ref: 000002287AD4D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002287AD50A6B,?,?,?,000002287AD5045C,?,?,?,000002287AD4C84F), ref: 000002287AD4CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002287AD50A6B,?,?,?,000002287AD5045C,?,?,?,000002287AD4C84F), ref: 000002287AD4CF76

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: caf7a428e3707d06cf654b7f69e18d1049c85e9ed4488eb946d0102582408019
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 35414F2C38324466FEE8A7F55D5E369EA419B45FB4F340724AD36476E6DE3CF4014600

Function 000002287AD42244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 000002287AD42259
GetCurrentProcessId.KERNEL32 ref: 000002287AD42263

Part of subcall function 000002287AD41934: OpenProcess.KERNEL32 ref: 000002287AD41952
Part of subcall function 000002287AD41934: IsWow64Process.KERNEL32 ref: 000002287AD41968
Part of subcall function 000002287AD41934: CloseHandle.KERNEL32 ref: 000002287AD41983

CreateFileW.KERNEL32 ref: 000002287AD422BC
WriteFile.KERNEL32 ref: 000002287AD422E4
ReadFile.KERNEL32 ref: 000002287AD42303
CloseHandle.KERNEL32 ref: 000002287AD4230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 000002287AD4228C
\\.\pipe\dialerchildproc32, xrefs: 000002287AD42293

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: e1a4234d330813a9ef371ee32b6803a7a7fe3c66ce6235c53af086949f8fae27
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: C021653A61674093F750CBA5F84C36ABBA0F789BE5F640215EA5903BA8DF3DD149CB01

Function 000002287AD4A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002287AD4A5A1

Part of subcall function 000002287AD4B414: __GetUnwindTryBlock.LIBCMT ref: 000002287AD4B457
Part of subcall function 000002287AD4B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002287AD4B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002287AD4A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002287AD4A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000002287AD4A9DA

Strings

csm, xrefs: 000002287AD4A69C
csm, xrefs: 000002287AD4A622
csm, xrefs: 000002287AD4A5BB

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: ce4bb4e51dd55c8c3a403ba62ab066672b797156608fab510febe25c61d81552
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: FFE1B47A606B40A6FBA0DFA5D84839DBBB0F755F98F600115EE8957BA5CF38E181C700

Function 000002287AD4F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 000002287AD4F510
GetProcAddress.KERNEL32 ref: 000002287AD4F51C

Strings

api-ms-, xrefs: 000002287AD4F45A
ext-ms-, xrefs: 000002287AD4F46D

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: b48d4e2ada66079e7f28355b30074cfa318d4146a15a4faa6432de62adbb7fab
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 7641D42B313A00B1FB96CBE6AC08795AB95F749FE0F2985259D0E87794EE3CE4458310

Function 000002287AD4104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002287AD410B1
RegEnumValueW.ADVAPI32 ref: 000002287AD41117
GetProcessHeap.KERNEL32 ref: 000002287AD4115A
HeapAlloc.KERNEL32 ref: 000002287AD41168
GetProcessHeap.KERNEL32 ref: 000002287AD41185
HeapFree.KERNEL32 ref: 000002287AD41193

Strings

d, xrefs: 000002287AD410D6

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 247594ec2395e5b07854cc9e5e76116d2821bffb54a4ebe2f88cc0d0e991168f
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 5D417437615B84D6E790CFA1E84875EBBA1F384B98F248115EB8907758DF3DD445CB00

Function 000002287AD4D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FlsGetValue.KERNEL32(?,?,?,000002287AD4C7DE,?,?,?,?,?,?,?,?,000002287AD4CF9D,?,?,00000001), ref: 000002287AD4D087
FlsSetValue.KERNEL32(?,?,?,000002287AD4C7DE,?,?,?,?,?,?,?,?,000002287AD4CF9D,?,?,00000001), ref: 000002287AD4D0A6
FlsSetValue.KERNEL32(?,?,?,000002287AD4C7DE,?,?,?,?,?,?,?,?,000002287AD4CF9D,?,?,00000001), ref: 000002287AD4D0CE
FlsSetValue.KERNEL32(?,?,?,000002287AD4C7DE,?,?,?,?,?,?,?,?,000002287AD4CF9D,?,?,00000001), ref: 000002287AD4D0DF
FlsSetValue.KERNEL32(?,?,?,000002287AD4C7DE,?,?,?,?,?,?,?,?,000002287AD4CF9D,?,?,00000001), ref: 000002287AD4D0F0

Strings

Y%, xrefs: 000002287AD4D0A6
1%, xrefs: 000002287AD4D0CE

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 2a7fe306970342c8d28199f987a5d1fc91bd79add344bf5eb8fd78575c2624d7
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: 1A11932874724465FEE8A7A59D6E369E9419B49FF0F344324ACB9477EADE3CF4028200

Function 000002287AD47510 Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002287AD47538
__scrt_acquire_startup_lock.LIBCMT ref: 000002287AD4758A
_RTC_Initialize.LIBCMT ref: 000002287AD475B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002287AD475DE
__scrt_release_startup_lock.LIBCMT ref: 000002287AD47609

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 1a20a05061dca19b64c9b518e166e6642e95f3179fcebb900232e05332915be4
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 7B81D32CA03741A6FBD0ABE99C4D399EF91A745F80F784415AD0847796DF3CE9458F00

Function 000002287AD49DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32 ref: 000002287AD49E49
GetLastError.KERNEL32 ref: 000002287AD49E57
LoadLibraryExW.KERNEL32 ref: 000002287AD49E81
FreeLibrary.KERNEL32 ref: 000002287AD49EC7
GetProcAddress.KERNEL32 ref: 000002287AD49ED3

Strings

api-ms-, xrefs: 000002287AD49E69

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 584b8c01e0b70e57f26449ff222099f6d06bc89bc709c0222dd7223dd57a1c1d
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 0A31A32D313A40F1EEA1DBC7AC08B65AA95B748FA0F794935AD2E0B794DF3DE4458300

Function 000002287AD53DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000002287AD53DE5
GetLastError.KERNEL32 ref: 000002287AD53DF1
CloseHandle.KERNEL32 ref: 000002287AD53E09
CreateFileW.KERNEL32 ref: 000002287AD53E34
WriteConsoleW.KERNEL32 ref: 000002287AD53E53

Strings

CONOUT$, xrefs: 000002287AD53E15

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 2e77ba979f28693f9f16795037e44967f4cc252b98d81dc257c2ee4cc08d46de
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 6811BF39712B4092E750CB96EC58719FAA4F388FE4F280225EA2A877A4CF7DD8048740

Function 000002287AD43790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000002287AD4379E
GetCurrentProcess.KERNEL32 ref: 000002287AD437CC
VirtualProtectEx.KERNEL32 ref: 000002287AD437EE
GetCurrentProcess.KERNEL32 ref: 000002287AD43809
VirtualProtectEx.KERNEL32 ref: 000002287AD4382A

Strings

wr, xrefs: 000002287AD437FF

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 4e4daf94a97750f91189a1fe9db1e1a2bef8d6cd53c14ffdbccffd97f3392290
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 9A115E2E70674193EF589BA9E808669EAA0F748FD5F680029DE8907754EF3ED505C704

Function 000002287AD45B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002287AD45B6B
GetThreadContext.KERNEL32 ref: 000002287AD45CD5

Part of subcall function 000002287AD45960: GetCurrentThreadId.KERNEL32 ref: 000002287AD45964

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 96f7c51ceef55797b9058ba940676b764a5d8e79acbff97015189cbe06b30fa6
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: 7FD17D7A205B8896DA70DB56E89835ABBA0F7C8F84F200116EECD47BA5DF3CD551CB40

Function 000002287AD42F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002287AD42F27
HeapAlloc.KERNEL32 ref: 000002287AD42F3A
StrCmpNIW.SHLWAPI ref: 000002287AD42FAF
GetProcessHeap.KERNEL32 ref: 000002287AD43015
HeapFree.KERNEL32 ref: 000002287AD43023

Strings

dialer, xrefs: 000002287AD42FA8

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: dabc0e3c40413ed1b4d1046e800613297d4f47542371bcbad35f5b2cf4000f65
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: E831912A703B51A2EA95CF97ED4872AEFA0FB44F80F5841209F4847B55EF3DE4A18700

Function 000002287AD414A4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002287AD414C5
HeapFree.KERNEL32 ref: 000002287AD414D4
GetProcessHeap.KERNEL32 ref: 000002287AD414E1
HeapFree.KERNEL32 ref: 000002287AD414F0
GetProcessHeap.KERNEL32 ref: 000002287AD41500

Strings

C:\Windows\system32\svchost.exe, xrefs: 000002287AD561A9, 000002287AD561B1

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID: C:\Windows\system32\svchost.exe
API String ID: 3168794593-4180442734
Opcode ID: 5f1dcf0d6982f64b78ee420bc41fcee6693c0fdf65c097574d0a291fc3cf39dd
Instruction ID: 3fe35f0a50f390c44dd8ae09ee2fceaf017d6a47418d2b562510470748955b70
Opcode Fuzzy Hash: 5f1dcf0d6982f64b78ee420bc41fcee6693c0fdf65c097574d0a291fc3cf39dd
Instruction Fuzzy Hash: 58316FAF90BAC4AAF351CFF59C59669AFA0F795F40F2D8015DB8403647EE3AE4048742

Function 000002287AD4CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000002287AD4CFAF
FlsSetValue.KERNEL32(?,?,?,000002287AD4D6B5,?,?,?,?,000002287AD4D778), ref: 000002287AD4CFE5
FlsSetValue.KERNEL32(?,?,?,000002287AD4D6B5,?,?,?,?,000002287AD4D778), ref: 000002287AD4D012
FlsSetValue.KERNEL32(?,?,?,000002287AD4D6B5,?,?,?,?,000002287AD4D778), ref: 000002287AD4D023
FlsSetValue.KERNEL32(?,?,?,000002287AD4D6B5,?,?,?,?,000002287AD4D778), ref: 000002287AD4D034
SetLastError.KERNEL32 ref: 000002287AD4D04F

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 4e5582e0474a076cd751713097a6978cafad305db8cb3186a1b749fb2ad0a9f8
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: 17116D2834728061FAE4A7F19D5D369EA42AB89FF4F340724AC76476EADE3CE4018700

Function 000002287AD4199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000002287AD419C2
K32GetModuleFileNameExW.KERNEL32 ref: 000002287AD419E0
PathFindFileNameW.SHLWAPI ref: 000002287AD419EF
lstrlenW.KERNEL32 ref: 000002287AD419FB
StrCpyW.SHLWAPI ref: 000002287AD41A0E
CloseHandle.KERNEL32 ref: 000002287AD41A1C

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: b4893b8b22a76008968fd82bc61f32ca1f37494857043076c37b799cc34e7bee
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 97016929702B8092EB90DB92E84C759ABA1F788FC5FA84035DE4943758DF3DD98AC700

Function 000002287AD436C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000002287AD436E4
GetCurrentProcess.KERNEL32 ref: 000002287AD436F2
VirtualProtectEx.KERNEL32 ref: 000002287AD43714
GetCurrentProcess.KERNEL32 ref: 000002287AD43732
VirtualProtectEx.KERNEL32 ref: 000002287AD43753
TerminateThread.KERNEL32 ref: 000002287AD43762

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: db9bfe011ad0c8e5d4ba0327c1c1c26d38c8a91e6fa98e1031008cafb478a6bc
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 82012D6D71374092FB649BA5EC0C715ABA4BB45FC6F280424DD4907755EF3DD1188701

Function 000002287AD49005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002287AD49013
_IsNonwritableInCurrentImage.LIBCMT ref: 000002287AD490A8
RtlUnwindEx.NTDLL ref: 000002287AD490F7

Strings

f, xrefs: 000002287AD49026
csm, xrefs: 000002287AD4908E

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: b1825bd710485f0bba041030fde6b3a9a1e32f3773c7ed219419e3b9f18b126e
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 0851913A603600A6EB94DBA6DC4CF59BB97F344F88F248124EE1643748DF79E841C700

Function 000002287AD48FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002287AD49013
_IsNonwritableInCurrentImage.LIBCMT ref: 000002287AD490A8
RtlUnwindEx.NTDLL ref: 000002287AD490F7

Strings

f, xrefs: 000002287AD49026
csm, xrefs: 000002287AD4908E

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 3d55c581d8b614482a8c8483e4cd3c223c21377bc6632f8c91a9d0e6a02713a3
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 2E316B3A202640A6E794DFA2EC4CB19BFA6F744F88F258514EE5A07789DF3DE940C705

Function 000002287AD41A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000002287AD41A60
StrCmpNIW.SHLWAPI ref: 000002287AD41A7A
lstrlenW.KERNEL32 ref: 000002287AD41A89
StrCpyW.SHLWAPI ref: 000002287AD41A9E

Strings

\\?\, xrefs: 000002287AD41A6E

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: 644405c38f13191ac5d3427aad02c6610619091a1f91e5372ccbd796ba5111e8
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: CDF04426706641A2F760CFE5FC98759AB61F758BC8FA84020DA4946554DF3DD68DCB00

Function 000002287AD4BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000002287AD4BCBD
GetProcAddress.KERNEL32 ref: 000002287AD4BCD3
FreeLibrary.KERNEL32 ref: 000002287AD4BCFA

Strings

mscoree.dll, xrefs: 000002287AD4BCB4
CorExitProcess, xrefs: 000002287AD4BCCC

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 78a982b147a55b1b38349afcad47d7a4510fb19c9bce9aac28a7a62e5f713fa7
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 96F06269213A04A1EB50CBE8EC4C359AB60EB88B61F780619DA6A461E4CF3DD144C700

Function 000002287AD43044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000002287AD43066
StrCpyW.SHLWAPI ref: 000002287AD43076
StrCatW.SHLWAPI ref: 000002287AD43082
PathCombineW.SHLWAPI ref: 000002287AD43090

Strings

\\.\pipe\, xrefs: 000002287AD4305C

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 3b4a246aa34b08b7a3dd1872fffa9ea369f5f6f0a08b3959c4e5a8415cf3858a
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 6BF05828306B80A2FA44CFD6FD18129AA60AB48FD0F2C8120EE4A07B28DE3CD4858700

Function 000002287AD450D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002287AD45156

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: 2596987db0924f786fdba8dfac169f38f03951093ef5be0b381d591d0a306ff9
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: B202BD36619B8496E7A0CB95E89435AFBA0F3C5B94F204015EE8E87B68DF7DD854CF00

Function 000002287AD45710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002287AD45726

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: 4c97c994bd2bd881d5bb07df5f7f4e8d790058b1eecd8e0ae59bf96262c6ffed
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: 8A61C03A51AB44D6E7A0CB95E84831ABBA4F384B84F200115FE8E47BA8DF7CD945CF00

Function 000002287AD54104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002287AD5412C
_set_statfp.LIBCMT ref: 000002287AD54147
_set_statfp.LIBCMT ref: 000002287AD54163
_set_statfp.LIBCMT ref: 000002287AD5419F

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: de8ce369ea6e310e47ffa966fc16399e177ceee15ae43f98ac52f6f5b8765546
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: E41127AEE83E5031F66892E8DC1D7A58C136B783F4F384624A536076D6CE3EE8404202

Function 000002287AD4AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000002287AD4AA68
_CallSETranslator.LIBVCRUNTIME ref: 000002287AD4AAB7

Strings

MOC, xrefs: 000002287AD4AA7C
RCC, xrefs: 000002287AD4AA85

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 17ef0b28a518a576b9b2106d4f362850be4219ac165f5facea9e2ac532faf5a3
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 3D61B13B606B849AEB50DFA5D84479DBBA1F348F88F244215EF4917BA8DF38E184C700

Function 000002287AD4AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002287AD4ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002287AD4AE88

Strings

csm, xrefs: 000002287AD4ADC2
csm, xrefs: 000002287AD4AEDA

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: e0e40851127b7a61dbf07d7bf29e134bd5ec1da6b04e91dd569283a5f631de7e
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 9651937A206780AAEBB48F959988359BFA0F354F85F244116EE9947BE5CF3CE450C700

Function 000002287AD52058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000002287AD520D7
WriteFile.KERNEL32 ref: 000002287AD5239F
WriteFile.KERNEL32 ref: 000002287AD523E5
GetLastError.KERNEL32 ref: 000002287AD5249B

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: dff244be24b00069661c0f7a21ff929da84c2252b97a53a34125e1d4a83c28a0
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 59D10336B16A80A9E711CFB9D84439CBFB1F354B98F244216CE5997B99EE39D40AC340

Function 000002287AD52980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000002287AD52A9C
GetLastError.KERNEL32 ref: 000002287AD52B27

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: d6bd8fecf8380711298a32fb7ef6d0fb73e2e93f59bea2e542015d71e3c12744
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: 1191D836703650A5F764DFA58C583ADBFA0B715B88F344109DE0A97699EF3ED44AC700

Function 000002287AD47960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000002287AD4798C
GetCurrentThreadId.KERNEL32 ref: 000002287AD4799A
GetCurrentProcessId.KERNEL32 ref: 000002287AD479A6
QueryPerformanceCounter.KERNEL32 ref: 000002287AD479B6

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 48fa9309331cb3859d48dcc39b02a731aa23bbf8a096e8fe0992499ca9744507
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 78111C26712B019AEF40CBA0EC593A877A4F719758F540E21EA6D477A8DF7CD1988380

Function 000002287AD4253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002287AD42620
StrCpyW.SHLWAPI ref: 000002287AD42639

Strings

\\.\pipe\, xrefs: 000002287AD4262B

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 8f96606f629d94357db9f86543fae014b8cc4eda410cac590828ff953256e5ae
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 4971D67A20178166E7A4DFA5DC483AAEF94F389FC4F640016DD0953B89EE3DD545C700

Function 000002287AD42330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002287AD42416
StrCpyW.SHLWAPI ref: 000002287AD4242D

Strings

\\.\pipe\, xrefs: 000002287AD42421

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 95e4a1ddac21b8d21b6efd4a6728b3bd2179ca04cdb9844e0a221d5057f5b55e
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: CD51053A60A381A1E6F4DFA9A85C3BAEF51F395F80F690125DD4D13B49EE3DE5048740

Function 000002287AD526F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000002287AD52807
GetLastError.KERNEL32 ref: 000002287AD52829

Strings

U, xrefs: 000002287AD527B3

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 8dd3ff9a3c28cba6e7fceb608b149d51e4ccedb60315b798c82d5eef4d000739
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: A241E676316A80A6DB20CFA5EC483AABBA0F398B94F644021EE4D87794EF3DD405C740

Function 000002287AD494A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000002287AD494F0
RaiseException.KERNEL32 ref: 000002287AD49531

Strings

csm, xrefs: 000002287AD4951E

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: cf0cf7a52147803433ce0350d0a75bcd98f0a3eff94c5234becb0b83a7d44b71
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 4B113D36216B8092EB618F55F844359BBE5F788F94F684220EE8C47B58DF3DD551CB00

Function 000002287AD41BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002287AD41C2D
HeapAlloc.KERNEL32 ref: 000002287AD41C3B
GetProcessHeap.KERNEL32 ref: 000002287AD41C77
HeapFree.KERNEL32 ref: 000002287AD41C85

Part of subcall function 000002287AD4152C: StrCmpIW.SHLWAPI ref: 000002287AD4155D

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: a533c1df0c3641f7d1140dcae3fbc29e250e71a023e2703c72a14d21572f0e92
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 70118F29A03B4491EA44DBA6AC08629BBA1FB89FC0F284124EE4D43765DF3DE482C300

Function 000002287AD41268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002287AD4126E
HeapAlloc.KERNEL32 ref: 000002287AD4127D
GetProcessHeap.KERNEL32 ref: 000002287AD41297
HeapAlloc.KERNEL32 ref: 000002287AD412A8

Memory Dump Source

Source File: 00000030.00000002.2638207792.000002287AD40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002287AD40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_2287ad40000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 13b30b473d7aa4abd5a4338d40bcb2162bfa758f575faae3169f30695bd86f78
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: BFE03939A0360486EB44CBA2D80876ABAE1EB89B06F1880248A1907751DF7ED499C751

Analysis Process: svchost.exePID: 1044, Parent PID: 7692COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	74
Total number of Limit Nodes:	2

Executed Functions

Function 000001B94DA9328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000001B94DA932AE
PathFindFileNameW.SHLWAPI ref: 000001B94DA932BD

Part of subcall function 000001B94DA93844: StrCmpNIW.SHLWAPI ref: 000001B94DA9385C

Part of subcall function 000001B94DA93790: GetModuleHandleW.KERNEL32 ref: 000001B94DA9379E
Part of subcall function 000001B94DA93790: GetCurrentProcess.KERNEL32 ref: 000001B94DA937CC
Part of subcall function 000001B94DA93790: VirtualProtectEx.KERNEL32 ref: 000001B94DA937EE
Part of subcall function 000001B94DA93790: GetCurrentProcess.KERNEL32 ref: 000001B94DA93809
Part of subcall function 000001B94DA93790: VirtualProtectEx.KERNEL32 ref: 000001B94DA9382A

CreateThread.KERNEL32 ref: 000001B94DA9330B

Part of subcall function 000001B94DA91D14: GetCurrentThread.KERNEL32 ref: 000001B94DA91D1F

Memory Dump Source

Source File: 00000031.00000002.2629564042.000001B94DA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B94DA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b94da90000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: c96ff13c95401dd77f8de147b55b35d7c48e2cd7a1e1fc34b714a5150cdf1649
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 9D11803DA1064086FF609B71FB493EA32B4AF54349F568A659B16816B1FF7CCC4F8610

Function 000001B94DA91ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001B94DA91628: GetProcessHeap.KERNEL32 ref: 000001B94DA91633
Part of subcall function 000001B94DA91628: HeapAlloc.KERNEL32 ref: 000001B94DA91642
Part of subcall function 000001B94DA91628: RegOpenKeyExW.ADVAPI32 ref: 000001B94DA916B2
Part of subcall function 000001B94DA91628: RegOpenKeyExW.ADVAPI32 ref: 000001B94DA916DF
Part of subcall function 000001B94DA91628: RegCloseKey.ADVAPI32 ref: 000001B94DA916F9
Part of subcall function 000001B94DA91628: RegOpenKeyExW.ADVAPI32 ref: 000001B94DA91719
Part of subcall function 000001B94DA91628: RegCloseKey.ADVAPI32 ref: 000001B94DA91734
Part of subcall function 000001B94DA91628: RegOpenKeyExW.ADVAPI32 ref: 000001B94DA91754
Part of subcall function 000001B94DA91628: RegCloseKey.ADVAPI32 ref: 000001B94DA9176F
Part of subcall function 000001B94DA91628: RegOpenKeyExW.ADVAPI32 ref: 000001B94DA9178F
Part of subcall function 000001B94DA91628: RegCloseKey.ADVAPI32 ref: 000001B94DA917AA
Part of subcall function 000001B94DA91628: RegOpenKeyExW.ADVAPI32 ref: 000001B94DA917CA

Sleep.KERNEL32 ref: 000001B94DA91AD7
SleepEx.KERNELBASE ref: 000001B94DA91ADD

Part of subcall function 000001B94DA91628: RegCloseKey.ADVAPI32 ref: 000001B94DA917E5
Part of subcall function 000001B94DA91628: RegOpenKeyExW.ADVAPI32 ref: 000001B94DA91805
Part of subcall function 000001B94DA91628: RegCloseKey.ADVAPI32 ref: 000001B94DA91820
Part of subcall function 000001B94DA91628: RegOpenKeyExW.ADVAPI32 ref: 000001B94DA91840
Part of subcall function 000001B94DA91628: RegCloseKey.ADVAPI32 ref: 000001B94DA9185B
Part of subcall function 000001B94DA91628: RegOpenKeyExW.ADVAPI32 ref: 000001B94DA9187B
Part of subcall function 000001B94DA91628: RegCloseKey.ADVAPI32 ref: 000001B94DA91896
Part of subcall function 000001B94DA91628: RegCloseKey.ADVAPI32 ref: 000001B94DA918A0

Memory Dump Source

Source File: 00000031.00000002.2629564042.000001B94DA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B94DA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b94da90000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: bdb395ece79d3cd103683ddfbc51f61e4cc732ce345513d12d96d83408b1be0f
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 8431FDB9200A4182FF54AB26DB493E933E5AF84BD4F0A5C619F09876B5FF24CC5BC210

Function 000001B94DA93844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 000001B94DA9385C

Strings

dialer, xrefs: 000001B94DA93855

Memory Dump Source

Source File: 00000031.00000002.2629564042.000001B94DA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B94DA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b94da90000_svchost.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction ID: 71f8af887441174848e2e837ea4e684f42409e05527858769fe449d82ed14272
Opcode Fuzzy Hash: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction Fuzzy Hash: 0DD05E7831160586FF149FE789C46A03361AF14748F8E86208A0001270EB588D8F9A10

Function 000001B94DA6273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000001B94DA6285E

Memory Dump Source

Source File: 00000031.00000002.2629149043.000001B94DA60000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B94DA60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b94da60000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 57795ad3bd89589d76509a4d0e431a774af815a63aa21886f5785d395a7cbf25
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 1961007BB01690C7DB548F2596007ADB3A2FB94BA8F198121CF9907798DB38DC5BC700

Non-executed Functions

Function 000001B94DA92B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000001B94DA92BD0
lstrlenW.KERNEL32 ref: 000001B94DA92E0A

Part of subcall function 000001B94DA9199C: OpenProcess.KERNEL32 ref: 000001B94DA919C2
Part of subcall function 000001B94DA9199C: K32GetModuleFileNameExW.KERNEL32 ref: 000001B94DA919E0
Part of subcall function 000001B94DA9199C: PathFindFileNameW.SHLWAPI ref: 000001B94DA919EF
Part of subcall function 000001B94DA9199C: lstrlenW.KERNEL32 ref: 000001B94DA919FB
Part of subcall function 000001B94DA9199C: StrCpyW.SHLWAPI ref: 000001B94DA91A0E
Part of subcall function 000001B94DA9199C: CloseHandle.KERNEL32 ref: 000001B94DA91A1C

GetProcAddress.KERNEL32 ref: 000001B94DA92BE5

Part of subcall function 000001B94DA9152C: StrCmpIW.SHLWAPI ref: 000001B94DA9155D

Part of subcall function 000001B94DA93844: StrCmpNIW.SHLWAPI ref: 000001B94DA9385C

StrCmpNIW.SHLWAPI ref: 000001B94DA92C28
lstrlenW.KERNEL32 ref: 000001B94DA92D50

Strings

\Device\Nsi, xrefs: 000001B94DA92C1B
ntdll.dll, xrefs: 000001B94DA92BC9
NtQueryObject, xrefs: 000001B94DA92BDB

Memory Dump Source

Source File: 00000031.00000002.2629564042.000001B94DA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B94DA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b94da90000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 2b5b56178e1dd60846ff1411c3348c25afdc0c4170f5190034af9a68a1468625
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 98B19B7A211A9086EF648F25C6807E977A5FF44B88F865856EF09537A4EF34CC8BC740

Function 000001B94DA66910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001B94DA66938
__scrt_acquire_startup_lock.LIBCMT ref: 000001B94DA6698A
_RTC_Initialize.LIBCMT ref: 000001B94DA669B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001B94DA669DE
__scrt_release_startup_lock.LIBCMT ref: 000001B94DA66A09

Strings

`eh vector copy constructor iterator', xrefs: 000001B94DA66A3B
scriptor', xrefs: 000001B94DA66B39, 000001B94DA66BB2, 000001B94DA66BEC
`eh vector vbase copy constructor iterator', xrefs: 000001B94DA669EE
`dynamic initializer for ', xrefs: 000001B94DA669C7

Memory Dump Source

Source File: 00000031.00000002.2629149043.000001B94DA60000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B94DA60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b94da60000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 2b7c7a3ff26d452d22de7ec1fd6257963b3f7cd2820866f5c22045ef821cbe87
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 9681EC3A710601CAFB54AB6597413D972E0EF95B80F5E84A5AF89837B6DB38CC4F8700

Function 000001B94DA69944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001B94DA699A1

Part of subcall function 000001B94DA6A814: __GetUnwindTryBlock.LIBCMT ref: 000001B94DA6A857
Part of subcall function 000001B94DA6A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001B94DA6A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001B94DA69A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001B94DA69CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001B94DA69DDA

Strings

csm, xrefs: 000001B94DA699BB
csm, xrefs: 000001B94DA69A22
csm, xrefs: 000001B94DA69A9C

Memory Dump Source

Source File: 00000031.00000002.2629149043.000001B94DA60000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B94DA60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b94da60000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 185b045793e0dd5fa6c77c60bc54875c7f67e5de3b2f8cc83a3ebf1dae97a93b
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 17E19C7A600B80CAEB60DF25D6803DD77A4FB56B88F120515EF8957BA9CB34C99BC701

Function 000001B94DA9104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001B94DA910B1
RegEnumValueW.ADVAPI32 ref: 000001B94DA91117
GetProcessHeap.KERNEL32 ref: 000001B94DA9115A
HeapAlloc.KERNEL32 ref: 000001B94DA91168
GetProcessHeap.KERNEL32 ref: 000001B94DA91185
HeapFree.KERNEL32 ref: 000001B94DA91193

Strings

d, xrefs: 000001B94DA910D6

Memory Dump Source

Source File: 00000031.00000002.2629564042.000001B94DA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B94DA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b94da90000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 9be938eca48de88435d24c63339287b55dbb0c5e3be7a72195a9d72b9edee393
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 4A418537214B84D6EB50CF21E54439EB7A1F789B98F158219DB8907768EF38C84ACB00

Function 000001B94DA9D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000001B94DA9C7DE,?,?,?,?,?,?,?,?,000001B94DA9CF9D,?,?,00000001), ref: 000001B94DA9D087
FlsSetValue.KERNEL32(?,?,?,000001B94DA9C7DE,?,?,?,?,?,?,?,?,000001B94DA9CF9D,?,?,00000001), ref: 000001B94DA9D0A6
FlsSetValue.KERNEL32(?,?,?,000001B94DA9C7DE,?,?,?,?,?,?,?,?,000001B94DA9CF9D,?,?,00000001), ref: 000001B94DA9D0CE
FlsSetValue.KERNEL32(?,?,?,000001B94DA9C7DE,?,?,?,?,?,?,?,?,000001B94DA9CF9D,?,?,00000001), ref: 000001B94DA9D0DF
FlsSetValue.KERNEL32(?,?,?,000001B94DA9C7DE,?,?,?,?,?,?,?,?,000001B94DA9CF9D,?,?,00000001), ref: 000001B94DA9D0F0

Strings

1%, xrefs: 000001B94DA9D0CE
Y%, xrefs: 000001B94DA9D0A6

Memory Dump Source

Source File: 00000031.00000002.2629564042.000001B94DA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B94DA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b94da90000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 7722da8a1ccd55d912fbac9019d21d5b7ed297ac1f66f6f11e942dae4d4dcc93
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: 5B11513970428441FE68972657553F971815F447F0F6A4BA5AB3A076FAFF28CC8B8200

Function 000001B94DA95B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001B94DA95B6B
GetThreadContext.KERNEL32 ref: 000001B94DA95CD5

Part of subcall function 000001B94DA95960: GetCurrentThreadId.KERNEL32 ref: 000001B94DA95964

Memory Dump Source

Source File: 00000031.00000002.2629564042.000001B94DA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B94DA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b94da90000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: a6c60449dc8865bce278dc6f819b9f40a7481718748598da645dd4efd33a2a6b
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: 4FD1BA7A205B8882DA70DB06E59539A7BA0F7C8B84F110556EB8D47BB9DF3CC957CB00

Function 000001B94DA9CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001B94DA9CFAF
FlsSetValue.KERNEL32(?,?,?,000001B94DA9D6B5,?,?,?,?,000001B94DA9D778), ref: 000001B94DA9CFE5
FlsSetValue.KERNEL32(?,?,?,000001B94DA9D6B5,?,?,?,?,000001B94DA9D778), ref: 000001B94DA9D012
FlsSetValue.KERNEL32(?,?,?,000001B94DA9D6B5,?,?,?,?,000001B94DA9D778), ref: 000001B94DA9D023
FlsSetValue.KERNEL32(?,?,?,000001B94DA9D6B5,?,?,?,?,000001B94DA9D778), ref: 000001B94DA9D034
SetLastError.KERNEL32 ref: 000001B94DA9D04F

Memory Dump Source

Source File: 00000031.00000002.2629564042.000001B94DA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B94DA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b94da90000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 2d6bfc0a446fb61f8f57c17015c17e4651d4d8ac2de9b1a8c40aa7bf73c2aa91
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: 43117F3820178041FE64A73657453F972826F847F0F1A4B65AB36477FAFF288C4B8600

Function 000001B94DA99005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001B94DA99013
_IsNonwritableInCurrentImage.LIBCMT ref: 000001B94DA990A8
RtlUnwindEx.NTDLL ref: 000001B94DA990F7

Strings

f, xrefs: 000001B94DA99026
csm, xrefs: 000001B94DA9908E

Memory Dump Source

Source File: 00000031.00000002.2629564042.000001B94DA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B94DA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b94da90000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 68ec67cfde644317781d1d8da9a4473fc41bc061b0f021cae615b38d02cd20cc
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 3B51063A70160096EF94CF15E648B993795FB4AB88F269960DB16477E8FB35CC4BC700

Function 000001B94DA98FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001B94DA99013
_IsNonwritableInCurrentImage.LIBCMT ref: 000001B94DA990A8
RtlUnwindEx.NTDLL ref: 000001B94DA990F7

Strings

f, xrefs: 000001B94DA99026
csm, xrefs: 000001B94DA9908E

Memory Dump Source

Source File: 00000031.00000002.2629564042.000001B94DA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B94DA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b94da90000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 040db3ddf6ae383136a0280ee84918cffc4b9f6a5ab2333838043ca3e9487e01
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 4831F439200640A6EF54DF11E9487993BA4FB45B88F1A8954EF56037A8EB39CD4BC704

Function 000001B94DA93044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000001B94DA93066
StrCpyW.SHLWAPI ref: 000001B94DA93076
StrCatW.SHLWAPI ref: 000001B94DA93082
PathCombineW.SHLWAPI ref: 000001B94DA93090

Strings

\\.\pipe\, xrefs: 000001B94DA9305C

Memory Dump Source

Source File: 00000031.00000002.2629564042.000001B94DA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B94DA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b94da90000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: c6ee8d65ae8d00248a338797ddd6fe5fe4ab245aace9c9a271afe987f135a6b0
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 45F0FE78614B8482FE548B53BA141997661AF48FD0F4E9620EF5647B38EF6CC84B8B10

Function 000001B94DA9BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001B94DA9BCBD
GetProcAddress.KERNEL32 ref: 000001B94DA9BCD3
FreeLibrary.KERNEL32 ref: 000001B94DA9BCFA

Strings

mscoree.dll, xrefs: 000001B94DA9BCB4
CorExitProcess, xrefs: 000001B94DA9BCCC

Memory Dump Source

Source File: 00000031.00000002.2629564042.000001B94DA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B94DA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b94da90000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: ba5d19a53f1952751f1f425006cbb8af14798dd4c05e181ec12188a8432f52b7
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 0CF04F79211A0481FF108B24A5443AA7320AF89B65F5907198B6A452F4DF2DC84FC700

Function 000001B94DA73504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001B94DA7352C
_set_statfp.LIBCMT ref: 000001B94DA73547
_set_statfp.LIBCMT ref: 000001B94DA73563
_set_statfp.LIBCMT ref: 000001B94DA7359F

Memory Dump Source

Source File: 00000031.00000002.2629149043.000001B94DA60000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B94DA60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b94da60000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 79394b6645a282d355233756652c7aa71a169a0ded3c85fa290b7daf37870595
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 4F11C23BA10E1119FEA41528E7523E932916F58374F4B8638ABB6063F6CB68DC4F4200

Function 000001B94DA6F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001B94DA6F124

Strings

Wednesday, xrefs: 000001B94DA6F1ED
or copy constructor iterator', xrefs: 000001B94DA6F25A, 000001B94DA6F275
Tuesday, xrefs: 000001B94DA6F0F4

Memory Dump Source

Source File: 00000031.00000002.2629149043.000001B94DA60000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B94DA60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b94da60000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 4e6107d6c3839f932154574a38960d08c3b217ba2c3ef6c6b5bdfac440d1c861
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 7361AD7E600240C2FA699B68E7443EA7AA1EF85780F574427DB8A077F4EB34CD4F8601

Function 000001B94DA6A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001B94DA6A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001B94DA6A288

Strings

csm, xrefs: 000001B94DA6A1C2
csm, xrefs: 000001B94DA6A2DA

Memory Dump Source

Source File: 00000031.00000002.2629149043.000001B94DA60000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B94DA60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b94da60000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: c73c8bd4d5f19cd1475b82d459c41824adab66629c4531bbf17af45df03cb3c0
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: AB518E3E100780CAEB748F25964439977A0FB55F88F1A4216DBD987BE5CB38D8ABC701

Function 000001B94DA68405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001B94DA68413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001B94DA684A8

Strings

csm, xrefs: 000001B94DA6848E
f, xrefs: 000001B94DA68426

Memory Dump Source

Source File: 00000031.00000002.2629149043.000001B94DA60000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B94DA60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b94da60000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 9c4fe1d770c8cd9973d45c000a20f4ef2b388e4c59b7b5ae355e1f282bd9a290
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 7151DD7A702200CAEB14CB35E644B9837A9FB54B98F568125DB96437E8FB34CC4B8706

Function 000001B94DA683E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001B94DA68413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001B94DA684A8

Strings

csm, xrefs: 000001B94DA6848E
f, xrefs: 000001B94DA68426

Memory Dump Source

Source File: 00000031.00000002.2629149043.000001B94DA60000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B94DA60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b94da60000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: ab51dea73786399f692faa31976dc9adaaa15ab25bc9220aef76076779216550
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 6D319F7A201740D6EB14DF21E94879977A8FB44B98F168014EFAA077A8DB38CD4BC706

Function 000001B94DAA2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000001B94DAA20D7
WriteFile.KERNEL32 ref: 000001B94DAA239F
WriteFile.KERNEL32 ref: 000001B94DAA23E5
GetLastError.KERNEL32 ref: 000001B94DAA249B

Memory Dump Source

Source File: 00000031.00000002.2629564042.000001B94DA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B94DA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b94da90000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: ad8f01ca3d01d7c2f0612becf703cc44c021a01be82e6742a6b1975bddf1fd59
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 9CD1CD36714A808AF711CFA9D6402EC3BB1EB55798F059316CF5A97BA9DB34C85BC340

Function 000001B94DA69E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000001B94DA69EB7

Strings

RCC, xrefs: 000001B94DA69E85
MOC, xrefs: 000001B94DA69E7C

Memory Dump Source

Source File: 00000031.00000002.2629149043.000001B94DA60000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B94DA60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b94da60000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: a9e0a7520a71c3ea0c8b231138a4074f8da6043908b52c405a53a4f2855a9dbc
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 44617B3BA01B84CAEB20DF65D5403DD77A0FB45B88F064215EF8917BA9DB38D99AC700

Function 000001B94DA92330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001B94DA92416
StrCpyW.SHLWAPI ref: 000001B94DA9242D

Strings

\\.\pipe\, xrefs: 000001B94DA92421

Memory Dump Source

Source File: 00000031.00000002.2629564042.000001B94DA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B94DA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b94da90000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 6ce11cda4c209c177238ca766998622cb494d33cecf08a336205543b22ebe854
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: A751EA3A20478141EE34DA29A2983EA7751FBC6758F860565DF5A03B79EB3DCD0F8740

Function 000001B94DA67356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001B94DA6737C

Strings

riptor at (, xrefs: 000001B94DA67364
ierarchy Descriptor', xrefs: 000001B94DA67381

Memory Dump Source

Source File: 00000031.00000002.2629149043.000001B94DA60000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B94DA60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b94da60000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: b77cba94475364b6056217e751ae9763afee11bf71d23422b04273fc26f68f60
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 22E08671641B44D0EF018F21E9442D873A4DF58B64B4991229A5C46361FB38D5EFC300

Function 000001B94DA673B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001B94DA673D8

Strings

riptor at (, xrefs: 000001B94DA673C0
Locator', xrefs: 000001B94DA673DD

Memory Dump Source

Source File: 00000031.00000002.2629149043.000001B94DA60000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B94DA60000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b94da60000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 78c33e3442022b6a32376d0c45522c0c9ad1406811c54d920b18383aafb4daaa
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 7AE08C71A41B48C0EF028F21E9802D873A4EB68B64B899122CA4C46361EB38D5EBC300

Function 000001B94DA91BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001B94DA91C2D
HeapAlloc.KERNEL32 ref: 000001B94DA91C3B
GetProcessHeap.KERNEL32 ref: 000001B94DA91C77
HeapFree.KERNEL32 ref: 000001B94DA91C85

Part of subcall function 000001B94DA9152C: StrCmpIW.SHLWAPI ref: 000001B94DA9155D

Memory Dump Source

Source File: 00000031.00000002.2629564042.000001B94DA90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B94DA90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1b94da90000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 01e50fe647656b25202c61eb090f9d8d763cafe54ad3edf3708de273a8057eea
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 64115B39601B4481EA449B66A6082A977E1EB89FC0F1E45649F4D47775EF38C8478300

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Kawpow new.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Change of critical system settings

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Change of critical system settings

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\wwuujrlkomwy\eejhedztifcv.exe

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FB0D848F74F70BB2EAA93746D24D9749

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_14lxb2me.xns.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gs1rry12.jcn.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mvbm5klb.omy.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ox3wzhkj.oev.ps1

C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

C:\Windows\System32\winevt\Logs\Application.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx

Windows Analysis Report
Kawpow new.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre